From c37b283865ac564cdf16b9e16d482677c077e76b Mon Sep 17 00:00:00 2001
From: Jacob Herrington <jacobherringtondeveloper@gmail.com>
Date: Mon, 12 Oct 2020 10:27:22 -0500
Subject: [PATCH] Allow Forem admins to enable an invite only mode. (#10758)

* Add invite only mode field to SiteConfig

* Add UI elements for invite only mode
---
 app/controllers/admin/configs_controller.rb   |  1 +
 app/helpers/application_helper.rb             |  6 +++++-
 .../admin/controllers/config_controller.js    | 19 +++++++++++++++++++
 app/lib/constants/site_config.rb              |  4 ++++
 app/models/site_config.rb                     |  1 +
 app/services/authentication/providers.rb      |  2 ++
 app/views/admin/configs/show.html.erb         | 10 ++++++++--
 .../articles/_sidebar_additional.html.erb     |  2 +-
 .../registrations/_registration_form.html.erb |  6 +++++-
 .../shared/_authorization_error.html.erb      |  2 +-
 spec/requests/admin/configs_spec.rb           | 19 +++++++++++++++++++
 .../user_logs_in_with_facebook_spec.rb        | 12 ++++++++++++
 .../user_logs_in_with_github_spec.rb          | 12 ++++++++++++
 .../user_logs_in_with_twitter_spec.rb         | 12 ++++++++++++
 14 files changed, 102 insertions(+), 6 deletions(-)
 create mode 100644 app/javascript/admin/controllers/config_controller.js

diff --git a/app/controllers/admin/configs_controller.rb b/app/controllers/admin/configs_controller.rb
index e5f98ef4a..f97707cff 100644
--- a/app/controllers/admin/configs_controller.rb
+++ b/app/controllers/admin/configs_controller.rb
@@ -55,6 +55,7 @@ module Admin
         github_secret
         facebook_key
         facebook_secret
+        invite_only_mode
         allow_email_password_registration
         primary_brand_color_hex
         spam_trigger_terms
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index a590864d4..59440d4f6 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -106,7 +106,11 @@ module ApplicationHelper
     end
   end
 
-  def any_selfserve_auth?
+  def invite_only_mode?
+    SiteConfig.invite_only_mode?
+  end
+
+  def any_enabled_auth_providers?
     authentication_enabled_providers.any?
   end
 
diff --git a/app/javascript/admin/controllers/config_controller.js b/app/javascript/admin/controllers/config_controller.js
new file mode 100644
index 000000000..709938f38
--- /dev/null
+++ b/app/javascript/admin/controllers/config_controller.js
@@ -0,0 +1,19 @@
+import { Controller } from 'stimulus';
+
+export default class ConfigController extends Controller {
+  static targets = ['inviteOnlyMode', 'authenticationProviders'];
+
+  disableAuthenticationOptions() {
+    if (this.inviteOnlyModeTarget.checked) {
+      this.authenticationProvidersTarget.disabled = true;
+      document.querySelector(
+        'button[data-id=site_config_authentication_providers]',
+      ).disabled = true;
+    } else {
+      this.authenticationProvidersTarget.disabled = false;
+      document.querySelector(
+        'button[data-id=site_config_authentication_providers]',
+      ).disabled = false;
+    }
+  }
+}
diff --git a/app/lib/constants/site_config.rb b/app/lib/constants/site_config.rb
index f3816bc48..d73d1e8cc 100644
--- a/app/lib/constants/site_config.rb
+++ b/app/lib/constants/site_config.rb
@@ -122,6 +122,10 @@ module Constants
         description: "Used to authenticate with your health check endpoints.",
         placeholder: "a secure token"
       },
+      invite_only_mode: {
+        description: "Only users invited by email can join this community.",
+        placeholder: ""
+      },
       jobs_url: {
         description: "URL of the website where open positions are posted",
         placeholder: "Jobs URL"
diff --git a/app/models/site_config.rb b/app/models/site_config.rb
index 8381e5e38..66f2065e2 100644
--- a/app/models/site_config.rb
+++ b/app/models/site_config.rb
@@ -23,6 +23,7 @@ class SiteConfig < RailsSettings::Base
   # Authentication
   field :allow_email_password_registration, type: :boolean, default: false
   field :authentication_providers, type: :array, default: proc { Authentication::Providers.available }
+  field :invite_only_mode, type: :boolean, default: false
   field :twitter_key, type: :string, default: ApplicationConfig["TWITTER_KEY"]
   field :twitter_secret, type: :string, default: ApplicationConfig["TWITTER_SECRET"]
   field :github_key, type: :string, default: ApplicationConfig["GITHUB_KEY"]
diff --git a/app/services/authentication/providers.rb b/app/services/authentication/providers.rb
index 247cffeca..1275318d1 100644
--- a/app/services/authentication/providers.rb
+++ b/app/services/authentication/providers.rb
@@ -44,6 +44,8 @@ module Authentication
     # TODO: [@forem/oss] ideally this should be "available - disabled"
     # we can get there once we have feature flags
     def self.enabled
+      return [] if SiteConfig.invite_only_mode
+
       SiteConfig.authentication_providers.map(&:to_sym).sort
     end
 
diff --git a/app/views/admin/configs/show.html.erb b/app/views/admin/configs/show.html.erb
index b26394dca..aed095f47 100644
--- a/app/views/admin/configs/show.html.erb
+++ b/app/views/admin/configs/show.html.erb
@@ -1,4 +1,4 @@
-<div class="grid gap-6">
+<div class="grid gap-6" data-controller="config">
   <div class="crayons-notice crayons-notice--info" role="alert">
     <p class="mb-1">
       Only admins with explicit <strong>single resource admin</strong> role may make changes to site config. Even super admins require this permission.
@@ -116,6 +116,11 @@
                          expanded: "false"
                        } %>
             <div id="authenticationBodyContainer" class="card-body collapse hide" aria-labelledby="authenticationBodyContainer">
+              <div class="form-group">
+                <%= admin_config_label :invite_only_mode %>
+                <%= f.check_box :invite_only_mode, checked: SiteConfig.invite_only_mode, data: { action: "config#disableAuthenticationOptions", target: "config.inviteOnlyMode" } %>
+                <div class="alert alert-info"><%= Constants::SiteConfig::DETAILS[:invite_only_mode][:description] %></div>
+              </div>
               <div class="form-group">
                 <%= admin_config_label :allow_email_password_registration %>
                 <%= f.check_box :allow_email_password_registration, checked: SiteConfig.allow_email_password_registration %>
@@ -131,7 +136,8 @@
                                  authentication_enabled_providers.map(&:provider_name),
                                ),
                                multiple: true,
-                               class: "form-control selectpicker" %>
+                               class: "form-control selectpicker",
+                               data: { target: "config.authenticationProviders" } %>
                 <div class="alert alert-info"><%= Constants::SiteConfig::DETAILS[:authentication_providers][:description] %></div>
               </div>
               <div class="crayons-notice crayons-notice--info mb-4">
diff --git a/app/views/articles/_sidebar_additional.html.erb b/app/views/articles/_sidebar_additional.html.erb
index d6235401e..d4ccf60b6 100644
--- a/app/views/articles/_sidebar_additional.html.erb
+++ b/app/views/articles/_sidebar_additional.html.erb
@@ -1,7 +1,7 @@
 <div id="sidebar-wrapper-right" class="sidebar-wrapper sidebar-wrapper-right crayons-layout__sidebar-right">
   <div class="sidebar-bg" id="sidebar-bg-right"></div>
   <aside class="side-bar sidebar-additional showing grid gap-4" id="sidebar-additional">
-    <% unless user_signed_in? || !any_selfserve_auth? %>
+    <% unless user_signed_in? || !any_enabled_auth_providers? %>
       <section class="crayons-card crayons-card--secondary signin-cta-widget">
         <div class="authentication-widget__container">
           <figure class="authentication-widget__image-container">
diff --git a/app/views/devise/registrations/_registration_form.html.erb b/app/views/devise/registrations/_registration_form.html.erb
index 25a1b8ac4..4182247bc 100644
--- a/app/views/devise/registrations/_registration_form.html.erb
+++ b/app/views/devise/registrations/_registration_form.html.erb
@@ -2,7 +2,11 @@
   <div class="registration crayons-card">
     <div class="registration__content">
       <h1 class="registration__title">
-        Welcome to <%= community_name %>
+        <% if params[:state] == "new-user" && invite_only_mode? %>
+          <%= community_name %> is invite only.
+        <% else %>
+          Welcome to <%= community_name %>
+        <% end %>
       </h1>
       <p class="registration__description">
         <a href="/"><%= community_name %></a> is a community of
diff --git a/app/views/devise/shared/_authorization_error.html.erb b/app/views/devise/shared/_authorization_error.html.erb
index 55deaaa98..7065b7ea2 100644
--- a/app/views/devise/shared/_authorization_error.html.erb
+++ b/app/views/devise/shared/_authorization_error.html.erb
@@ -15,7 +15,7 @@
       </strong>
       <br>
     <% end %>
-    <% if any_selfserve_auth? %>
+    <% if any_enabled_auth_providers? %>
       If you haven't created an account, we recommend signing up with social authentication below.
     <% end %>
       Contact <%= email_link %> if you continue having trouble.
diff --git a/spec/requests/admin/configs_spec.rb b/spec/requests/admin/configs_spec.rb
index 19cacf2f3..7cc837ee9 100644
--- a/spec/requests/admin/configs_spec.rb
+++ b/spec/requests/admin/configs_spec.rb
@@ -78,6 +78,25 @@ RSpec.describe "/admin/config", type: :request do
                                           confirmation: confirmation_message }
           expect(SiteConfig.authentication_providers).to eq([provider])
         end
+
+        context "when authentication providers are present" do
+          before do
+            SiteConfig.authentication_providers = Authentication::Providers.available.map(&:to_s)
+          end
+
+          it "allows authentication providers to be unset" do
+            new_provider = Array.wrap(SiteConfig.authentication_providers.pop.to_s)
+            post "/admin/config", params: { site_config: { authentication_providers: new_provider },
+                                            confirmation: confirmation_message }
+            expect(SiteConfig.authentication_providers).to eq(new_provider)
+          end
+
+          it "allows all authentication providers to be unset" do
+            post "/admin/config", params: { site_config: { authentication_providers: [] },
+                                            confirmation: confirmation_message }
+            expect(SiteConfig.authentication_providers).to be_empty
+          end
+        end
       end
 
       describe "Community Content" do
diff --git a/spec/system/authentication/user_logs_in_with_facebook_spec.rb b/spec/system/authentication/user_logs_in_with_facebook_spec.rb
index d772e1d04..f30451322 100644
--- a/spec/system/authentication/user_logs_in_with_facebook_spec.rb
+++ b/spec/system/authentication/user_logs_in_with_facebook_spec.rb
@@ -220,4 +220,16 @@ RSpec.describe "Authenticating with Facebook" do
       end
     end
   end
+
+  context "when community is in invite only mode" do
+    before do
+      SiteConfig.invite_only_mode = true
+    end
+
+    it "doesn't present the authentication option" do
+      visit sign_up_path(state: "new-user")
+      expect(page).not_to have_text(sign_in_link)
+      expect(page).to have_text("invite only")
+    end
+  end
 end
diff --git a/spec/system/authentication/user_logs_in_with_github_spec.rb b/spec/system/authentication/user_logs_in_with_github_spec.rb
index d43ef379f..15cb0895e 100644
--- a/spec/system/authentication/user_logs_in_with_github_spec.rb
+++ b/spec/system/authentication/user_logs_in_with_github_spec.rb
@@ -186,4 +186,16 @@ RSpec.describe "Authenticating with GitHub" do
       end
     end
   end
+
+  context "when community is in invite only mode" do
+    before do
+      SiteConfig.invite_only_mode = true
+    end
+
+    it "doesn't present the authentication option" do
+      visit sign_up_path(state: "new-user")
+      expect(page).not_to have_text(sign_in_link)
+      expect(page).to have_text("invite only")
+    end
+  end
 end
diff --git a/spec/system/authentication/user_logs_in_with_twitter_spec.rb b/spec/system/authentication/user_logs_in_with_twitter_spec.rb
index 55030b2b9..76be37c09 100644
--- a/spec/system/authentication/user_logs_in_with_twitter_spec.rb
+++ b/spec/system/authentication/user_logs_in_with_twitter_spec.rb
@@ -178,4 +178,16 @@ RSpec.describe "Authenticating with Twitter" do
       end
     end
   end
+
+  context "when community is in invite only mode" do
+    before do
+      SiteConfig.invite_only_mode = true
+    end
+
+    it "doesn't present the authentication option" do
+      visit sign_up_path(state: "new-user")
+      expect(page).not_to have_text(sign_in_link)
+      expect(page).to have_text("invite only")
+    end
+  end
 end