coze-dev / coze-dev/coze-studio

fix: registration whitelist (ALLOW_REGISTRATION_EMAIL) never works when registration is disabled

Open Beginner friendly
#2,731 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
21.6k
Forks
3.1k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When `DISABLE_USER_REGISTRATION=true` and `ALLOW_REGISTRATION_EMAIL` is set to a whitelist (e.g. `ALLOW_REGISTRATION_EMAIL="alice@example.com"`), the registration whitelist never works: every registration attempt is rejected with `The user registration has been disabled by the administrator. Please contact the administrator!`, even for whitelisted emails.

**Root cause**

In `backend/bizpkg/config/base/base.go`, `getBasicConfigurationFromOldConfig()` populates `AllowRegistrationEmail` from the wrong environment variable:

```go
AllowRegistrationEmail: os.Getenv(consts.DisableUserRegistration),
```

It should read `ALLOW_REGISTRATION_EMAIL` (`consts.AllowRegistrationEmail`). Because `DISABLE_USER_REGISTRATION` is set to `"true"` in this scenario, the whitelist becomes the single-element list `["true"]`, which never contains a real email, so `allowRegisterChecker` always returns false.

**To Reproduce**

1. Set in `.env`: `DISABLE_USER_REGISTRATION=true` and `ALLOW_REGISTRATION_EMAIL="neuroai@neurotrace.net"`
2. Restart the server
3. Try to register an account with `neuroai@neurotrace.net`

**Expected behavior**

Only the email(s) listed in `ALLOW_REGISTRATION_EMAIL` can register; other emails are rejected.

**Actual behavior**

All registration attempts (including whitelisted emails) are rejected with "The user registration has been disabled by the administrator."

**Version**

Current `main` (the bug has existed since the persisted base config was introduced, ~PR #2303, Oct 2025).

**Environment**

Any (env-based deployment; independent of the database, since `getBasicConfigurationFromOldConfig()` is the fallback used when no base config is persisted yet).

**Additional context**

- The original feature PR #208 read the correct env var directly; the wrong env var was introduced later when the config moved to the persisted `BasicConfiguration`.
- `AdminAuthMW` already uses `consts.AllowRegistrationEmail` correctly for the admin email fallback; only the registration whitelist path is broken.

Contributor guide

Open the contributing guide

Research direction

Start in backend/bizpkg/config/base/base.go at getBasicConfigurationFromOldConfig() and compare its environment-variable handling with the AdminAuthMW fallback mentioned in the issue. Reproduce with DISABLE_USER_REGISTRATION=true and a whitelisted ALLOW_REGISTRATION_EMAIL; done means the listed email can register while other emails remain rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.