Self-serve allowlist: an invite-only middle tier between operators and fully open registration #82

New issue

Closed

opened 2026-07-11 06:41:04 +00:00 by robocub · 1 comment

robocub commented

2026-07-11 06:41:04 +00:00

Collaborator

Today self-serve access is all-or-nothing: open_registration = false means only the allow operators can use the management bot; true means every Matrix user (federation included) gets the self-serve tier, gated structurally (room authority + Discord approval + caps + deny-list).

For a closed/invite beta the operator may want a middle tier: open registration semantics (scoped link/unlink/list, two-sided auth still mandatory) but only for MXIDs on a list they control — without making those users full operators.

Proposal: an optional [management] self_serve_allow = ["@friend:example.org", …] (or a runtime allow/deny-style bot command pair so the list is editable over DM like ban/unban). Semantics:

When set (non-empty) and open_registration = true: only listed MXIDs (plus operators) get the self-serve tier; everyone else is treated as if open registration were off (ignored, no DM auto-join).
When unset: current behavior (fully open) — no breaking change.
Deny-list still wins over everything.

Editable-over-DM is the nicer UX (mirrors ban, persists in a file under data_dir), config-only is the simpler build. Either works for the beta use case.

Context: asked by the operator while enabling open registration for testing on the hosted instance (2026-07-11). Related: #43, #47, #77.

Today self-serve access is all-or-nothing: `open_registration = false` means only the `allow` operators can use the management bot; `true` means **every** Matrix user (federation included) gets the self-serve tier, gated structurally (room authority + Discord approval + caps + deny-list). For a **closed/invite beta** the operator may want a middle tier: open registration semantics (scoped `link`/`unlink`/`list`, two-sided auth still mandatory) but only for MXIDs on a list they control — without making those users full operators. Proposal: an optional `[management] self_serve_allow = ["@friend:example.org", …]` (or a runtime `allow`/`deny`-style bot command pair so the list is editable over DM like `ban`/`unban`). Semantics: - When set (non-empty) and `open_registration = true`: only listed MXIDs (plus operators) get the self-serve tier; everyone else is treated as if open registration were off (ignored, no DM auto-join). - When unset: current behavior (fully open) — no breaking change. - Deny-list still wins over everything. Editable-over-DM is the nicer UX (mirrors `ban`, persists in a file under `data_dir`), config-only is the simpler build. Either works for the beta use case. Context: asked by the operator while enabling open registration for testing on the hosted instance (2026-07-11). Related: #43, #47, #77.

robocub referenced this issue from a commit

2026-07-11 19:18:04 +00:00

feat(mgmt,config): #80 name approval bot + #82 self-serve allowlist tier

robocub commented

2026-07-11 19:51:31 +00:00

Author

Collaborator

Fixed + shipped in v0.3.0-alpha.21 (deployed 2026-07-11). An invite-only middle tier between operators and fully-open registration. New [management] self_serve_allow seeds <data_dir>/self_serve_allow.toml; operators then edit it live over DM with serve-allow / serve-remove / serve-open / serve-list. When configured, only listed MXIDs (plus operators) get the self-serve tier; everyone else is ignored. The FILE'S EXISTENCE enables restriction (removing the last entry does not silently re-open the surface); absent ⇒ open to everyone (the pre-#82 default, backward-compatible). A single BotCtx::may_self_serve(sender) folds open_registration + the allowlist and replaces the two gates (command gate + invite accept). Verified: unit tests (file ops, tier semantics, command parse, validation) + live mgmt_self_serve_link PASS (default unrestricted, no regression).

Fixed + shipped in **v0.3.0-alpha.21** (deployed 2026-07-11). An invite-only middle tier between operators and fully-open registration. New `[management] self_serve_allow` seeds `<data_dir>/self_serve_allow.toml`; operators then edit it live over DM with `serve-allow` / `serve-remove` / `serve-open` / `serve-list`. When configured, only listed MXIDs (plus operators) get the self-serve tier; everyone else is ignored. The FILE'S EXISTENCE enables restriction (removing the last entry does not silently re-open the surface); absent ⇒ open to everyone (the pre-#82 default, backward-compatible). A single `BotCtx::may_self_serve(sender)` folds `open_registration` + the allowlist and replaces the two gates (command gate + invite accept). Verified: unit tests (file ops, tier semantics, command parse, validation) + live `mgmt_self_serve_link` PASS (default unrestricted, no regression).

robocub closed this issue

2026-07-11 19:51:31 +00:00