feat: enhance user registration and login flow with additional fields and checks

Author: SimoleS

.gitignore

@@ -11,4 +11,5 @@ platform/dev_ca/
 .env
 docs-internal/
 dist/
-build/
+build/
+*.old

platform/.env.example

@@ -6,6 +6,7 @@ DB_BACKEND=postgres
 SSH_CA_KEY_PATH=./dev_ca/ssh_user_ca
 SSH_CERT_TTL_SECONDS=300
 LOCAL_AUTH_ENABLED=1
+REGISTRATION_ENABLED=1
 DEV_AUTH_ENABLED=0
 ALLOWED_LOGIN_DOMAINS=example.com
 FIRST_USER_ADMIN=1

platform/app/auth.py

@@ -1,15 +1,26 @@
-from flask import Blueprint, Response, flash, redirect, render_template, request, session, url_for
+from flask import Blueprint, Response, current_app, flash, redirect, render_template, request, session, url_for
 
 from app.models.base import utcnow
 
-from app.services.auth import login_federated_user, login_local_user, login_or_create_user, logout_user, register_local_user
+from app.services.auth import (
+    ADMIN_ROLE,
+    current_user,
+    current_user_roles,
+    login_federated_user,
+    login_local_user,
+    login_or_create_user,
+    logout_user,
+    register_local_user,
+)
 from app.services.sso import enabled_sso_providers, oidc_authorization_url, oidc_callback_payload, saml_acs_payload, saml_login_url, saml_metadata_xml
 
 bp = Blueprint("auth", __name__)
 
 
 @bp.get("/login")
 def login():
+    if current_user() is not None:
+        return redirect(_post_login_redirect())
     return render_template("auth/login.html", sso=enabled_sso_providers())
 
 
@@ -26,29 +37,47 @@ def login_post():
     session["user_id"] = str(user.id)
     session["authenticated_at"] = utcnow().isoformat()
     session.permanent = True
-    return redirect(url_for("portal.index"))
+    return redirect(_post_login_redirect())
 
 
 @bp.get("/register")
 def register():
+    if current_user() is not None:
+        return redirect(_post_login_redirect())
+    if not _registration_available():
+        flash("registration_disabled", "warning")
+        return redirect(url_for("auth.login"))
     return render_template("auth/register.html")
 
 
 @bp.post("/register")
 def register_post():
+    if not _registration_available():
+        flash("registration_disabled", "warning")
+        return redirect(url_for("auth.login"))
+
+    first_name = request.form.get("first_name")
+    last_name = request.form.get("last_name")
+    display_name = request.form.get("display_name") or " ".join(
+        part for part in [(first_name or "").strip(), (last_name or "").strip()] if part
+    )
     user, error = register_local_user(
         email=request.form.get("email", ""),
         password=request.form.get("password", ""),
-        display_name=request.form.get("display_name"),
+        display_name=display_name,
     )
+    if user is not None and (first_name or last_name):
+        from app.services.auth import update_user_profile
+
+        update_user_profile(str(user.id), user.display_name, user.external_id, first_name=first_name, last_name=last_name)
     if error:
         flash(error, "danger")
         return redirect(url_for("auth.register"))
 
     session["user_id"] = str(user.id)
     session["authenticated_at"] = utcnow().isoformat()
     session.permanent = True
-    return redirect(url_for("portal.index"))
+    return redirect(_post_login_redirect())
 
 
 @bp.post("/dev-login")
@@ -64,7 +93,7 @@ def dev_login_post():
     session["user_id"] = str(user.id)
     session["authenticated_at"] = utcnow().isoformat()
     session.permanent = True
-    return redirect(url_for("portal.index"))
+    return redirect(_post_login_redirect())
 
 
 @bp.get("/oidc/login")
@@ -134,4 +163,14 @@ def _finish_sso_login(payload: dict):
     session["user_id"] = str(user.id)
     session["authenticated_at"] = utcnow().isoformat()
     session.permanent = True
-    return redirect(url_for("portal.index"))
+    return redirect(_post_login_redirect())
+
+
+def _post_login_redirect():
+    if ADMIN_ROLE in current_user_roles():
+        return url_for("admin.dashboard")
+    return url_for("portal.index")
+
+
+def _registration_available() -> bool:
+    return current_app.config["LOCAL_AUTH_ENABLED"] and current_app.config["REGISTRATION_ENABLED"]

platform/app/config.py

@@ -21,6 +21,7 @@ class Config:
     SERVER_ENROLLMENT_MAX_TTL_MINUTES = int(os.environ.get("SERVER_ENROLLMENT_MAX_TTL_MINUTES", "1440"))
     SERVER_ENROLLMENT_MAX_USES_LIMIT = int(os.environ.get("SERVER_ENROLLMENT_MAX_USES_LIMIT", "100"))
     LOCAL_AUTH_ENABLED = os.environ.get("LOCAL_AUTH_ENABLED", "1") == "1"
+    REGISTRATION_ENABLED = os.environ.get("REGISTRATION_ENABLED", "1") == "1"
     DEV_AUTH_ENABLED = os.environ.get("DEV_AUTH_ENABLED", "0") == "1"
     ALLOWED_LOGIN_DOMAINS = [
         domain.strip().lower()

platform/app/services/auth.py

@@ -17,6 +17,8 @@
 
 
 def login_local_user(email: str, password: str) -> tuple[User | None, str | None]:
+    if not current_app.config["LOCAL_AUTH_ENABLED"]:
+        return None, "local_auth_disabled"
     normalized_email = email.strip().lower()
     user = User.query.filter_by(email=normalized_email).one_or_none()
     if user is None or not user.password_hash:
@@ -152,10 +154,19 @@ def _complete_login(user: User, provider: str) -> tuple[User | None, str | None]
     return user, None
 
 
-def create_local_user(email: str, password: str, display_name: str | None, roles: list[str]) -> tuple[dict, int]:
+def create_local_user(
+    email: str,
+    password: str,
+    display_name: str | None,
+    roles: list[str],
+    first_name: str | None = None,
+    last_name: str | None = None,
+) -> tuple[dict, int]:
+    display_name = _display_name(display_name, first_name, last_name, email)
     user, error = register_local_user(email, password, display_name)
     if error:
         return {"error": error}, 400
+    user.external_id = _profile_external_id(user.external_id, first_name, last_name)
     for role in roles:
         if role:
             _ensure_role(user, role)
@@ -279,18 +290,29 @@ def set_user_status(user_id: str, status: str) -> tuple[dict, int]:
     return {"user_id": str(user.id), "status": status}, 200
 
 
-def update_user_profile(user_id: str, display_name: str | None, external_id: str | None) -> tuple[dict, int]:
+def update_user_profile(
+    user_id: str,
+    display_name: str | None,
+    external_id: str | None,
+    first_name: str | None = None,
+    last_name: str | None = None,
+) -> tuple[dict, int]:
     user, error_response = _user_from_id(user_id)
     if error_response:
         return error_response
-    user.display_name = display_name or user.email
-    user.external_id = external_id or None
+    user.display_name = _display_name(display_name, first_name, last_name, user.email)
+    user.external_id = _profile_external_id(external_id, first_name, last_name)
     record_audit_event(
         event_type="user.profile_updated",
         outcome="success",
         target_type="user",
         target_id=user.id,
-        metadata={"display_name": user.display_name, "external_id": user.external_id},
+        metadata={
+            "display_name": user.display_name,
+            "external_id": external_id,
+            "first_name": (first_name or "").strip(),
+            "last_name": (last_name or "").strip(),
+        },
     )
     db.session.commit()
     return {"user_id": str(user.id)}, 200
@@ -367,11 +389,16 @@ def list_users_with_roles() -> list[dict]:
             .all()
         )
         servers = accessible_servers_for_user(user.id)
+        first_name, last_name, directory_id = _profile_parts(user.external_id)
         result.append(
             {
             "id": str(user.id),
             "email": user.email,
             "display_name": user.display_name,
+            "first_name": first_name,
+            "last_name": last_name,
+            "directory_id": directory_id,
+            "initials": _initials(first_name, last_name, user.display_name, user.email),
             "status": user.status,
             "auth_provider": user.auth_provider,
             "external_id": user.external_id,
@@ -392,6 +419,52 @@ def list_users_with_roles() -> list[dict]:
     return result
 
 
+def _display_name(display_name: str | None, first_name: str | None, last_name: str | None, email: str) -> str:
+    explicit = (display_name or "").strip()
+    if explicit:
+        return explicit
+    full_name = " ".join(part for part in [(first_name or "").strip(), (last_name or "").strip()] if part)
+    return full_name or email
+
+
+def _profile_external_id(external_id: str | None, first_name: str | None, last_name: str | None) -> str | None:
+    directory_id = (external_id or "").strip()
+    parts = []
+    if directory_id:
+        parts.append(directory_id)
+    first_name = (first_name or "").strip()
+    last_name = (last_name or "").strip()
+    if first_name:
+        parts.append(f"first_name={first_name}")
+    if last_name:
+        parts.append(f"last_name={last_name}")
+    return "|".join(parts) or None
+
+
+def _profile_parts(external_id: str | None) -> tuple[str, str, str | None]:
+    first_name = ""
+    last_name = ""
+    directory_parts = []
+    for part in (external_id or "").split("|"):
+        if part.startswith("first_name="):
+            first_name = part.removeprefix("first_name=")
+        elif part.startswith("last_name="):
+            last_name = part.removeprefix("last_name=")
+        elif part:
+            directory_parts.append(part)
+    return first_name, last_name, "|".join(directory_parts) or None
+
+
+def _initials(first_name: str, last_name: str, display_name: str | None, email: str) -> str:
+    if first_name or last_name:
+        return f"{first_name[:1]}{last_name[:1]}".upper() or "U"
+    name = (display_name or email or "U").strip()
+    parts = [part for part in name.split() if part]
+    if len(parts) >= 2:
+        return f"{parts[0][:1]}{parts[-1][:1]}".upper()
+    return name[:2].upper()
+
+
 def _domain_allowed(email: str) -> bool:
     if "@" not in email:
         return False

platform/app/templates/admin/settings.html

@@ -174,7 +174,7 @@ <h1 class="page-title">Settings</h1>
 
             <div style="display:flex;align-items:center;gap:10px;margin-top:6px;">
               <button type="submit" class="btn-primary" style="font-size:13px;">Save Configuration</button>
-              <form method="POST" action="{{ url_for(' admin.settings_integration_test', provider=integration.provider)
+              <form method="POST" action="{{ url_for('admin.settings_integration_test', provider=integration.provider)
                 }}" style="display:inline;">
               <button type="submit" class="btn-ghost" style="font-size:13px;">Test Connection</button>
         </form>
@@ -413,6 +413,22 @@ <h1 class="page-title">Settings</h1>
             {% endif %}
           </div>
 
+          <div
+            style="padding:14px 16px;background:var(--c-bg);border:1px solid var(--c-s2);border-radius:8px;display:flex;align-items:flex-start;gap:12px;">
+            <div style="flex:1;">
+              <div style="font-weight:600;font-size:13px;color:#e8eaed;">Self-Service Registration</div>
+              <div style="font-size:12px;color:var(--c-s4);margin-top:3px;line-height:1.5;">Allow new users to create
+                local accounts from the login page. Admin-created users and SSO provisioning are unaffected.</div>
+            </div>
+            {% if config.REGISTRATION_ENABLED and config.LOCAL_AUTH_ENABLED %}
+            <span class="sbadge sbadge-green">Enabled</span>
+            {% elif config.REGISTRATION_ENABLED and not config.LOCAL_AUTH_ENABLED %}
+            <span class="sbadge sbadge-amber">Blocked by local auth</span>
+            {% else %}
+            <span class="sbadge sbadge-muted">Disabled</span>
+            {% endif %}
+          </div>
+
           <div
             style="padding:14px 16px;background:var(--c-bg);border:1px solid {% if config.DEV_AUTH_ENABLED %}rgba(245,158,11,.3){% else %}var(--c-s2){% endif %};border-radius:8px;display:flex;align-items:flex-start;gap:12px;">
             <div style="flex:1;">
@@ -449,7 +465,8 @@ <h1 class="page-title">Settings</h1>
         </div>
         <div
           style="margin-top:16px;padding:10px 12px;background:rgba(245,158,11,.06);border:1px solid rgba(245,158,11,.2);border-radius:8px;font-size:11px;color:var(--c-s4);line-height:1.6;">
-          Auth method flags are read-only in the UI. Set <code>LOCAL_AUTH_ENABLED</code>, <code>DEV_AUTH_ENABLED</code>
+          Auth method flags are read-only in the UI. Set <code>LOCAL_AUTH_ENABLED</code>,
+          <code>REGISTRATION_ENABLED</code>, <code>DEV_AUTH_ENABLED</code>
           in your environment or <code>.env</code> file and restart the platform.
         </div>
       </div>
@@ -636,4 +653,4 @@ <h1 class="page-title">Settings</h1>
     btn.classList.add('sso-active');
   }
 </script>
-{% endblock %}
+{% endblock %}