{"record":{"id":"74ce75ad3368a93f","repo":"passbolt/passbolt_api","slug":"the-self-registration-is-disabled","errorCode":null,"errorMessage":"The self registration is disabled.","messagePattern":"The self registration is disabled\\.","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/SelfRegistration/src/Service/DryRun/SelfRegistrationEmailDomainsDryRunService.php","lineNumber":65,"sourceCode":"        $email = $form->getData('email');\n        $this->checkEmailDomainIsAllowed($email, $allowedDomains);\n        $this->checkEmailNotPreviouslyRegistered($email);\n\n        return true;\n    }\n\n    /**\n     * @return array\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if no allowed domains are found in the settings.\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the settings in DB are not valid.\n     */\n    protected function getAllowedDomainsInSettings(): array\n    {\n        // Fetch settings in DB\n        $settings = $this->getSelfRegistrationSettingsInDB();\n        $allowedDomains = $settings['data']['allowed_domains'] ?? null;\n        if (is_null($allowedDomains)) {\n            throw new ForbiddenException(__('The self registration is disabled.'));\n        }\n\n        return $allowedDomains;\n    }\n\n    /**\n     * Check that the email complies to the allowed domains\n     *\n     * @param string $email Email to check\n     * @param array $allowedDomains Allowed domains\n     * @return void\n     * @throws \\App\\Error\\Exception\\ValidationException if the email does not comply\n     */\n    protected function checkEmailDomainIsAllowed(string $email, array $allowedDomains): void\n    {\n        /** @var \\App\\Model\\Table\\UsersTable $UsersTable */\n        $UsersTable = TableRegistry::getTableLocator()->get('Users');\n        if (!$UsersTable->isUsernameCaseSensitive()) {","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/SelfRegistration/src/Service/DryRun/SelfRegistrationEmailDomainsDryRunService.php#L47-L83","documentation":"Thrown by SelfRegistrationEmailDomainsDryRunService::getAllowedDomainsInSettings when the stored self-registration settings exist but contain no allowed_domains data. Raised as ForbiddenException to signal that self-registration is effectively disabled for the instance. Prevents the domain check from running against a null allow-list.","triggerScenarios":"Dry-run when organization settings hold no 'allowed_domains' array (settings saved without domains, provider mismatch, or settings property absent entirely).","commonSituations":"Admin cleared the allowed domains list; settings stored under a different provider than the email-domains service reads; migration/version change altered the settings payload shape; fresh environment without configuration.","solutions":["Open Admin > Self Registration and configure at least one allowed domain, or POST valid settings with allowed_domains","Verify the stored settings property data contains a non-null allowed_domains array","Check that the email-domains dry-run service matches the configured provider type","Re-save settings after any upgrade that changed their internal shape"],"exampleFix":"// before\n// settings stored without domains\n{\"providers\":{\"emailDomains\":{}}}\n// after\n{\"providers\":{\"emailDomains\":{\"allowed_domains\":[\"example.com\",\"company.org\"]}}}","handlingStrategy":"fallback","validationCode":"const settings = await api.get('/self-registration/settings.json');\nconst domains = settings?.data?.allowed_domains;\nif (!Array.isArray(domains) || domains.length === 0) {\n  // self-registration effectively disabled — don't call dry-run\n}","typeGuard":"const hasAllowedDomains = (s) => Array.isArray(s?.data?.allowed_domains) && s.data.allowed_domains.length > 0;","tryCatchPattern":"try {\n    await api.post('/self-registration/dry-run', { email });\n} catch (e) {\n    if (e.status === 403 && /disabled/i.test(e.message)) { /* treat registration as closed */ }\n}","preventionTips":["Configure at least one allowed domain in admin settings","Re-verify settings after upgrades or environment clones","Persist settings under the provider the email-domains service reads","Surface a clear 'registration closed' state instead of calling dry-run blind"],"tags":["self-registration","configuration","settings"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}