Method Signup

server-source-code/internal/handler/auth.go:1372–1449

Signup handles POST /auth/signup (public, when signup enabled).

(w http.ResponseWriter, r *http.Request)

// Signup handles POST /auth/signup (public, when signup enabled).
func (h *AuthHandler) Signup(w http.ResponseWriter, r *http.Request) {
	if h.log != nil {
		h.log.Debug("auth request", "method", r.Method, "path", r.URL.Path)
	}
	s, err := h.settings.GetFirst(r.Context())
	if err != nil || s == nil || !s.SignupEnabled {
		Error(w, http.StatusForbidden, "User signup is currently disabled")
		return
	}

	var req struct {
		FirstName string `json:"firstName"`
		LastName  string `json:"lastName"`
		Username  string `json:"username"`
		Email     string `json:"email"`
		Password  string `json:"password"`
	}
	if err := decodeJSON(r, &req); err != nil {
		Error(w, http.StatusBadRequest, "Invalid request body")
		return
	}
	if req.FirstName == "" || req.LastName == "" || req.Username == "" || req.Email == "" || req.Password == "" {
		Error(w, http.StatusBadRequest, "All fields are required")
		return
	}
	if len(req.Username) < 3 {
		Error(w, http.StatusBadRequest, "Username must be at least 3 characters")
		return
	}
	if err := ValidatePasswordPolicy(h.resolved, req.Password); err != nil {
		Error(w, http.StatusBadRequest, err.Error())
		return
	}

	exists, _ := h.users.ExistsByUsernameOrEmail(r.Context(), req.Username, req.Email, "")
	if exists {
		Error(w, http.StatusConflict, "Username or email already exists")
		return
	}

	role := s.DefaultUserRole
	if role == "" && h.resolved != nil {
		role = h.resolved.DefaultUserRole
	}
	if role == "" {
		role = "user"
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), 12)
	if err != nil {
		Error(w, http.StatusInternalServerError, "Failed to create account")
		return
	}
	hashStr := string(hash)

	u := &models.User{
		Username:     req.Username,
		Email:        req.Email,