trypost/app/Http/Controllers/Auth
Paulo Castellano 74bd88d3d6 feat(auth): self-hosted registration gate + admin seeder (closes #46)
Self-hosted installs (SELF_HOSTED=true, the default) now close /register
to the public. Workspace invites still work — the AcceptInvite page
links into /register with ?invite={id}, the middleware persists that
into the session, and POST /register passes through.

- EnsureRegistrationEnabled middleware gates GET/POST /register.
  Accepts ?invite=… (URL) or pending_invite_id (session) as the pass.
- RegisteredUserController::store clears the marker after signup.
- AcceptInvite.vue passes invite.id in the register link's query string.
- Login.vue hides the "Sign up" link when self_hosted.
- UserSeeder bootstraps a single admin (admin@trypost.it / password).
  Idempotent; not wired into DatabaseSeeder — operator runs
  `php artisan db:seed --class=UserSeeder` per the install docs.
- Tests cover both flag values for every changed surface.

Docs PR: see trypost-docs self-hosting/installation.mdx step 3.
2026-05-19 11:45:16 -03:00
..
Concerns feat: capture signup UTMs/IP and add GitHub OAuth login 2026-05-04 18:42:25 -03:00
AcceptInviteController.php feat: @mentions in comments, AI Action layer + MCP tools, settings tabs 2026-05-01 20:59:03 -03:00
AuthenticatedSessionController.php fix: security audit - IDOR, open redirect, authorization, session fixes 2026-03-30 14:58:25 -03:00
BlueskyController.php refactor(social): use config for OAuth hosts everywhere 2026-05-19 08:34:35 -03:00
EmailVerificationNotificationController.php refactor: restructure to Actions, subdomain routes (app/api), API tokens 2026-03-29 19:24:28 -03:00
EmailVerificationPromptController.php refactor: restructure to Actions, subdomain routes (app/api), API tokens 2026-03-29 19:24:28 -03:00
FacebookController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
GitHubController.php revert: keep one OAuth callback URL per provider 2026-05-04 19:42:13 -03:00
GoogleController.php revert: keep one OAuth callback URL per provider 2026-05-04 19:42:13 -03:00
InstagramController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
InstagramFacebookController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
LinkedInController.php refactor: remove debug logging from social OAuth controllers 2026-05-14 11:23:40 -03:00
LinkedInPageController.php fix(linkedin-page): persist OAuth scopes through the page-picker flow 2026-05-14 11:48:30 -03:00
MastodonController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
NewPasswordController.php feat: improvements on invites 2026-01-20 16:53:54 -03:00
PasswordResetLinkController.php feat: improvements on invites 2026-01-20 16:53:54 -03:00
PinterestController.php refactor: remove debug logging from social OAuth controllers 2026-05-14 11:23:40 -03:00
RegisteredUserController.php feat(auth): self-hosted registration gate + admin seeder (closes #46) 2026-05-19 11:45:16 -03:00
SignupSuccessController.php chore: tracking, gtm and more 2026-03-30 21:32:43 -03:00
SocialController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
ThreadsController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00
TikTokController.php refactor: remove debug logging from social OAuth controllers 2026-05-14 11:23:40 -03:00
VerifyEmailController.php refactor: restructure to Actions, subdomain routes (app/api), API tokens 2026-03-29 19:24:28 -03:00
XController.php feat: redesign accounts page with multi-account support 2026-04-14 19:48:35 -03:00
YouTubeController.php feat: localize OAuth popup callback messages across 12 controllers 2026-05-07 14:03:52 -03:00