Invited users can't register because registration is disabled

[yixuanwu4]

Description

After accepting an organization invitation via the "Accept Invitation" button, I'm redirected to the registration page. I filled the form using my name and email, but submitting it fails with the error "Registration is disabled." This makes it impossible to complete the invitation flow and join the organization.

• Self registration is disabled via APP_ENABLE_REGISTRATION="false"
• Invitations can still be sent

The rationale is, that even though self registration is disabled, it should be possible to invite people and that they set their own password.

Steps To Reproduce

1. Receive an organization invitation email.
2. Click "Accept Invitation."
3. Get redirected to the registration page (name and email pre-filled).
4. Fill in the password fields, agree to the Terms of Service, and click "Register."
5. See the error "Registration is disabled" under the email field.

Self-hosted or Cloud?

Self-Hosted

Version of solidtime: (for self-hosted)

0.15.0

solidtime self-hosting guide: (for self-hosted)

https://docs.solidtime.io/self-hosting/guides/docker

[Onatcer]

i initially thought this is a regression caused by the recently released invite changes but looking again this was always the case and was also brought up in discussions before. Something to consider: Allowing registration for all invited users would basically mean that every user that has an account could overrule APP_ENABLE_REGISTRATION="false" by inviting someone in an organization that they own (f.e. an organization they just created).

I understand this is the behaviour some (probably most) people are expecting, however changing the behaviour of this env would cause an authoritative regression in the registration behaviour. And especially for bigger instances I think there should be way to actually make sure user registration rules cannot be circumvented by the lowest-privileged users. Maybe its better to have a separate env for this.

[yixuanwu4]

i initially thought this is a regression caused by the recently released invite changes but looking again this was always the case and was also brought up in discussions before. Something to consider: Allowing registration for all invited users would basically mean that every user that has an account could overrule APP_ENABLE_REGISTRATION="false" by inviting someone in an organization that they own (f.e. an organization they just created).

I understand this is the behaviour some (probably most) people are expecting, however changing the behaviour of this env would cause an authoritative regression in the registration behaviour. And especially for bigger instances I think there should be way to actually make sure user registration rules cannot be circumvented by the lowest-privileged users. Maybe its better to have a separate env for this.

I think that with another env would be a clean solution. Something like:

APP_ENABLE_REGISTRATION_UPON_INVITE="true" which defaults to false wouldn't be a authoritative regression.

What even would be more useful if we can define a role that is minimally needed for invites:

APP_INVITE_MINIMUM_ROLE="admin"

[josevavia]

I've encountered the exact same problem. I'm inviting users in my organization using my admin/superadmin account, and they receive the emails, but they can't complete the activation process because registration is disabled.

Enabling registration via APP_ENABLE_REGISTRATION would allow anyone with the link to my instance to register, which isn't a good idea.

I think the reasonable approach would be users who access the registration page via a secure "accept invitation" link to be able to register without needing APP_ENABLE_REGISTRATION:true. In this case, the email address input should be automatically filled in on the registration form (without allowing them to change it). Wouldn't this be the correct way to implement the invitation system?