fix: registration whitelist (ALLOW_REGISTRATION_EMAIL) never works when registration is disabled

Author: errpunkCreated Aug 13, 2026Updated Aug 16, 2026

Describe the bug

When DISABLE_USER_REGISTRATION=true and ALLOW_REGISTRATION_EMAIL is set to a whitelist (e.g. ALLOW_REGISTRATION_EMAIL="[email protected]"), the registration whitelist never works: every registration attempt is rejected with The user registration has been disabled by the administrator. Please contact the administrator!, even for whitelisted emails.

Root cause

In backend/bizpkg/config/base/base.go, getBasicConfigurationFromOldConfig() populates AllowRegistrationEmail from the wrong environment variable:

go
AllowRegistrationEmail: os.Getenv(consts.DisableUserRegistration),

It should read ALLOW_REGISTRATION_EMAIL (consts.AllowRegistrationEmail). Because DISABLE_USER_REGISTRATION is set to "true" in this scenario, the whitelist becomes the single-element list ["true"], which never contains a real email, so allowRegisterChecker always returns false.

To Reproduce

  1. Set in .env: DISABLE_USER_REGISTRATION=true and ALLOW_REGISTRATION_EMAIL="[email protected]"
  2. Restart the server
  3. Try to register an account with [email protected]

Expected behavior

Only the email(s) listed in ALLOW_REGISTRATION_EMAIL can register; other emails are rejected.

Actual behavior

All registration attempts (including whitelisted emails) are rejected with "The user registration has been disabled by the administrator."

Version

Current main (the bug has existed since the persisted base config was introduced, ~PR #2303, Oct 2025).

Environment

Any (env-based deployment; independent of the database, since getBasicConfigurationFromOldConfig() is the fallback used when no base config is persisted yet).

Additional context

  • The original feature PR #208 read the correct env var directly; the wrong env var was introduced later when the config moved to the persisted BasicConfiguration.
  • AdminAuthMW already uses consts.AllowRegistrationEmail correctly for the admin email fallback; only the registration whitelist path is broken.