From 78a057ebf91e82885cfaf797eec41a41a3300ac7 Mon Sep 17 00:00:00 2001
From: Christy Jacob <christyjacob4@gmail.com>
Date: Mon, 9 Jan 2023 22:39:58 +0530
Subject: [PATCH] feat: add code to account creation endpoint

---
 .env                            |  3 ++-
 app/config/variables.php        |  9 +++++++++
 app/controllers/api/account.php | 19 ++++++++++++-------
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/.env b/.env
index 51e6cc3705..8de833b1e0 100644
--- a/.env
+++ b/.env
@@ -3,6 +3,7 @@ _APP_LOCALE=en
 _APP_WORKER_PER_CORE=2
 _APP_CONSOLE_WHITELIST_ROOT=disabled
 _APP_CONSOLE_WHITELIST_EMAILS=
+_APP_CONSOLE_WHITELIST_CODES=mlh
 _APP_CONSOLE_WHITELIST_IPS=
 _APP_CONSOLE_INVITES=enabled
 _APP_SYSTEM_EMAIL_NAME=Appwrite
@@ -72,4 +73,4 @@ _APP_LOGGING_PROVIDER=
 _APP_LOGGING_CONFIG=
 _APP_REGION=default
 _APP_DOCKER_HUB_USERNAME=
-_APP_DOCKER_HUB_PASSWORD=
+_APP_DOCKER_HUB_PASSWORD=
\ No newline at end of file
diff --git a/app/config/variables.php b/app/config/variables.php
index 85c7a04f25..0b2492b07b 100644
--- a/app/config/variables.php
+++ b/app/config/variables.php
@@ -88,6 +88,15 @@ return [
                 'question' => '',
                 'filter' => ''
             ],
+            [
+                'name' => '_APP_CONSOLE_WHITELIST_CODES',
+                'description' => 'This option allows you to control the creation of new users on the Appwrite console. This option is useful when you want to give access to a group of users without sharing their email addresses. To enable it, pass a list of allowed invitation codes separated by a comma.',
+                'introduction' => '1.3.0',
+                'default' => '',
+                'required' => false,
+                'question' => '',
+                'filter' => ''
+            ],
             // [
             //     'name' => '_APP_CONSOLE_WHITELIST_DOMAINS',
             //     'description' => 'This option allows you to limit creation of users to Appwrite console for users sharing the same email domains. This option is very useful for team working with company emails domain.\n\nTo enable this option, pass a list of allowed email domains separated by a comma.',
diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 346820d699..5501e9fbf1 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -66,24 +66,29 @@ App::post('/v1/account')
     ->param('email', '', new Email(), 'User email.')
     ->param('password', '', new Password(), 'User password. Must be at least 8 chars.')
     ->param('name', '', new Text(128), 'User name. Max length: 128 chars.', true)
+    ->param('code', '', new Text(64), 'An invite code to restrict users ', true)
     ->inject('request')
     ->inject('response')
     ->inject('project')
     ->inject('dbForProject')
     ->inject('events')
-    ->action(function (string $userId, string $email, string $password, string $name, Request $request, Response $response, Document $project, Database $dbForProject, Event $events) {
+    ->action(function (string $userId, string $email, string $password, string $name, string $code, Request $request, Response $response, Document $project, Database $dbForProject, Event $events) {
 
         $email = \strtolower($email);
+
         if ('console' === $project->getId()) {
             $whitelistEmails = $project->getAttribute('authWhitelistEmails');
             $whitelistIPs = $project->getAttribute('authWhitelistIPs');
+            $whitelistCodes = (!empty(App::getEnv('_APP_CONSOLE_WHITELIST_CODES', null))) ? \explode(',', App::getEnv('_APP_CONSOLE_WHITELIST_CODES', null)) : [];
 
-            if (!empty($whitelistEmails) && !\in_array($email, $whitelistEmails)) {
-                throw new Exception(Exception::USER_EMAIL_NOT_WHITELISTED);
-            }
-
-            if (!empty($whitelistIPs) && !\in_array($request->getIP(), $whitelistIPs)) {
-                throw new Exception(Exception::USER_IP_NOT_WHITELISTED);
+            if (!empty($whitelistCodes) && !\in_array($code, $whitelistCodes)) {
+                if (!empty($whitelistEmails) && !\in_array($email, $whitelistEmails)) {
+                    throw new Exception(Exception::USER_EMAIL_NOT_WHITELISTED);
+                }
+    
+                if (!empty($whitelistIPs) && !\in_array($request->getIP(), $whitelistIPs)) {
+                    throw new Exception(Exception::USER_IP_NOT_WHITELISTED);
+                }
             }
         }