feat: implements allow_new_users setting

Refs: #1484 #1566 #1629
Closes: #1429

Author: HorlogeSkynet

docs/src/config.md

@@ -106,6 +106,7 @@ The following configuration options are available.
 | <span id="SYNC_TOKENSERVER__STATSD_LABEL"></span>SYNC_TOKENSERVER__STATSD_LABEL | syncstorage.tokenserver | StatsD metrics label prefix |
 | <span id="SYNC_TOKENSERVER__TOKEN_DURATION"></span>SYNC_TOKENSERVER__TOKEN_DURATION | 3600 | Token TTL (1 hour) |
 | <span id="SYNC_TOKENSERVER__FXA_WEBHOOK_ENABLED"></span>SYNC_TOKENSERVER__FXA_WEBHOOK_ENABLED | false | Enable the FxA webhook endpoint. When disabled, the route is not registered. |
+| <span id="SYNC_TOKENSERVER__ALLOW_NEW_USERS"></span>SYNC_TOKENSERVER__ALLOW_NEW_USERS | true | Whether new users may be created. When disabled, only previously registered users can use the tokenserver service. |
 
 ### Tokenserver+FxA Integration
 

syncserver/src/tokenserver/extractors.rs

@@ -249,6 +249,7 @@ impl FromRequest for TokenserverRequest {
                     client_state: auth_data.client_state.clone(),
                     keys_changed_at: auth_data.keys_changed_at,
                     capacity_release_rate: state.node_capacity_release_rate,
+                    allow_new_users: state.allow_new_users,
                 })
                 .await?;
             log_items_mutator.insert("first_seen_at".to_owned(), user.first_seen_at.to_string());

syncserver/src/tokenserver/mod.rs

@@ -34,6 +34,7 @@ pub struct ServerState {
     pub token_duration: u64,
     pub set_verifiers: Vec<SETVerifierImpl>,
     pub fxa_webhook_enabled: bool,
+    pub allow_new_users: bool,
 }
 
 impl ServerState {
@@ -115,6 +116,7 @@ impl ServerState {
             token_duration: settings.token_duration,
             set_verifiers,
             fxa_webhook_enabled: settings.fxa_webhook_enabled,
+            allow_new_users: settings.allow_new_users,
         })
     }
 

syncstorage-db-common/src/diesel.rs

@@ -31,6 +31,10 @@ impl DbError {
         DbErrorKind::Common(SyncstorageDbError::collection_not_found()).into()
     }
 
+    pub fn user_not_found() -> Self {
+        DbErrorKind::Common(SyncstorageDbError::user_not_found()).into()
+    }
+
     pub fn conflict() -> Self {
         DbErrorKind::Common(SyncstorageDbError::conflict()).into()
     }

syncstorage-db-common/src/error.rs

@@ -28,6 +28,10 @@ enum SyncstorageDbErrorKind {
     #[error("Specified collection does not exist")]
     CollectionNotFound,
 
+    /// User cannot be found.
+    #[error("Specified user does not exist")]
+    UserNotFound,
+
     /// BSO object cannot be found.
     #[error("Specified bso does not exist")]
     BsoNotFound,
@@ -65,6 +69,10 @@ impl SyncstorageDbError {
         SyncstorageDbErrorKind::CollectionNotFound.into()
     }
 
+    pub fn user_not_found() -> Self {
+        SyncstorageDbErrorKind::UserNotFound.into()
+    }
+
     pub fn conflict() -> Self {
         SyncstorageDbErrorKind::Conflict.into()
     }
@@ -82,6 +90,7 @@ impl SyncstorageDbError {
 /// `SyncstorageDbErrorKind` matches the kind passed in.
 pub trait DbErrorIntrospect {
     fn is_collection_not_found(&self) -> bool;
+    fn is_user_not_found(&self) -> bool;
     fn is_conflict(&self) -> bool;
     fn is_quota(&self) -> bool;
     fn is_bso_not_found(&self) -> bool;
@@ -95,6 +104,10 @@ impl DbErrorIntrospect for SyncstorageDbError {
         matches!(self.kind, SyncstorageDbErrorKind::CollectionNotFound)
     }
 
+    fn is_user_not_found(&self) -> bool {
+        matches!(self.kind, SyncstorageDbErrorKind::UserNotFound)
+    }
+
     fn is_conflict(&self) -> bool {
         matches!(self.kind, SyncstorageDbErrorKind::Conflict)
     }
@@ -140,7 +153,11 @@ impl From<SyncstorageDbErrorKind> for SyncstorageDbError {
     /// Fills in the HTTP status and a new backtrace automatically.
     fn from(kind: SyncstorageDbErrorKind) -> Self {
         let status = match kind {
-            SyncstorageDbErrorKind::CollectionNotFound | SyncstorageDbErrorKind::BsoNotFound => {
+            (
+                SyncstorageDbErrorKind::CollectionNotFound |
+                SyncstorageDbErrorKind::UserNotFound |
+                SyncstorageDbErrorKind::BsoNotFound
+            ) => {
                 StatusCode::NOT_FOUND
             }
             // Matching the Python code here (a 400 vs 404)

tokenserver-db-common/src/lib.rs

@@ -113,7 +113,7 @@ pub trait Db {
     fn metrics(&self) -> &Metrics;
 
     /// Gets the user with the given email and service ID.
-    /// If one doesn't exist, allocates a new user.
+    /// If one doesn't exist, and when configuration allows it, allocates a new user.
     async fn get_or_create_user(
         &mut self,
         params: params::GetOrCreateUser,
@@ -127,7 +127,12 @@ pub trait Db {
 
         if raw_users.is_empty() {
             // There are no users in the database with the given email and service ID, so
-            // allocate a new one.
+            // allocate a new one if allowed by configuration.
+            if !params.allow_new_users {
+                warn!("New users registration is disabled by configuration"; "email" => params.email);
+                return Err(DbError::user_not_found());
+            }
+
             let allocate_user_result = self
                 .allocate_user(params.clone() as params::AllocateUser)
                 .await?;

tokenserver-db-common/src/params.rs

@@ -35,6 +35,7 @@ pub struct GetOrCreateUser {
     pub client_state: String,
     pub keys_changed_at: Option<i64>,
     pub capacity_release_rate: Option<f32>,
+    pub allow_new_users: bool,
 }
 
 pub type AllocateUser = GetOrCreateUser;

tokenserver-db/src/tests.rs

@@ -1270,6 +1270,47 @@ async fn test_correct_created_at_used_during_user_retrieval() -> DbResult<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn test_no_new_user_allocation() -> DbResult<()> {
+    let pool = db_pool().await?;
+    let mut db = pool.get().await?;
+
+    let service_id = db
+        .get_service_id(params::GetServiceId {
+            service: "sync-1.5".to_owned(),
+        })
+        .await?
+        .id;
+
+    // Add a downed node
+    db.post_node(params::PostNode {
+        service_id,
+        node: "https://node1".to_owned(),
+        current_load: 0,
+        capacity: 100,
+        available: 100,
+        downed: 1,
+        ..Default::default()
+    })
+    .await?;
+
+    // User allocation fails because users allocation is disabled
+    let result = db
+        .allocate_user(params::AllocateUser {
+            service_id,
+            generation: 1234,
+            email: "test@test.com".to_owned(),
+            client_state: "aaaa".to_owned(),
+            keys_changed_at: Some(1234),
+            capacity_release_rate: None,
+            allow_new_users: false,
+        })
+        .await;
+    assert!(result.unwrap_err().is_user_not_found());
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn test_latest_created_at() -> DbResult<()> {
     let pool = db_pool().await?;

tokenserver-settings/src/lib.rs

@@ -66,6 +66,9 @@ pub struct Settings {
     /// Whether to enable the FxA webhook endpoint.
     /// Defaults to false.
     pub fxa_webhook_enabled: bool,
+    /// Whether new users may register to the Tokenserver.
+    /// Defaults to true.
+    pub allow_new_users: bool,
 }
 
 impl Default for Settings {
@@ -93,6 +96,7 @@ impl Default for Settings {
             init_node_url: None,
             init_node_capacity: 100000,
             fxa_webhook_enabled: false,
+            allow_new_users: true,
         }
     }
 }