Auth/PM-41517 - Registration with an Open Org Invite Link - Allow when DisableUserRegistration Enabled

[JaredSnider-Bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-41517
previously https://bitwarden.atlassian.net/browse/PM-42625

📔 Objective

• The DisableUserRegistration self-hosted toggle targets open self-registration, but a validated open-org invite link is itself the authorization for the invited path — so gating that path behind the toggle was incorrect.
• Two call sites were doing this:
  1. SendVerificationEmailForRegistrationCommand.Run — the guard is moved below the invite validator and skipped when a valid invite is present.
  2. RegisterUserCommand.RegisterUserViaEmailVerificationTokenAndOpenOrgInvite — the redundant guard is dropped entirely.
• Unit and integration coverage added to pin the new behavior end to end.

📸 Screenshots

n/a - integration tests are sufficient.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed the DisableUserRegistration bypass for the open-org-invite registration path at head bcdf40a. The only change since the prior review at 3f910e3 is a merge from main that touches unrelated util/Seeder files; the auth diff is unchanged and both earlier findings remain addressed. Traced the trust boundary at both crossings: SendVerificationEmailForRegistrationCommand.Run throws on an invalid invite before reaching the relocated toggle check, and RegisterUserCommand.RegisterUserViaEmailVerificationTokenAndOpenOrgInvite re-validates the invite via IValidateOrganizationInviteLinkQuery (code match, org enabled, UseInviteLinks, domain allowlist) before creating the user, so the guard removal does not open an unauthenticated path — and both endpoints stay behind FeatureFlagKeys.GenerateInviteLink. Treating a validated invite as the authorization matches the existing precedent in RegisterUserViaOrganizationInviteToken, and unit plus integration coverage pins the new behavior end to end.

Code Review Details

No findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.44%. Comparing base (54ce9ce) to head (3f910e3).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8277      +/-   ##
==========================================
+ Coverage   63.32%   63.44%   +0.11%     
==========================================
  Files        2430     2430              
  Lines      104922   104928       +6     
  Branches     9505     9505              
==========================================
+ Hits        66447    66569     +122     
+ Misses      36198    36080     -118     
- Partials     2277     2279       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.