Update_REGISTRATION_DISABLED_behavior (breaking change)

.github/workflows/e2e-ui-tests.yml

@@ -11,10 +11,20 @@ permissions:
 
 jobs:
   build:
+    name: E2E (${{ matrix.configuration }})
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - configuration: default-jit
+            registration_disabled: ''
+          - configuration: registration-policy-sso
+            registration_disabled: sso
     env:
       CYPRESS_TESTING: true
       NODE_ENV: test
+      REGISTRATION_DISABLED: ${{ matrix.registration_disabled }}
     services:
       postgres:
         image: postgres:latest
@@ -64,17 +74,27 @@ jobs:
           yarn backend sequelize db:migrate
           yarn backend sequelize db:seed:all
 
-      - name: Cypress run
-        uses: cypress-io/github-action@v7
+      - name: Cypress run (default JIT policy)
+        if: matrix.configuration == 'default-jit'
+        uses: cypress-io/github-action@fa4a118725a8f001170d49631ea89e5d66fee626 # v7
         with:
+          config: excludeSpecPattern=test/integration/registration-policy.cy.ts
           start: yarn start, yarn run cypress-test mock-json, yarn run cypress-test mock-openid
           wait-on: 'http://127.0.0.1:3000, http://127.0.0.1:3001'
 
+      - name: Cypress run (SSO provisioning denied)
+        if: matrix.configuration == 'registration-policy-sso'
+        uses: cypress-io/github-action@fa4a118725a8f001170d49631ea89e5d66fee626 # v7
+        with:
+          start: yarn start, yarn run cypress-test mock-json, yarn run cypress-test mock-openid
+          wait-on: 'http://127.0.0.1:3000, http://127.0.0.1:3001'
+          spec: test/integration/registration-policy.cy.ts
+
       - name: Upload test screenshots and videos
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: cypress-recording
+          name: cypress-recording-${{ matrix.configuration }}
           path: |
             test/screenshots
             test/videos

CHANGELOG

@@ -1,3 +1,9 @@
+v2.13.2
+
+## Breaking Changes
+
+- **BREAKING:** `REGISTRATION_DISABLED` is now a fail-fast, scoped enum. `true` disables local registration and SSO/LDAP just-in-time account creation; previously tolerated invalid values now prevent startup. Review the [v2.13.2 registration policy upgrade note](docs/upgrade-notes/registration-disabled-enum.md) before upgrading.
+
 v2.13.1
 
 ## What's New

apps/backend/.env-example

@@ -16,7 +16,7 @@ ADMIN_EMAIL=<email for default admin user (if nothing is provided, defaults to a
 ADMIN_USES_EXTERNAL_AUTH=<if the default admin user uses alternative/external authentication (if nothing is provided, defaults to false)
 ADMIN_PASSWORD=<Password for admin user (if nothing is provided, defaults to a randomly generated password that will only be shown on initial setup)>
 LOCAL_LOGIN_DISABLED=<If internal user login should be allowed, if not then only alternative authention providers can be used, (if nothing provided, defaults to false)>
-REGISTRATION_DISABLED=<If public user registration should be allowed, if not then only the administrator user can create users (defaults to false)>
+REGISTRATION_DISABLED=<Controls account self-provisioning: false/unset allows local registration and SSO auto-account creation; true disables both; local disables local registration only; sso disables SSO auto-account creation only, including LDAP (defaults to false)>
 ONE_SESSION_PER_USER=<If users are only allowed to be logged in on one browser, (defaults to false)>
 JWT_SECRET=<JSON Web Token Secret (no default, must be set)>
 JWT_EXPIRE_TIME=<JSON Web Token Length of time before signature expires (if nothing is provided, defaults to 60s)>
@@ -90,3 +90,4 @@ OIDC_USER_INFO_URL=<Your OIDC user info endpoint, for example: https://sample.us
 OIDC_CLIENTID=<Your OIDC Client ID (no default, must be set)>
 OIDC_CLIENT_SECRET=<Your OIDC Client Secret (no default, must be set)>
 OIDC_EXTERNAL_GROUPS=<Synchronize user groups from external OIDC provider; Groups are not created automatically, users are only mapped into existing groups - true or false (defaults to false if not provided)>
+OIDC_USES_VERIFIED_EMAIL=<Require email_verified=true before using an OIDC email to provision or match an account; setting false permits unverified claims and is unsafe for pre-provisioned access (defaults to true)>