WPB-17885 EphemeralUserCreation feature flag

changelog.d/2-features/WPB-17885

@@ -0,0 +1 @@
+Brig setting to en-/disable ephemeral user creation

charts/brig/templates/configmap.yaml

@@ -388,5 +388,6 @@ data:
       setAuditLogEmailRecipient: {{ .setAuditLogEmailRecipient }}
       {{- end }}
       setChallengeTTL: {{ or .setChallengeTTL 172800 }}
+      setEphemeralUserCreationEnabled: {{ .setEphemeralUserCreationEnabled }}
     {{- end }}
   {{- end }}

charts/brig/values.yaml

@@ -80,7 +80,7 @@ config:
     #   key: <ca-attribute>
 
   # Postgres connection settings
-  # 
+  #
   # Values are described in https://www.postgresql.org/docs/17/libpq-connect.html#LIBPQ-PARAMKEYWORDS
   # To set the password via a brig secret see `secrets.pgPassword`.
   #
@@ -189,6 +189,7 @@ config:
       ipAddressExceptions: []
       maxRateLimitedKeys: 100000 # Estimated memory usage: 4 MB
     # setAuditLogEmailRecipient: security@wire.com
+    setEphemeralUserCreationEnabled: true
 
   smtp:
     passwordFile: /etc/wire/brig/secrets/smtp-password.txt

docs/src/developer/reference/config-options.md

@@ -247,12 +247,12 @@ fileSharing:
 
 These are all the possible combinations of `status` and `lockStatus`:
 
-| `status`   | `lockStatus`   |                                                   |
-|------------|----------------|---------------------------------------------------|
-| `enabled`  | `locked`       | Feature enabled, cannot be disabled by team admin |
-| `enabled`  | `unlocked`     | Feature enabled, can be disabled by team admin    |
-| `disabled` | `locked`       | Feature disabled, cannot be enabled by team admin |
-| `disabled` | `unlocked`     | Feature disabled, can be enabled by team admin    |
+| `status`   | `lockStatus` |                                                   |
+| ---------- | ------------ | ------------------------------------------------- |
+| `enabled`  | `locked`     | Feature enabled, cannot be disabled by team admin |
+| `enabled`  | `unlocked`   | Feature enabled, can be disabled by team admin    |
+| `disabled` | `locked`     | Feature disabled, cannot be enabled by team admin |
+| `disabled` | `unlocked`   | Feature disabled, can be enabled by team admin    |
 
 The lock status for individual teams can be changed via the internal API (`PUT /i/teams/:tid/features/fileSharing/(un)?locked`).
 
@@ -920,7 +920,7 @@ To configure the team invitation URL for personal users that is sent vai email,
 
 ```yaml
 brig:
-  config
+  config:
     emailSMS:
       team:
         tExistingUserInvitationUrl: '{{ .Values.accountUrl }}/accept-invitation/?team-code=${code}'
@@ -946,6 +946,17 @@ brig:
       setAuditLogEmailRecipient: security@wire.com
 ```
 
+### Ephemeral User Creation
+
+An ephemeral user is a temporary user that can be created without an email address to join conversations via a guest link. The ephemeral user account exists only for a limited period of time, usually 24h. Ephemeral user creation is enabled per default. To disable the feature set `setEphemeralUserCreationEnabled` to `false`:
+
+```yaml
+brig:
+  config:
+    optSettings:
+      setEphemeralUserCreationEnabled: false
+```
+
 ## Settings in cargohold
 
 AWS S3 (or an alternative provider / service) is used to upload and download

integration/test/Test/User.hs

@@ -381,3 +381,23 @@ testPasswordChange =
         resp.status `shouldMatchInt` 403
         resp.json %. "label" `shouldMatch` "invalid-credentials"
       login domain email newPassword >>= assertSuccess
+
+testEphemeralUserCreation :: (HasCallStack) => TaggedBool "ephemeral-user-creation-enabled" -> App ()
+testEphemeralUserCreation (TaggedBool enabled) = do
+  withModifiedBackend
+    def
+      { brigCfg = setField "optSettings.setEphemeralUserCreationEnabled" enabled
+      }
+    $ \domain -> do
+      registerEphemeralUser domain `bindResponse` \resp -> do
+        if enabled
+          then do
+            resp.status `shouldMatchInt` 201
+          else do
+            resp.status `shouldMatchInt` 403
+            resp.json %. "label" `shouldMatch` "ephemeral-user-creation-disabled"
+
+        registerUserWithEmail domain >>= assertSuccess
+  where
+    registerEphemeralUser domain = addUser domain def
+    registerUserWithEmail domain = addUser domain def {email = Just ("user@" <> domain)}

libs/wire-api/src/Wire/API/Error/Brig.hs

@@ -45,6 +45,7 @@ data BrigError
   | InvalidHandle
   | HandleNotFound
   | UserCreationRestricted
+  | EphemeralUserCreationDisabled
   | AllowlistError
   | InvalidInvitationCode
   | MissingIdentity
@@ -236,6 +237,8 @@ type instance
 -- | docs/reference/user/registration.md {#RefRestrictRegistration}.
 type instance MapError 'UserCreationRestricted = 'StaticError 403 "user-creation-restricted" "This instance does not allow creation of personal users or teams."
 
+type instance MapError 'EphemeralUserCreationDisabled = 'StaticError 403 "ephemeral-user-creation-disabled" "Ephemeral user creation is disabled on this instance."
+
 type instance MapError 'MLSProtocolError = 'StaticError 400 "mls-protocol-error" "MLS protocol error"
 
 type instance MapError 'InvalidPhone = 'StaticError 400 "invalid-phone" "Invalid mobile phone number"

libs/wire-api/src/Wire/API/User.hs

@@ -831,6 +831,7 @@ data RegisterError
   | RegisterErrorBlacklistedEmail
   | RegisterErrorTooManyTeamMembers
   | RegisterErrorUserCreationRestricted
+  | RegisterErrorEphemeralUserCreationDisabled
   deriving (Show, Generic)
   deriving (AsUnion RegisterErrorResponses) via GenericAsUnion RegisterErrorResponses RegisterError
 
@@ -847,7 +848,8 @@ type RegisterErrorResponses =
      ErrorResponse 'InvalidPhone,
      ErrorResponse 'BlacklistedEmail,
      ErrorResponse 'TooManyTeamMembers,
-     ErrorResponse 'UserCreationRestricted
+     ErrorResponse 'UserCreationRestricted,
+     ErrorResponse 'EphemeralUserCreationDisabled
    ]
 
 type RegisterResponses =

services/brig/brig.integration.yaml

@@ -260,6 +260,7 @@ optSettings:
       - 127.0.0.1/8
     maxRateLimitedKeys: 100000 # Estimated memory usage: 4 MB
   setChallengeTTL: 172800
+  setEphemeralUserCreationEnabled: true
 
 logLevel: Warn
 logNetStrings: false

services/brig/src/Brig/API/User.hs

@@ -557,14 +557,18 @@ createUserInviteViaScim (NewUserScimInvitation tid uid extId loc name email _) =
 -- | docs/reference/user/registration.md {#RefRestrictRegistration}.
 checkRestrictedUserCreation :: NewUser password -> ExceptT RegisterError (AppT r) ()
 checkRestrictedUserCreation new = do
-  restrictPlease <- fromMaybe False <$> asks (.settings.restrictUserCreation)
+  restrict <- fromMaybe False <$> asks (.settings.restrictUserCreation)
   when
-    ( restrictPlease
+    ( restrict
         && not (isNewUserTeamMember new)
         && not (isNewUserEphemeral new)
     )
     $ throwE RegisterErrorUserCreationRestricted
 
+  ephemeralUserCreationEnabled <- asks (.settings.ephemeralUserCreationEnabled)
+  when (not ephemeralUserCreationEnabled && isNewUserEphemeral new) $
+    throwE RegisterErrorEphemeralUserCreationDisabled
+
 -------------------------------------------------------------------------------
 -- Forcefully revoke a verified identity
 

services/brig/src/Brig/Options.hs

@@ -600,7 +600,9 @@ data Settings = Settings
     -- | Optional recipient email address for email domain registration audit logs
     auditLogEmailRecipient :: !(Maybe EmailAddress),
     -- | Time-to-live for new domain verification challenges, in seconds
-    challengeTTL :: !Timeout
+    challengeTTL :: !Timeout,
+    -- | Whether to allow ephemeral user creation
+    ephemeralUserCreationEnabled :: !Bool
   }
   deriving (Show, Generic)