feat(auth): invite-only / capped signup gate - #3715

Merged

PierreBrisorgueil merged 15 commits into

masterfrom

feat/invite-only-signup-gate

May 28, 2026

Commits on May 28, 2026

feat(users): add exact count() for signup cap enforcement
PierreBrisorgueil
committed
bdc679e
feat(auth): scaffold signup invitation model, schema, and CASL policy
PierreBrisorgueil
committed
9cd352f
fix(auth): drop duplicate token unique index on Invitation (keep explicit index)
PierreBrisorgueil
committed
f213b52
feat(auth): invitation repository + service (token gen, validation, consume)
PierreBrisorgueil
committed
cc82613
feat(auth): admin invitation CRUD + public verify endpoint + email template
PierreBrisorgueil
committed
16cac79
fix(auth): inline invitation routes into auth.routes (single reg, before :strategy wildcard)
PierreBrisorgueil
committed
c1f6c1d
feat(auth): gate local signup by cap + invite token, consume on success
PierreBrisorgueil
committed
52406ee
feat(auth): gate OAuth signup by cap + email-matched invite, consume on success
PierreBrisorgueil
committed
290b91f
docs(auth): document signup access control (cap + invitations) in README + OpenAPI
PierreBrisorgueil
committed
edbc2de
chore(auth): verify fixups for invitation signup gate
PierreBrisorgueil
committed
3c45aca
fix(auth): enforce invite email-pin on no-email signup; hide token from admin list
PierreBrisorgueil
committed
5ba9358
fix(auth): address CodeRabbit/Copilot review findings on invite gate
PierreBrisorgueil
committed
4fd1edc
fix(auth): canonicalize invited signup email to invite (single-use under concurrent case-variants)
PierreBrisorgueil
committed
ec3de30
test(users): isolate count unit test from Organization model (deterministic CI)
PierreBrisorgueil
committed
045a4d4
fix(auth): require verified provider email before OAuth invite matching (gate bypass)
PierreBrisorgueil
committed
43abee0

Navigation Menu

Uh oh!

Uh oh!

feat(auth): invite-only / capped signup gate - #3715

feat(auth): invite-only / capped signup gate#3715
PierreBrisorgueil merged 15 commits into
masterfrom
feat/invite-only-signup-gate

Commits on May 28, 2026

feat(users): add exact count() for signup cap enforcement

feat(auth): scaffold signup invitation model, schema, and CASL policy

fix(auth): drop duplicate token unique index on Invitation (keep explicit index)

feat(auth): invitation repository + service (token gen, validation, consume)

feat(auth): admin invitation CRUD + public verify endpoint + email template

fix(auth): inline invitation routes into auth.routes (single reg, before :strategy wildcard)

feat(auth): gate local signup by cap + invite token, consume on success

feat(auth): gate OAuth signup by cap + email-matched invite, consume on success

docs(auth): document signup access control (cap + invitations) in README + OpenAPI

chore(auth): verify fixups for invitation signup gate

fix(auth): enforce invite email-pin on no-email signup; hide token from admin list

fix(auth): address CodeRabbit/Copilot review findings on invite gate

fix(auth): canonicalize invited signup email to invite (single-use under concurrent case-variants)

test(users): isolate count unit test from Organization model (deterministic CI)

fix(auth): require verified provider email before OAuth invite matching (gate bypass)