add invitation by nananankona · Pull Request #863 · nextcloud/registration

nananankona · 2026-09-01T15:52:24Z

Allow-list with email domains (including wildcard) or exact email addresses to register with
Invitation codes and invitation links: restrict who can register, limit the number of uses per link, set a storage quota for invited users and optionally skip the email verification step

tcitworld · 2026-09-01T21:01:37Z

Thanks! Will review when I get the time.

Do you mind rebasing so that the CI passes ? You may drop the css/js changes to make it easier, they can be recompiled here. Ideally, please remove the translation files changes as well, those are usually handled through Transifex.

…limits- Add invitation links (/apps/registration/invite/{code}) with optional email/domain restriction, storage quota, maximum number of uses and expiry date; the usage counter is incremented and the quota applied when an account is created- Add allowed email addresses setting (in addition to allowed domains)- Add option to require an invitation code for all registrations- Add invitation management UI to the admin settings Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

… bypass- Add skip_email_verification option to invitations: registrations via such an invitation skip the email verification step and go straight to the account creation form- Show the invitation code and shareable link in a dialog after creating an invitation, each with a copy button; add a Details button to the invitation list for the same dialog- Add Japanese translations (l10n/ja) for the invitation strings Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

…time-typed expires/created_at fields can be returned as DateTimeobjects from the entity, which JSON-encode as objects and break thefrontend formatting (TypeError: b.replace is not a function). Normalizedates to Y-m-d H:i:s strings in the controller and harden isExpired andformatDate against non-string values. Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

…skip_email_verification flag can return null from the entity when thecolumn is missing or unset, which broke the bool return type ofinvitationSkipsVerification() with a TypeError on invite links. Defaultthe flag to false in the entity constructor and compare with === trueinstead of relying on the raw value. Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

The backtick-quoted uses + 1 expression breaks on PostgreSQL and Oracle, which do not accept backticks as identifier quotes. Use the unquoted column reference instead (uses is not a reserved word). Also guard domainMatches() against email addresses without an @ sign, which previously raised an undefined key warning and a TypeError in the wildcard branch instead of a clean RegistrationException. Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

Nextcloud forbids BOOLEAN columns with NOT NULL (see MigrationService::ensureOracleConstraints and nextcloud/server#45576). Follow the pattern used by nextcloud/mail and declare the invitation flags as nullable booleans instead. Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

Nextcloud requires index names to be 30 characters or shorter (see MigrationService::ensureOracleConstraints). Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

With the default primary key name the table name (minus prefix) must be shorter than 23 chars. registration_invitation is exactly 23 chars, so set an explicit name instead (see MigrationService::ensureOracleConstraints). Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

Use IQueryBuilder::getColumnName() so the identifier is quoted per platform (Oracle folds unquoted identifiers to upper case, MySQL does not accept backticks on other platforms). Fixes ORA-00904 on Oracle. Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

github-actions · 2026-09-16T06:23:06Z

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

tcitworld

Please bump the app version so that the migrations run.

tcitworld · 2026-09-14T07:51:33Z

+				$invitation = $this->invitationService->getById($invitationId);
+				$this->invitationService->validate($invitation, $registration->getEmail());
+			} catch (DoesNotExistException $e) {
+				// The invitation was deleted in the meantime, continue without it


Should we really go on with the account creation if the invitation has been deleted in the meantime?

tcitworld · 2026-09-14T07:53:37Z

+		$invitation->setCode($code);
+		$invitation->setEmail($email !== null && $email !== '' ? strtolower($email) : null);
+		$invitation->setDomain($domain !== null && $domain !== '' ? strtolower($domain) : null);
+		$invitation->setQuota($quota !== null && $quota !== '' ? $quota : null);


Quota should be validated first here with OCP\Util::computerFileSize before being saved

tcitworld · 2026-09-14T07:58:53Z

+		$invitation->setQuota($quota !== null && $quota !== '' ? $quota : null);
+		$invitation->setMaxUses($maxUses);
+		$invitation->setUses(0);
+		$invitation->setExpires($expires);


Date should be validated as well

tcitworld · 2026-09-14T08:02:59Z

 	}

+	#[PublicPage]
+	#[NoCSRFRequired]


Add AnonRateLimit and BruteForceProtection attributes to avoid attackers guessing simple invite codes.

tcitworld · 2026-09-20T14:12:48Z

+		try {
+			$this->invitationMapper->findByCode($code);
+			throw new RegistrationException($this->l10n->t('An invitation with this code already exists.'));
+		} catch (DoesNotExistException $e) {
+		}


Instead of doing a read then a write, simply catch the UniqueConstraintViolationException on insertion and throw RegistrationException then.

tcitworld · 2026-09-20T15:09:17Z

+		<NcTextField
+			v-model="allowedEmails"
+			:label="emailListLabel"
+			:labelVisible="true"
+			:disabled="loading"
+			placeholder="user1@example.com;user2@example.com"
+			@update:modelValue="debounceSavingSlow" />


I don't understand what's the use case for this: if you have specific e-mail adresses to allow, why not just create accounts for them?

tcitworld · 2026-09-26T17:40:49Z

@nananankona Are you affiliated with https://github.com/LukasTechhelpSupport2907/invite-registration ? If not, did you test it?

tcitworld self-requested a review September 1, 2026 21:03

nananankona added 5 commits September 3, 2026 20:52

feat: add per-invitation administrator approval bypass

22f1372

Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

nananankona force-pushed the master branch from 9c432af to 22f1372 Compare September 3, 2026 11:52

nananankona added 7 commits September 3, 2026 20:58

fix: admin-only default, entity sync, test stubs, portable SQL

0e3c632

Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

style: apply php-cs-fixer

571c283

Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

fix: shorten invitation code index name to 30 chars

5a3d0da

Nextcloud requires index names to be 30 characters or shorter (see MigrationService::ensureOracleConstraints). Signed-off-by: nananankona <185404318+nananankona@users.noreply.github.com>

github-actions Bot added the feedback-requested label Sep 16, 2026

tcitworld requested changes Sep 20, 2026

View reviewed changes

Navigation Menu

Repository navigation

add invitation - #863

add invitation#863
nananankona wants to merge 12 commits into
nextcloud:masterfrom
nananankona:master

nananankona commented Sep 1, 2026

Uh oh!

tcitworld commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

tcitworld left a comment

Uh oh!

tcitworld Sep 14, 2026

Uh oh!

tcitworld Sep 14, 2026

Uh oh!

tcitworld Sep 14, 2026

Uh oh!

tcitworld Sep 14, 2026

Uh oh!

tcitworld Sep 20, 2026

Uh oh!

tcitworld Sep 20, 2026

Uh oh!

tcitworld commented Sep 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nananankona commented Sep 1, 2026

Uh oh!

tcitworld commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

tcitworld left a comment

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 20, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld Sep 20, 2026

Choose a reason for hiding this comment

Uh oh!

tcitworld commented Sep 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants