Disable self-registration by default

config/settings/base.py

@@ -163,6 +163,7 @@ CELERY_RESULT_SERIALIZER = 'json'
 SAAS_MODE = os.environ.get('SAAS_MODE', 'False').lower() == 'true'
 BILLING_ENABLED = SAAS_MODE
 USAGE_LIMITS_ENABLED = SAAS_MODE
+ALLOW_SELF_REGISTRATION = os.environ.get('ALLOW_SELF_REGISTRATION', 'False').lower() == 'true'
 
 # Login settings
 LOGIN_URL = '/login/'

templates/users/login.html

@@ -33,8 +33,10 @@
         <button type="submit" class="btn btn-primary btn-full">Login</button>
     </form>
 
+    {% if allow_self_registration %}
     <p class="auth-footer">
         Don't have an account? <a href="{% url 'register' %}">Register</a>
     </p>
+    {% endif %}
 </div>
 {% endblock %}

users/views.py

@@ -3,6 +3,7 @@ User views for KeepItGoing.
 """
 
 from django.contrib.auth import get_user_model, login, logout
+from django.conf import settings
 from django.shortcuts import render, redirect
 from django.utils import timezone
 from django.views import View
@@ -27,6 +28,13 @@ from .throttles import LoginRateThrottle, RegisterRateThrottle
 User = get_user_model()
 
 
+def self_registration_disabled_response():
+    """Standard response payload for disabled self-registration."""
+    return {
+        'detail': 'Self-registration is disabled. Contact an administrator to create your account.'
+    }
+
+
 # =============================================================================
 # API Views
 # =============================================================================
@@ -36,9 +44,7 @@ class UsersAPIRoot(APIView):
     permission_classes = [permissions.AllowAny]
 
     def get(self, request):
-        return Response({
-            'endpoints': {
-                'register': '/api/users/register/',
+        endpoints = {
             'login': '/api/users/token/',
             'refresh_token': '/api/users/token/refresh/',
             'verify_email': '/api/users/verify-email/',
@@ -47,7 +53,9 @@ class UsersAPIRoot(APIView):
             'change_password': '/api/users/change-password/',
             'devices': '/api/users/devices/',
         }
-        })
+        if settings.ALLOW_SELF_REGISTRATION:
+            endpoints['register'] = '/api/users/register/'
+        return Response({'endpoints': endpoints})
 
 
 class RegisterAPIView(generics.CreateAPIView):
@@ -59,6 +67,12 @@ class RegisterAPIView(generics.CreateAPIView):
     throttle_classes = [RegisterRateThrottle]
 
     def create(self, request, *args, **kwargs):
+        if not settings.ALLOW_SELF_REGISTRATION:
+            return Response(
+                self_registration_disabled_response(),
+                status=status.HTTP_403_FORBIDDEN
+            )
+
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         user = serializer.save()
@@ -284,6 +298,7 @@ class LoginView(View):
             'error': error,
             'email': email,
             'can_resend': can_resend,
+            'allow_self_registration': settings.ALLOW_SELF_REGISTRATION,
         })
 
     def post(self, request):
@@ -319,6 +334,7 @@ class LoginView(View):
             'error': error,
             'email': email,
             'can_resend': can_resend,
+            'allow_self_registration': settings.ALLOW_SELF_REGISTRATION,
         })
 
 
@@ -340,9 +356,20 @@ class RegisterView(View):
     def get(self, request):
         if request.user.is_authenticated:
             return redirect('dashboard')
+        if not settings.ALLOW_SELF_REGISTRATION:
+            return render(request, 'users/login.html', {
+                'error': 'Self-registration is disabled. Contact an administrator to create your account.',
+                'allow_self_registration': False,
+            }, status=403)
         return render(request, 'users/register.html')
 
     def post(self, request):
+        if not settings.ALLOW_SELF_REGISTRATION:
+            return render(request, 'users/login.html', {
+                'error': 'Self-registration is disabled. Contact an administrator to create your account.',
+                'allow_self_registration': False,
+            }, status=403)
+
         email = request.POST.get('email')
         username = request.POST.get('username')
         password = request.POST.get('password')