Repository navigation
Invite registrations - #6024
Open
devonh wants to merge 2 commits into
Open
Invite registrations#6024devonh wants to merge 2 commits into
devonh wants to merge 2 commits into
Conversation
Deploying matrix-authentication-service-docs with
|
| Latest commit: |
e4e9e3f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a02e0ae8.matrix-authentication-service-docs.pages.dev |
| Branch Preview URL: | https://devonh-invite-registrations.matrix-authentication-service-docs.pages.dev |
devonh
force-pushed
the
devonh/invite-registrations
branch
from
October 9, 2026 20:10
571b420 to
1ec1bae
Compare
devonh
commented
Oct 11, 2026
| /// Returns `true` if the token is an invite: it registers without a | ||
| /// password, as the username and the email address it pins | ||
| #[must_use] | ||
| pub fn is_invite(&self) -> bool { |
Member
Author
There was a problem hiding this comment.
Should this be renamed to is_guest_invite to distinguish it better?
Would this ever be used for non-guests?
Member
There was a problem hiding this comment.
I think I like is_guest_invite better
Think it fits the 'passwordless' aspect especially?
devonh
commented
Oct 11, 2026
Comment on lines
+376
to
+382
| /// The invite code the registration form was submitted with | ||
| pub(super) enum InviteCode<'a> { | ||
| Missing, | ||
| Invalid, | ||
| Valid(&'a UserRegistrationToken), | ||
| } | ||
|
|
Member
Author
There was a problem hiding this comment.
This is a small refactoring to allow accessing the registration_token.
reivilibre
approved these changes
Oct 12, 2026
| /// Returns `true` if the token is an invite: it registers without a | ||
| /// password, as the username and the email address it pins | ||
| #[must_use] | ||
| pub fn is_invite(&self) -> bool { |
Member
There was a problem hiding this comment.
I think I like is_guest_invite better
Think it fits the 'passwordless' aspect especially?
reivilibre
reviewed
Oct 12, 2026
| let is_invite = registration_token | ||
| .as_ref() | ||
| .is_some_and(UserRegistrationToken::is_invite); | ||
| if !is_invite && let Err(e) = limiter.check_registration(requester) { |
Member
There was a problem hiding this comment.
(do we need some generous but finite rate limiting to avoid bruteforcing invite tokens?)
sandhose
force-pushed
the
devonh/invite-registrations
branch
from
October 13, 2026 09:32
7b09f0d to
9d161bc
Compare
sandhose
force-pushed
the
devonh/invite-registrations
branch
from
October 13, 2026 12:02
9d161bc to
fdc52ff
Compare
sandhose
force-pushed
the
devonh/invite-registrations
branch
from
October 13, 2026 13:35
fdc52ff to
059bc0b
Compare
sandhose
force-pushed
the
devonh/invite-registrations
branch
2 times, most recently
from
October 16, 2026 09:34
e003592 to
f613d7b
Compare
A registration token which is passwordless and pins both a username and an email address is an invite for one person. Its registration form offered the upstream providers too, so an external invitee could pick the company's single sign-on by mistake. The form now offers none for an invite. The sign-in link stays, and the sign-in page keeps its own providers, for an invitee who already has an account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF
The registration rate limit is keyed on the client IP only, three per hour by default, so a team invited together from behind one NAT could only accept three invites an hour. An invite registers only the one username it pins, and is minted by an admin client for one address, so it can't be used to register in bulk. The email authentication rate limits still apply to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF
sandhose
force-pushed
the
devonh/invite-registrations
branch
from
October 16, 2026 12:58
f613d7b to
e4e9e3f
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of https://github.com/element-hq/backend-internal/issues/292
Reviewable commit by commit.
This PR adds
UserRegistrationToken::is_invite()as the one definition of an invite registration: valid registration token, passwordless, and pins both username and email address.Also changed in this PR:
rate_limiting.registrationis bypassed