Skip /users restriction when signup mgmt is disabled

Author: ujibang

accounts/src/main/java/org/restheart/accounts/AccountsInitializer.java

@@ -80,6 +80,13 @@ public void init() {
             if (!"users".equals(mr.getCollectionName())) return false;
             if (!RequestOverrides.db(mr, conf).equals(mr.getDBName())) return false;
 
+            // A tenant that never enabled Sign-up Management never opted into
+            // restheart-accounts's opinions on /users — see RequestOverrides.SIGNUP_MGMT_ENABLED.
+            // Must be checked here (during authorization) rather than via a post-auth
+            // interceptor: vetoes are evaluated as part of authorization, which runs
+            // before any REQUEST_AFTER_AUTH interceptor gets a chance to run.
+            if (!RequestOverrides.signupMgmtEnabled(mr, conf)) return false;
+
             // Roles configured via `users-unrestricted-roles` (e.g. an admin console
             // role) bypass this restriction entirely — see AccountsConfigData. Reads
             // the per-team override first (set by e.g. TeamConfigInterceptor), falling

accounts/src/main/java/org/restheart/accounts/util/RequestOverrides.java

@@ -152,6 +152,16 @@ public final class RequestOverrides {
     /** Roles exempt from the {@code /users} self-service write restriction (override for multi-team). */
     public static final String USERS_UNRESTRICTED_ROLES = "override-accounts-users-unrestricted-roles";
 
+    /**
+     * Whether Sign-up Management is enabled for this tenant (override for multi-team).
+     * When explicitly {@code false}, the {@code /users} self-service write restriction
+     * is skipped entirely — a tenant that never opted into restheart-accounts never
+     * opted into its opinions on {@code /users}. Must be set before authentication
+     * (e.g. {@code REQUEST_BEFORE_EXCHANGE_INIT}), since the veto is evaluated as part
+     * of authorization, before any {@code REQUEST_AFTER_AUTH} interceptor runs.
+     */
+    public static final String SIGNUP_MGMT_ENABLED = "override-accounts-signup-mgmt-enabled";
+
     private RequestOverrides() {}
 
     // ── Accessor methods ──────────────────────────────────────────────────────
@@ -219,6 +229,15 @@ public static List<String> usersUnrestrictedRoles(ServiceRequest<?> req, Account
         return list(req, USERS_UNRESTRICTED_ROLES, conf.usersUnrestrictedRoles());
     }
 
+    /**
+     * Whether Sign-up Management is enabled for this tenant. Defaults to {@code true}
+     * (restriction fully enforced) unless a deployment-layer interceptor explicitly
+     * attaches {@code false}.
+     */
+    public static boolean signupMgmtEnabled(ServiceRequest<?> req, AccountsConfigData conf) {
+        return bool(req, SIGNUP_MGMT_ENABLED, true);
+    }
+
     /**
      * Per-team Google OAuth config, or {@code null} if not overridden.
      * When non-null, this takes precedence over the static {@link OAuthConfig}.