Feature Request: Add ability to disable anonymous user signup

[ColourfulField]

Scope & Context

I am looking to create a setup with multiple workspaces, each assigned to a person I know personally.

I want to give access to the CRM manually and disable signup for anonymous users.

Current behavior

Currently when setting IS_MULTIWORKSPACE_ENABLED, all anonymous users can freely create new accounts and new workspaces.

Also, when setting an env variable IS_WORKSPACE_CREATION_LIMITED_TO_WORKSPACE_ADMINS=true, non-admin users who are already registered can no longer create workspaces. However, it does not prevent new account signups and workspace creation for those accounts.

More info here: #13460

Expected behavior

Option 1

IS_WORKSPACE_CREATION_LIMITED_TO_WORKSPACE_ADMINS=true disables workspace creation for both registered and anonymous users.

For me this is a preferrable option due to how the variable is named. Since it was only introduced 2 months ago and wasn't added to the documentation or environment variable list inside admin panel, I assume that the impact of changing this behavior is low.

Option 2

reintroduce IS_SIGN_UP_DISABLED variable. Setting this varialbe to true disables signup for anonymous users when IS_MULTIWORKSPACE_ENABLED=true.

Technical inputs

The following code could be relevant in sign-in-up.service.ts. What I'm looking for is a way to disable signup when this.isFirstWorkspaceForUser(currentUser.id) === true

 async checkWorkspaceCreationIsAllowedOrThrow(
    currentUser: UserEntity,
  ): Promise<void> {
    if (!this.isWorkspaceCreationLimitedToServerAdmins()) return;

    if (await this.isFirstWorkspaceForUser(currentUser.id)) return;

    if (!currentUser.canAccessFullAdminPanel) {
      throw new AuthException(
        'Workspace creation is restricted to admins',
        AuthExceptionCode.FORBIDDEN_EXCEPTION,
        {
          userFriendlyMessage: msg`Workspace creation is restricted to admins`,
        },
      );
    }
  }

Extra info

It might make sense to add the existing env variable IS_WORKSPACE_CREATION_LIMITED_TO_WORKSPACE_ADMINS to the list of config variables visible in the admin panel.

[BOHEUS]

CC: @Bonapara

[Bonapara]

@ColourfulField thanks for raising this issue. We will turn this into a discussion as it’s not planned for the short term. If you're self-hosting, you could use a reverse proxy to block or redirect the signup API routes and the frontend signup page?

[FelixMalfait]

Thanks for the report!

@claude If I understand correctly, the author is saying that when IS_WORKSPACE_CREATION_LIMITED_TO_SERVER_ADMINS is set to true, then anonymous users can still create workspaces? Please double check if it's the case, because it would indeed be a bug. The author mentions IS_WORKSPACE_CREATION_LIMITED_TO_WORKSPACE_ADMINS but the correct variable name is IS_WORKSPACE_CREATION_LIMITED_TO_SERVER_ADMINS maybe that's where the error comes from? If it's a misinterpretation from the variable name then please close this discussion as well as PR #17610 ; if it's an actual bug then raise a PR
You might not have the permissions to do this so if you fail to perform a task please raise a PR to adjust your permissions so we can try again later

[github-actions[bot]]

Claude finished processing this request. See workflow run

[Avataw]

I support @ColourfulField

I just setup my self-hosted Twenty and I was surprised to see that there was no easy way to disable anonymous sign ups.

Option 2 makes more sense to me.

[FelixMalfait]

Yes agree this was a bug, not intentional. It's been merged, will be included in the next major release 1.17!