Skip to content

Add query parameter to suppress display of signup UI elements#7138

Open
simonpoole wants to merge 1 commit into
openstreetmap:masterfrom
simonpoole:hide-account-sign-up
Open

Add query parameter to suppress display of signup UI elements#7138
simonpoole wants to merge 1 commit into
openstreetmap:masterfrom
simonpoole:hide-account-sign-up

Conversation

@simonpoole

@simonpoole simonpoole commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

This adds support for a query parameter "allow_signup" that will suppress the rendering of signup UI elements during the OAuth2 authorisation flow.

This is the same solution as github implements for their "webflow" OAuth2 process.

Resolves #5118

Description

With allow_signup set to "true" or absent there are no visual changes, with allow_signup set to "false" during authorisation, the log in/sign up tabs are removed, including the similar buttons when the hamburger menu is clicked. Screenshots from authorisation with allow_signup=false.

Screenshot_1780827477 Screenshot_1780827664

How has this been tested?

Not at all yet ... this needs to have an integration test.

@simonpoole simonpoole force-pushed the hide-account-sign-up branch from ef4e3f1 to 830af5b Compare June 7, 2026 10:38
Comment thread app/controllers/concerns/session_methods.rb Outdated
Comment thread app/views/layouts/_header.html.erb
@simonpoole simonpoole force-pushed the hide-account-sign-up branch from 6614502 to 7e20cd7 Compare June 7, 2026 18:13
@simonpoole simonpoole changed the title Add query parameter that to suppress display of signup UI elements Add query parameter to suppress display of signup UI elements Jun 7, 2026
@simonpoole simonpoole force-pushed the hide-account-sign-up branch 2 times, most recently from ba7235d to e92f95b Compare June 7, 2026 18:46
Comment thread app/views/sessions/new.html.erb Outdated
@simonpoole simonpoole force-pushed the hide-account-sign-up branch from e92f95b to 979cb52 Compare June 8, 2026 09:49
Comment thread app/views/layouts/site.html.erb Outdated
Comment thread app/views/layouts/_header.html.erb Outdated
Comment thread app/views/sessions/new.html.erb Outdated
@simonpoole simonpoole requested a review from tomhughes June 8, 2026 21:04
hlfan

This comment was marked as resolved.

@simonpoole

Copy link
Copy Markdown
Contributor Author

With the separate cookie store of a web login page embedded inside a native app, maybe that flag should be stored in a session cookie as well. Then User.new could actually respond with a 403 instead of still working.

No strong feelings on this. We know that googles review is happy when there is no "visual" hint that you can sign up as that is what we've done for the last two years (see #5118 (comment)) and I kind of want to keep changes to a minimum if at all possible. The requirement is just that you can't signup from the app (not that you can't signup at all :-)) and arguably manually crafting an URL and entering it in a browser is not "in the app".

@tomhughes tomhughes left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Squash the two commits together please, then I think this is good.

This adds support for a query paramater "allow_signup" that will
suppress the rendering of signup UI elements during the OAuth2
authorisation flow.

This is the same solution as github implements for their "webflow"
OAuth2 process.

Resolves openstreetmap#5118
@simonpoole simonpoole force-pushed the hide-account-sign-up branch from 3011f8f to c5ac15e Compare June 9, 2026 17:39
@simonpoole

Copy link
Copy Markdown
Contributor Author

Squash the two commits together please, then I think this is good.

Done.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Login screen for OAuth 2 authorization shows "sign up" tab that triggers googles android policy violation bot

3 participants