From 6b112fc1be462ad353264325fac466a22c6d6675 Mon Sep 17 00:00:00 2001
From: Alexey Zinoviev <alexey.zinoviev@xored.com>
Date: Tue, 15 Oct 2024 14:03:55 +0400
Subject: [PATCH] UBERF-8429: Allow to disable sign-ups (#6934)

Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com>
---
 .vscode/launch.json                           |  3 +-
 dev/docker-compose.yaml                       |  2 +
 .../src/components/Form.svelte                |  3 +-
 .../src/components/LoginApp.svelte            |  7 ++--
 .../src/components/LoginForm.svelte           |  5 ++-
 .../src/components/LoginOtpForm.svelte        |  4 +-
 .../src/components/LoginPasswordForm.svelte   |  2 +
 .../src/components/OtpForm.svelte             |  3 +-
 .../src/components/PasswordRequest.svelte     |  5 ++-
 .../src/components/SignupForm.svelte          |  6 +++
 .../src/components/Tabs.svelte                | 23 ++++++-----
 plugins/login/src/index.ts                    |  3 +-
 pods/authProviders/src/github.ts              | 39 ++++++++++++++-----
 pods/authProviders/src/google.ts              | 26 +++++++++----
 pods/authProviders/src/index.ts               |  8 ++--
 pods/authProviders/src/openid.ts              | 39 ++++++++++++++-----
 pods/authProviders/src/token.ts               |  3 +-
 server/account-service/src/index.ts           |  7 +++-
 server/account/src/operations.ts              | 14 +++++--
 server/front/src/index.ts                     |  2 +
 server/front/src/starter.ts                   |  5 ++-
 21 files changed, 148 insertions(+), 61 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index c1f2a92066..4b97af00c9 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -97,7 +97,8 @@
         "SES_URL": "",
         "MINIO_ACCESS_KEY": "minioadmin",
         "MINIO_SECRET_KEY": "minioadmin",
-        "MINIO_ENDPOINT": "localhost"
+        "MINIO_ENDPOINT": "localhost",
+        // "DISABLE_SIGNUP": "true",
         // "INIT_SCRIPT_URL": "https://raw.githubusercontent.com/hcengineering/init/main/script.yaml",
         // "INIT_WORKSPACE": "onboarding",
       },
diff --git a/dev/docker-compose.yaml b/dev/docker-compose.yaml
index b9784be4ce..d000ac9d5a 100644
--- a/dev/docker-compose.yaml
+++ b/dev/docker-compose.yaml
@@ -85,6 +85,7 @@ services:
       - LAST_NAME_FIRST=true
       - ACCOUNTS_URL=http://host.docker.internal:3000
       - BRANDING_PATH=/var/cfg/branding.json
+      # - DISABLE_SIGNUP=true
       # - INIT_SCRIPT_URL=https://raw.githubusercontent.com/hcengineering/init/main/script.yaml
       # - INIT_WORKSPACE=onboarding      
     restart: unless-stopped
@@ -197,6 +198,7 @@ services:
       - DESKTOP_UPDATES_URL=https://dist.huly.io
       - DESKTOP_UPDATES_CHANNEL=dev
       - BRANDING_URL=http://host.docker.internal:8087/branding.json
+      # - DISABLE_SIGNUP=true
     restart: unless-stopped
   transactor:
     image: hardcoreeng/transactor
diff --git a/plugins/login-resources/src/components/Form.svelte b/plugins/login-resources/src/components/Form.svelte
index ab4028b92b..a9ee5d1bd6 100644
--- a/plugins/login-resources/src/components/Form.svelte
+++ b/plugins/login-resources/src/components/Form.svelte
@@ -57,6 +57,7 @@
   export let ignoreInitialValidation: boolean = false
   export let withProviders: boolean = false
   export let subtitle: string | undefined = undefined
+  export let signUpDisabled = false
 
   $: $themeStore.language && validate($themeStore.language)
 
@@ -138,7 +139,7 @@
   }}
 >
   {#if loginState !== 'none'}
-    <Tabs {loginState} />
+    <Tabs {loginState} {signUpDisabled} />
   {:else}
     {#if subtitle !== undefined}
       <div class="fs-title">
diff --git a/plugins/login-resources/src/components/LoginApp.svelte b/plugins/login-resources/src/components/LoginApp.svelte
index 77174900fa..d0c9b64ef7 100644
--- a/plugins/login-resources/src/components/LoginApp.svelte
+++ b/plugins/login-resources/src/components/LoginApp.svelte
@@ -54,6 +54,7 @@
 
   export let page: Pages = 'signup'
 
+  const signUpDisabled = getMetadata(login.metadata.DisableSignUp) ?? false
   let navigateUrl: string | undefined
 
   onDestroy(location.subscribe(updatePageLoc))
@@ -134,13 +135,13 @@
       <Scroller padding={'1rem 0'}>
         <div class="form-content">
           {#if page === 'login'}
-            <LoginForm {navigateUrl} />
+            <LoginForm {navigateUrl} {signUpDisabled} />
           {:else if page === 'signup'}
-            <SignupForm />
+            <SignupForm {signUpDisabled} />
           {:else if page === 'createWorkspace'}
             <CreateWorkspaceForm />
           {:else if page === 'password'}
-            <PasswordRequest />
+            <PasswordRequest {signUpDisabled} />
           {:else if page === 'recovery'}
             <PasswordRestore />
           {:else if page === 'selectWorkspace'}
diff --git a/plugins/login-resources/src/components/LoginForm.svelte b/plugins/login-resources/src/components/LoginForm.svelte
index 2d8973b45b..ced1085f38 100644
--- a/plugins/login-resources/src/components/LoginForm.svelte
+++ b/plugins/login-resources/src/components/LoginForm.svelte
@@ -21,6 +21,7 @@
   import login from '../plugin'
 
   export let navigateUrl: string | undefined = undefined
+  export let signUpDisabled = false
 
   let method: LoginMethods = LoginMethods.Otp
 
@@ -44,12 +45,12 @@
 </script>
 
 {#if method === LoginMethods.Otp}
-  <LoginOtpForm {navigateUrl} on:change={changeMethod} />
+  <LoginOtpForm {navigateUrl} {signUpDisabled} on:change={changeMethod} />
   <div class="action">
     <BottomActionComponent action={loginWithPasswordAction} />
   </div>
 {:else}
-  <LoginPasswordForm {navigateUrl} on:change={changeMethod} />
+  <LoginPasswordForm {navigateUrl} {signUpDisabled} on:change={changeMethod} />
   <div class="action">
     <BottomActionComponent action={loginWithCodeAction} />
   </div>
diff --git a/plugins/login-resources/src/components/LoginOtpForm.svelte b/plugins/login-resources/src/components/LoginOtpForm.svelte
index 1782cc1d76..1ecf5943aa 100644
--- a/plugins/login-resources/src/components/LoginOtpForm.svelte
+++ b/plugins/login-resources/src/components/LoginOtpForm.svelte
@@ -21,6 +21,7 @@
   import { OtpLoginSteps, sendOtp } from '../index'
 
   export let navigateUrl: string | undefined = undefined
+  export let signUpDisabled = false
 
   const fields = [{ id: 'email', name: 'username', i18n: login.string.Email }]
   const formData = {
@@ -57,11 +58,12 @@
     {fields}
     object={formData}
     {action}
+    {signUpDisabled}
     ignoreInitialValidation
     withProviders
   />
 {/if}
 
 {#if step === OtpLoginSteps.Otp && formData.username !== ''}
-  <OtpForm email={formData.username} {navigateUrl} retryOn={otpRetryOn} on:step={handleStep} />
+  <OtpForm email={formData.username} {signUpDisabled} {navigateUrl} retryOn={otpRetryOn} on:step={handleStep} />
 {/if}
diff --git a/plugins/login-resources/src/components/LoginPasswordForm.svelte b/plugins/login-resources/src/components/LoginPasswordForm.svelte
index d5ac9c37a5..29bb4169ff 100644
--- a/plugins/login-resources/src/components/LoginPasswordForm.svelte
+++ b/plugins/login-resources/src/components/LoginPasswordForm.svelte
@@ -21,6 +21,7 @@
   import login from '../plugin'
 
   export let navigateUrl: string | undefined = undefined
+  export let signUpDisabled = false
 
   const fields = [
     { id: 'email', name: 'username', i18n: login.string.Email },
@@ -62,6 +63,7 @@
   {fields}
   {object}
   {action}
+  {signUpDisabled}
   bottomActions={[recoveryAction]}
   ignoreInitialValidation
   withProviders
diff --git a/plugins/login-resources/src/components/OtpForm.svelte b/plugins/login-resources/src/components/OtpForm.svelte
index 057e850cdb..dd655817be 100644
--- a/plugins/login-resources/src/components/OtpForm.svelte
+++ b/plugins/login-resources/src/components/OtpForm.svelte
@@ -28,6 +28,7 @@
   export let navigateUrl: string | undefined = undefined
   export let email: string
   export let retryOn: Timestamp
+  export let signUpDisabled = false
 
   const dispatch = createEventDispatcher()
 
@@ -232,7 +233,7 @@
   style:min-height={$deviceInfo.docHeight > 720 ? '42rem' : '0'}
 >
   <div class="header">
-    <Tabs loginState="login" />
+    <Tabs loginState="login" {signUpDisabled} />
     <div class="description">
       <Label label={login.string.SentTo} />
       <span class="email ml-1">
diff --git a/plugins/login-resources/src/components/PasswordRequest.svelte b/plugins/login-resources/src/components/PasswordRequest.svelte
index 8072bc16d8..2ddb3142fb 100644
--- a/plugins/login-resources/src/components/PasswordRequest.svelte
+++ b/plugins/login-resources/src/components/PasswordRequest.svelte
@@ -23,8 +23,9 @@
   import { BottomAction } from '..'
   import { signUpAction } from '../actions'
 
-  const fields = [{ id: 'email', name: 'username', i18n: login.string.Email }]
+  export let signUpDisabled = false
 
+  const fields = [{ id: 'email', name: 'username', i18n: login.string.Email }]
   const object = {
     username: ''
   }
@@ -64,7 +65,7 @@
         goTo('login')
       }
     },
-    signUpAction
+    ...(signUpDisabled ? [] : [signUpAction])
   ]
 </script>
 
diff --git a/plugins/login-resources/src/components/SignupForm.svelte b/plugins/login-resources/src/components/SignupForm.svelte
index 747e5f4ef4..57268ccaf3 100644
--- a/plugins/login-resources/src/components/SignupForm.svelte
+++ b/plugins/login-resources/src/components/SignupForm.svelte
@@ -21,6 +21,8 @@
   import { goTo, signUp } from '../utils'
   import Form from './Form.svelte'
 
+  export let signUpDisabled = false
+
   const fields = [
     { id: 'given-name', name: 'first', i18n: login.string.FirstName, short: true },
     { id: 'family-name', name: 'last', i18n: login.string.LastName, short: true },
@@ -39,6 +41,10 @@
 
   let status: Status<any> = OK
 
+  if (signUpDisabled) {
+    goTo('login')
+  }
+
   const action = {
     i18n: login.string.SignUp,
     func: async () => {
diff --git a/plugins/login-resources/src/components/Tabs.svelte b/plugins/login-resources/src/components/Tabs.svelte
index 0b90eb28d9..303d62cd1a 100644
--- a/plugins/login-resources/src/components/Tabs.svelte
+++ b/plugins/login-resources/src/components/Tabs.svelte
@@ -19,6 +19,7 @@
   import login from '../plugin'
 
   export let loginState: 'login' | 'signup' | 'none' = 'none'
+  export let signUpDisabled = false
 
   const goTab = (path: string) => {
     const loc = getCurrentLocation()
@@ -29,16 +30,18 @@
 </script>
 
 <div class="flex-row-center caption">
-  <a
-    class="title"
-    class:selected={loginState === 'signup'}
-    href="."
-    on:click|preventDefault={() => {
-      if (loginState !== 'signup') goTab('signup')
-    }}
-  >
-    <Label label={login.string.SignUp} />
-  </a>
+  {#if !signUpDisabled}
+    <a
+      class="title"
+      class:selected={loginState === 'signup'}
+      href="."
+      on:click|preventDefault={() => {
+        if (loginState !== 'signup') goTab('signup')
+      }}
+    >
+      <Label label={login.string.SignUp} />
+    </a>
+  {/if}
   <a
     class="title"
     class:selected={loginState === 'login'}
diff --git a/plugins/login/src/index.ts b/plugins/login/src/index.ts
index 1e87384389..933a301820 100644
--- a/plugins/login/src/index.ts
+++ b/plugins/login/src/index.ts
@@ -72,7 +72,8 @@ export default plugin(loginId, {
     LoginTokens: '' as Metadata<Record<string, string>>,
     LastToken: '' as Metadata<string>,
     LoginEndpoint: '' as Metadata<string>,
-    LoginEmail: '' as Metadata<string>
+    LoginEmail: '' as Metadata<string>,
+    DisableSignUp: '' as Metadata<boolean>
   },
   component: {
     LoginApp: '' as AnyComponent,
diff --git a/pods/authProviders/src/github.ts b/pods/authProviders/src/github.ts
index f1f1f08792..0feed30ece 100644
--- a/pods/authProviders/src/github.ts
+++ b/pods/authProviders/src/github.ts
@@ -13,7 +13,8 @@ export function registerGithub (
   accountsUrl: string,
   dbPromise: Promise<AccountDB>,
   frontUrl: string,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled?: boolean
 ): string | undefined {
   const GITHUB_CLIENT_ID = process.env.GITHUB_CLIENT_ID
   const GITHUB_CLIENT_SECRET = process.env.GITHUB_CLIENT_SECRET
@@ -69,7 +70,7 @@ export function registerGithub (
         const [first, last] = ctx.state.user.displayName?.split(' ') ?? [ctx.state.user.username, '']
         measureCtx.info('Provider auth handler', { email, type: 'github' })
         if (email !== undefined) {
-          let loginInfo: LoginInfo
+          let loginInfo: LoginInfo | null
           const state = safeParseAuthState(ctx.query?.state)
           const branding = getBranding(brandings, state?.branding)
           const db = await dbPromise
@@ -78,17 +79,35 @@ export function registerGithub (
               githubId: ctx.state.user.id
             })
           } else {
-            loginInfo = await loginWithProvider(measureCtx, db, null, email, first, last, {
-              githubId: ctx.state.user.id
-            })
+            loginInfo = await loginWithProvider(
+              measureCtx,
+              db,
+              null,
+              email,
+              first,
+              last,
+              {
+                githubId: ctx.state.user.id
+              },
+              signUpDisabled
+            )
           }
 
-          const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
-          const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
+          if (loginInfo === null) {
+            measureCtx.info('Failed to auth: no associated account found', {
+              email,
+              type: 'github',
+              user: ctx.state?.user
+            })
+            ctx.redirect(concatLink(branding?.front ?? frontUrl, '/login'))
+          } else {
+            const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
+            const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
 
-          measureCtx.info('Success auth, redirect', { email, type: 'github', target: origin })
-          // Successful authentication, redirect to your application
-          ctx.redirect(`${origin}?${query}`)
+            measureCtx.info('Success auth, redirect', { email, type: 'github', target: origin })
+            // Successful authentication, redirect to your application
+            ctx.redirect(`${origin}?${query}`)
+          }
         }
       } catch (err: any) {
         measureCtx.error('failed to auth', { err, type: 'github', user: ctx.state?.user })
diff --git a/pods/authProviders/src/google.ts b/pods/authProviders/src/google.ts
index b35463d123..7133aee96b 100644
--- a/pods/authProviders/src/google.ts
+++ b/pods/authProviders/src/google.ts
@@ -13,7 +13,8 @@ export function registerGoogle (
   accountsUrl: string,
   dbPromise: Promise<AccountDB>,
   frontUrl: string,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled?: boolean
 ): string | undefined {
   const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID
   const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET
@@ -70,22 +71,31 @@ export function registerGoogle (
       measureCtx.info('Provider auth handler', { email, type: 'google' })
       if (email !== undefined) {
         try {
-          let loginInfo: LoginInfo
+          let loginInfo: LoginInfo | null
           const state = safeParseAuthState(ctx.query?.state)
           const branding = getBranding(brandings, state?.branding)
           const db = await dbPromise
           if (state.inviteId != null && state.inviteId !== '') {
             loginInfo = await joinWithProvider(measureCtx, db, null, email, first, last, state.inviteId as any)
           } else {
-            loginInfo = await loginWithProvider(measureCtx, db, null, email, first, last)
+            loginInfo = await loginWithProvider(measureCtx, db, null, email, first, last, undefined, signUpDisabled)
           }
 
-          const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
-          const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
+          if (loginInfo === null) {
+            measureCtx.info('Failed to auth: no associated account found', {
+              email,
+              type: 'google',
+              user: ctx.state?.user
+            })
+            ctx.redirect(concatLink(branding?.front ?? frontUrl, '/login'))
+          } else {
+            const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
+            const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
 
-          // Successful authentication, redirect to your application
-          measureCtx.info('Success auth, redirect', { email, type: 'google', target: origin })
-          ctx.redirect(`${origin}?${query}`)
+            // Successful authentication, redirect to your application
+            measureCtx.info('Success auth, redirect', { email, type: 'google', target: origin })
+            ctx.redirect(`${origin}?${query}`)
+          }
         } catch (err: any) {
           measureCtx.error('failed to auth', { err, type: 'google', user: ctx.state?.user })
         }
diff --git a/pods/authProviders/src/index.ts b/pods/authProviders/src/index.ts
index d458f9b008..1cc29a4e89 100644
--- a/pods/authProviders/src/index.ts
+++ b/pods/authProviders/src/index.ts
@@ -18,7 +18,8 @@ export type AuthProvider = (
   accountsUrl: string,
   db: Promise<AccountDB>,
   frontUrl: string,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled?: boolean
 ) => string | undefined
 
 export function registerProviders (
@@ -28,7 +29,8 @@ export function registerProviders (
   db: Promise<AccountDB>,
   serverSecret: string,
   frontUrl: string | undefined,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled: boolean = false
 ): void {
   const accountsUrl = process.env.ACCOUNTS_URL
   if (accountsUrl === undefined) {
@@ -63,7 +65,7 @@ export function registerProviders (
   const res: string[] = []
   const providers: AuthProvider[] = [registerGoogle, registerGithub, registerOpenid]
   for (const provider of providers) {
-    const value = provider(ctx, passport, router, accountsUrl, db, frontUrl, brandings)
+    const value = provider(ctx, passport, router, accountsUrl, db, frontUrl, brandings, signUpDisabled)
     if (value !== undefined) res.push(value)
   }
 
diff --git a/pods/authProviders/src/openid.ts b/pods/authProviders/src/openid.ts
index 2c468a9e18..297c1a5b0c 100644
--- a/pods/authProviders/src/openid.ts
+++ b/pods/authProviders/src/openid.ts
@@ -28,7 +28,8 @@ export function registerOpenid (
   accountsUrl: string,
   dbPromise: Promise<AccountDB>,
   frontUrl: string,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled?: boolean
 ): string | undefined {
   const openidClientId = process.env.OPENID_CLIENT_ID
   const openidClientSecret = process.env.OPENID_CLIENT_SECRET
@@ -90,7 +91,7 @@ export function registerOpenid (
         const [first, last] = ctx.state.user.name?.split(' ') ?? [ctx.state.user.username, '']
         measureCtx.info('Provider auth handler', { email, type: 'openid' })
         if (email !== undefined) {
-          let loginInfo: LoginInfo
+          let loginInfo: LoginInfo | null
           const state = safeParseAuthState(ctx.query?.state)
           const branding = getBranding(brandings, state?.branding)
           const db = await dbPromise
@@ -99,17 +100,35 @@ export function registerOpenid (
               openId: ctx.state.user.sub
             })
           } else {
-            loginInfo = await loginWithProvider(measureCtx, db, null, email, first, last, {
-              openId: ctx.state.user.sub
-            })
+            loginInfo = await loginWithProvider(
+              measureCtx,
+              db,
+              null,
+              email,
+              first,
+              last,
+              {
+                openId: ctx.state.user.sub
+              },
+              signUpDisabled
+            )
           }
 
-          const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
-          const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
+          if (loginInfo === null) {
+            measureCtx.info('Failed to auth: no associated account found', {
+              email,
+              type: 'openid',
+              user: ctx.state?.user
+            })
+            ctx.redirect(concatLink(branding?.front ?? frontUrl, '/login'))
+          } else {
+            const origin = concatLink(branding?.front ?? frontUrl, '/login/auth')
+            const query = encodeURIComponent(qs.stringify({ token: loginInfo.token }))
 
-          measureCtx.info('Success auth, redirect', { email, type: 'openid', target: origin })
-          // Successful authentication, redirect to your application
-          ctx.redirect(`${origin}?${query}`)
+            measureCtx.info('Success auth, redirect', { email, type: 'openid', target: origin })
+            // Successful authentication, redirect to your application
+            ctx.redirect(`${origin}?${query}`)
+          }
         }
       } catch (err: any) {
         measureCtx.error('failed to auth', { err, type: 'openid', user: ctx.state?.user })
diff --git a/pods/authProviders/src/token.ts b/pods/authProviders/src/token.ts
index 87aa30c151..3c9aa1e303 100644
--- a/pods/authProviders/src/token.ts
+++ b/pods/authProviders/src/token.ts
@@ -13,7 +13,8 @@ export function registerToken (
   accountsUrl: string,
   dbPromise: Promise<AccountDB>,
   frontUrl: string,
-  brandings: BrandingMap
+  brandings: BrandingMap,
+  signUpDisabled?: boolean
 ): string | undefined {
   passport.use(
     'token',
diff --git a/server/account-service/src/index.ts b/server/account-service/src/index.ts
index 22da0613ac..cc95a5142d 100644
--- a/server/account-service/src/index.ts
+++ b/server/account-service/src/index.ts
@@ -30,7 +30,6 @@ import os from 'os'
  */
 export function serveAccount (measureCtx: MeasureContext, brandings: BrandingMap, onClose?: () => void): void {
   console.log('Starting account service with brandings: ', brandings)
-  const methods = getMethods()
   const ACCOUNT_PORT = parseInt(process.env.ACCOUNT_PORT ?? '3000')
   const dbUrl = process.env.DB_URL
   if (dbUrl === undefined) {
@@ -81,6 +80,9 @@ export function serveAccount (measureCtx: MeasureContext, brandings: BrandingMap
     setMetadata(toolPlugin.metadata.InitScriptURL, initScriptUrl)
   }
 
+  const hasSignUp = process.env.DISABLE_SIGNUP !== 'true'
+  const methods = getMethods(hasSignUp)
+
   const accountsDb = getAccountDB(dbUrl)
 
   const app = new Koa()
@@ -105,7 +107,8 @@ export function serveAccount (measureCtx: MeasureContext, brandings: BrandingMap
     }),
     serverSecret,
     frontURL,
-    brandings
+    brandings,
+    !hasSignUp
   )
 
   void accountsDb.then((res) => {
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
index 71a82adefc..a8e3ab09bc 100644
--- a/server/account/src/operations.ts
+++ b/server/account/src/operations.ts
@@ -2334,8 +2334,9 @@ export async function loginWithProvider (
   _email: string,
   first: string,
   last: string,
-  extra?: Record<string, string>
-): Promise<LoginInfo> {
+  extra?: Record<string, string>,
+  signUpDisabled: boolean = false
+): Promise<LoginInfo | null> {
   try {
     const email = cleanEmail(_email)
     if (last == null) {
@@ -2357,6 +2358,11 @@ export async function loginWithProvider (
       }
       return result
     }
+
+    if (signUpDisabled) {
+      return null
+    }
+
     const newAccount = await createAcc(ctx, db, branding, email, null, first, last, true, true, extra)
 
     const result = {
@@ -2463,7 +2469,7 @@ export async function deleteWorkspace (
 /**
  * @public
  */
-export function getMethods (): Record<string, AccountMethod> {
+export function getMethods (hasSignUp: boolean = true): Record<string, AccountMethod> {
   return {
     login: wrap(login),
     join: wrap(join),
@@ -2478,7 +2484,7 @@ export function getMethods (): Record<string, AccountMethod> {
     getInviteLink: wrap(getInviteLink),
     getAccountInfo: wrap(getAccountInfo),
     getWorkspaceInfo: wrap(getWorkspaceInfo),
-    createAccount: wrap(createAccount),
+    ...(hasSignUp ? { createAccount: wrap(createAccount) } : {}),
     createWorkspace: wrap(createUserWorkspace),
     assignWorkspace: wrap(assignWorkspace),
     removeWorkspace: wrap(removeWorkspace),
diff --git a/server/front/src/index.ts b/server/front/src/index.ts
index 03e3d63040..a174f93b00 100644
--- a/server/front/src/index.ts
+++ b/server/front/src/index.ts
@@ -257,6 +257,7 @@ export function start (
     brandingUrl?: string
     previewConfig: string
     pushPublicKey?: string
+    disableSignUp?: string
   },
   port: number,
   extraConfig?: Record<string, string | undefined>
@@ -308,6 +309,7 @@ export function start (
       BRANDING_URL: config.brandingUrl,
       PREVIEW_CONFIG: config.previewConfig,
       PUSH_PUBLIC_KEY: config.pushPublicKey,
+      DISABLE_SIGNUP: config.disableSignUp,
       ...(extraConfig ?? {})
     }
     res.status(200)
diff --git a/server/front/src/starter.ts b/server/front/src/starter.ts
index bc6dc4a6ac..e1301978f7 100644
--- a/server/front/src/starter.ts
+++ b/server/front/src/starter.ts
@@ -118,6 +118,8 @@ export function startFront (ctx: MeasureContext, extraConfig?: Record<string, st
 
   setMetadata(serverToken.metadata.Secret, serverSecret)
 
+  const disableSignUp = process.env.DISABLE_SIGNUP
+
   const config = {
     elasticUrl,
     storageAdapter,
@@ -134,7 +136,8 @@ export function startFront (ctx: MeasureContext, extraConfig?: Record<string, st
     collaborator,
     brandingUrl,
     previewConfig,
-    pushPublicKey
+    pushPublicKey,
+    disableSignUp
   }
   console.log('Starting Front service with', config)
   const shutdown = start(ctx, config, SERVER_PORT, extraConfig)