coze-dev / coze-dev/coze-studio
fix: registration whitelist (ALLOW_REGISTRATION_EMAIL) never works when registration is disabled
- Dominant language
- TypeScript
- Stars
- 21.6k
- Forks
- 3.1k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When `DISABLE_USER_REGISTRATION=true` and `ALLOW_REGISTRATION_EMAIL` is set to a whitelist (e.g. `ALLOW_REGISTRATION_EMAIL="alice@example.com"`), the registration whitelist never works: every registration attempt is rejected with `The user registration has been disabled by the administrator. Please contact the administrator!`, even for whitelisted emails.
**Root cause**
In `backend/bizpkg/config/base/base.go`, `getBasicConfigurationFromOldConfig()` populates `AllowRegistrationEmail` from the wrong environment variable:
```go
AllowRegistrationEmail: os.Getenv(consts.DisableUserRegistration),
```
It should read `ALLOW_REGISTRATION_EMAIL` (`consts.AllowRegistrationEmail`). Because `DISABLE_USER_REGISTRATION` is set to `"true"` in this scenario, the whitelist becomes the single-element list `["true"]`, which never contains a real email, so `allowRegisterChecker` always returns false.
**To Reproduce**
1. Set in `.env`: `DISABLE_USER_REGISTRATION=true` and `ALLOW_REGISTRATION_EMAIL="neuroai@neurotrace.net"`
2. Restart the server
3. Try to register an account with `neuroai@neurotrace.net`
**Expected behavior**
Only the email(s) listed in `ALLOW_REGISTRATION_EMAIL` can register; other emails are rejected.
**Actual behavior**
All registration attempts (including whitelisted emails) are rejected with "The user registration has been disabled by the administrator."
**Version**
Current `main` (the bug has existed since the persisted base config was introduced, ~PR #2303, Oct 2025).
**Environment**
Any (env-based deployment; independent of the database, since `getBasicConfigurationFromOldConfig()` is the fallback used when no base config is persisted yet).
**Additional context**
- The original feature PR #208 read the correct env var directly; the wrong env var was introduced later when the config moved to the persisted `BasicConfiguration`.
- `AdminAuthMW` already uses `consts.AllowRegistrationEmail` correctly for the admin email fallback; only the registration whitelist path is broken.
Contributor guide
Research direction
Start in backend/bizpkg/config/base/base.go at getBasicConfigurationFromOldConfig() and compare its environment-variable handling with the AdminAuthMW fallback mentioned in the issue. Reproduce with DISABLE_USER_REGISTRATION=true and a whitelisted ALLOW_REGISTRATION_EMAIL; done means the listed email can register while other emails remain rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100