fix(auth): expose register_enabled in /api/status and gate sign-up link on login page

[Gnonymous]

Problem

/api/status never returned register_enabled or password_register_enabled, so the sign-in page could not react when an admin toggled the Registration Enabled setting in the admin panel.

The "Sign up" link on the login page was only gated on self_use_mode_enabled — a separate and unrelated concept (single-user self-hosted mode vs. multi-user deployment). This creates two concrete bugs:

1. Registration disabled, link still visible: If RegisterEnabled = false but SelfUseModeEnabled = false, the "Sign up" link is shown. Users reach the sign-up page, fill in the form, and get a backend error — a confusing dead end.
2. Registration enabled, link invisible: If RegisterEnabled = true but SelfUseModeEnabled = true (common after the setup wizard selects self-use mode), the link is permanently hidden regardless of the admin setting.

Root Cause

controller/misc.go → GetStatus() builds the /api/status payload but omits register_enabled and password_register_enabled. The frontend type definitions (features/auth/types.ts) already declare these fields, but since the backend never sends them, they are always undefined at runtime and the sign-in page cannot use them.

Fix

controller/misc.go — expose two fields in the status response:

"register_enabled":          common.RegisterEnabled,
"password_register_enabled": common.PasswordRegisterEnabled,

web/default/src/features/auth/sign-in/index.tsx — gate the Sign Up link on both settings:

// before
{!status?.self_use_mode_enabled && (

// after
{!status?.self_use_mode_enabled && status?.register_enabled !== false && (

!== false (rather than === true) keeps the link visible for any client that has not yet received the new field (e.g. cached status), preserving backward compatibility.

Checklist

• Backend: register_enabled and password_register_enabled now included in /api/status
• Frontend: sign-in page respects register_enabled when deciding whether to show the Sign Up link
• No new dependencies, no schema changes
• Backward compatible — clients that do not receive the new fields default to showing the link (same behavior as before this fix)

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes

• Sign-in screen now correctly respects registration configuration settings when displaying the sign-up prompt.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c31638de-c15a-4c0d-b4ca-17fd51ec415b

📥 Commits

Reviewing files that changed from the base of the PR and between 18282e6 and 1f51774.

📒 Files selected for processing (2)

• controller/misc.go
• web/default/src/features/auth/sign-in/index.tsx

---

Walkthrough

The backend status endpoint now exposes two registration configuration fields to clients. The frontend sign-in screen uses one of these fields to conditionally show the signup prompt, restricting visibility when registration is disabled on the server.

Changes

Registration Configuration

Layer / File(s)	Summary
Registration configuration exposure and sign-up visibility controller/misc.go, web/default/src/features/auth/sign-in/index.tsx	GetStatus endpoint adds register_enabled and password_register_enabled fields to the response payload. The SignIn component conditionally renders the "Don't have an account? Sign up" prompt when status?.register_enabled !== false and !status?.self_use_mode_enabled.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A rabbit once set a gate,
With switches to control fate—
"Sign up here!" the prompt would say,
But only on a server's whim, hooray! 🐰✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes both main changes: exposing register_enabled in the API status endpoint and gating the sign-up link based on this configuration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Calcium-Ion]

Approving. Root cause and impact analysis are accurate:

• /api/status previously omitted register_enabled / password_register_enabled, while the default frontend types already declared them, so they were silently undefined.
• Gating the sign-up link on self_use_mode_enabled alone created two real dead-ends (registration disabled + link visible, registration enabled + link hidden under self-use).

Backend additions in controller/misc.go and the corresponding gate in web/default/src/features/auth/sign-in/index.tsx are minimal and consistent.