Repository navigation
LLM-735: open signup keeps the access-form code - #373
Merged
Merged
Conversation
With open registration on, register.html skipped the code step and never read ?code= from the URL, so accounts made through the access form were never linked to their request: the invite stayed unused and the email stayed off the account. The page now sends the URL code when open. The route drops a bad, used or expired code (at the first read or under the row lock) and registers code-less instead of refusing, since the code only links the request when anyone may sign up. Invite-only mode still refuses a bad code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LLM-735
With
open_registration = true,register.htmlhid the code step and never read?code=from the URL, so accounts made through the landing access form were never linked to their access request (invite stayed unused, email never reached the account).register.html: when open, take?code=from the URL intovalidatedCode(code step stays hidden).registration.js: a sharedinviteProblem()check for both the Phase 1 read and the Phase 3FOR UPDATEre-read. Under open registration a bad, used or expired code is dropped and the signup goes code-less (host realm, no email) instead of a 400. Invite-only mode refuses exactly as before.registration.test.js(6 tests): good code links invite + email; used/expired/unknown codes fall back when open; a code lost under the row lock falls back when open; no-code open signup; invite-only still refuses. The two fallback tests fail against the old route.Full suite: 282 pass.
Agent: Home
🤖 Generated with Claude Code