From 58cabe974cf6c09b87da7fe52a193baa1d1b4f04 Mon Sep 17 00:00:00 2001 From: Souptik Datta Date: Tue, 30 Jul 2024 16:56:20 +0530 Subject: [PATCH] fix: Add signup disabled flag check on signup route (#15844) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: Add signup disabled flag check on signup api Signed-off-by: Souptik Datta * feat: Implement a feature flag check trcp middleware Signed-off-by: Souptik Datta * Discard changes to packages/trpc/server/middlewares/featureFlagMiddleware.ts * Discard changes to packages/trpc/server/routers/viewer/organizations/_router.tsx --------- Signed-off-by: Souptik Datta Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com> Co-authored-by: Omar López Co-authored-by: Peer Richelsen --- apps/web/pages/api/auth/signup.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/apps/web/pages/api/auth/signup.ts b/apps/web/pages/api/auth/signup.ts index 7a7c6ac46c..fde16c45fe 100644 --- a/apps/web/pages/api/auth/signup.ts +++ b/apps/web/pages/api/auth/signup.ts @@ -3,6 +3,7 @@ import type { NextApiResponse } from "next"; import calcomSignupHandler from "@calcom/feature-auth/signup/handlers/calcomHandler"; import selfHostedSignupHandler from "@calcom/feature-auth/signup/handlers/selfHostedHandler"; import { type RequestWithUsernameStatus } from "@calcom/features/auth/signup/username"; +import { getFeatureFlag } from "@calcom/features/flags/server/utils"; import { IS_PREMIUM_USERNAME_ENABLED } from "@calcom/lib/constants"; import getIP from "@calcom/lib/getIP"; import { HttpError } from "@calcom/lib/http-error"; @@ -10,17 +11,20 @@ import logger from "@calcom/lib/logger"; import { checkCfTurnstileToken } from "@calcom/lib/server/checkCfTurnstileToken"; import { signupSchema } from "@calcom/prisma/zod-utils"; -function ensureSignupIsEnabled(req: RequestWithUsernameStatus) { +async function ensureSignupIsEnabled(req: RequestWithUsernameStatus) { const { token } = signupSchema .pick({ token: true, }) .parse(req.body); - // Stil allow signups if there is a team invite + // Still allow signups if there is a team invite if (token) return; - if (process.env.NEXT_PUBLIC_DISABLE_SIGNUP === "true") { + const prisma = await import("@calcom/prisma").then((mod) => mod.default); + const signupDisabled = await getFeatureFlag(prisma, "disable-signup"); + + if (process.env.NEXT_PUBLIC_DISABLE_SIGNUP === "true" || signupDisabled) { throw new HttpError({ statusCode: 403, message: "Signup is disabled", @@ -47,7 +51,7 @@ export default async function handler(req: RequestWithUsernameStatus, res: NextA }); ensureReqIsPost(req); - ensureSignupIsEnabled(req); + await ensureSignupIsEnabled(req); /** * Im not sure its worth merging these two handlers. They are different enough to be separate.