From 9c45d7e6c8a57b56048071b781180b422d5438dd Mon Sep 17 00:00:00 2001
From: copyrighttxt <183881018+copyrighttxt@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:13:03 -0400
Subject: [PATCH] uhh

---
 app/pages/admin/websitefeaturesdefinition.py |  3 ++
 app/pages/invitekeys/handler.py              |  8 +++-
 app/pages/signup/signup.html                 |  2 +
 app/pages/signup/signup.py                   | 43 +++++++++++---------
 4 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/app/pages/admin/websitefeaturesdefinition.py b/app/pages/admin/websitefeaturesdefinition.py
index fd5e635..965df22 100644
--- a/app/pages/admin/websitefeaturesdefinition.py
+++ b/app/pages/admin/websitefeaturesdefinition.py
@@ -79,5 +79,8 @@ WebsiteFeaturesDefinition = [
     },
     {
         "name": "CurrencyExchange"
+    },
+    {
+        "name": "InviteKeys"
     }
 ]
\ No newline at end of file
diff --git a/app/pages/invitekeys/handler.py b/app/pages/invitekeys/handler.py
index e3e8d7c..4571f1b 100644
--- a/app/pages/invitekeys/handler.py
+++ b/app/pages/invitekeys/handler.py
@@ -1,7 +1,7 @@
 from flask import Blueprint, render_template, request, redirect, url_for, jsonify, make_response, flash
 from app.models.user import User
 from app.models.invite_key import InviteKey
-from app.util import auth, transactions
+from app.util import auth, transactions, websiteFeatures
 from app.services import invitekeys, economy
 from app.extensions import db, limiter, csrf
 from datetime import datetime, timedelta
@@ -11,6 +11,9 @@ inviteKeyRoute = Blueprint("invitekey", __name__, url_prefix="/")
 @inviteKeyRoute.route("/invite-keys", methods=["GET"])
 @auth.authenticated_required
 def inviteKeysPage():
+    if not websiteFeatures.GetWebsiteFeature("InviteKeys"):
+        flash("Invite keys are temporarily disabled", "error")
+        return redirect("/home")
     AuthenticatedUser : User = auth.GetCurrentUser()
     pageNumber = request.args.get("page", 1, int)
     if pageNumber < 1:
@@ -23,6 +26,9 @@ def inviteKeysPage():
 @auth.authenticated_required
 @csrf.exempt
 def createInviteKey():
+    if not websiteFeatures.GetWebsiteFeature("InviteKeys"):
+        flash("Invite keys are temporarily disabled", "error")
+        return redirect("/home")
     AuthenticatedUser : User = auth.GetCurrentUser()
     if AuthenticatedUser is None:
         return jsonify({"success": False, "message": "Unauthorized"}),401
diff --git a/app/pages/signup/signup.html b/app/pages/signup/signup.html
index 4c174c7..d52925d 100644
--- a/app/pages/signup/signup.html
+++ b/app/pages/signup/signup.html
@@ -24,7 +24,9 @@
             <form action="/signup" method="post">
                 <input type="text" id="username" name="username" class="form-control" placeholder="Username" value="" required>
                 <input type="password" name="password" id="password" class="form-control" placeholder="Password" value="" required>
+                {% if InviteKeysEnabled %}
                 <input type="text" id="invite-key" name="invite-key" class="form-control mb-2" placeholder="Invite Key" value="" required>
+                {% endif %}
                 <div id="checkboxTerms">
                     <input class="form-check-input" name="agreetoTermsandPrivacy" type="checkbox" id="agreeCheckbox" required>
                     <label class="form-check-label" for="agreeCheckbox">
diff --git a/app/pages/signup/signup.py b/app/pages/signup/signup.py
index 99d52b4..50ef1f8 100644
--- a/app/pages/signup/signup.py
+++ b/app/pages/signup/signup.py
@@ -33,7 +33,8 @@ def signup_page():
     if not websiteFeatures.GetWebsiteFeature("WebSignup"):
         flash("Signups are temporarily disabled")
         SignupEnabled = False
-    return render_template("signup/signup.html", SignupEnabled=SignupEnabled)
+    InviteKeysEnabled = websiteFeatures.GetWebsiteFeature("InviteKeys")
+    return render_template("signup/signup.html", SignupEnabled=SignupEnabled, InviteKeysEnabled=InviteKeysEnabled)
 
 def RateLimitReached(e):
     flash("You are being rate limited. Please try again later.")
@@ -82,7 +83,8 @@ def signup_post():
         flash("Please complete the captcha", "error")
         return redirect("/signup")
 
-    if username is None or password is None or invitekey is None:
+    InviteKeysEnabled = websiteFeatures.GetWebsiteFeature("InviteKeys")
+    if username is None or password is None or (InviteKeysEnabled and invitekey is None):
         flash("Please fill in all fields")
         return redirect("/signup")
 
@@ -189,22 +191,23 @@ def signup_post():
         flash("Username already taken")
         return redirect("/signup")
     
-    try:
-         inviteKey : InviteKey = invitekeys.GetInviteKey(invitekey)
-    except invitekeys.InviteExceptions.InvalidInviteKey:
-         redislock.release_lock("UserSignupLock", UserSignupLock)
-         flash("Invalid invite key")
-         return redirect("/signup")
-    if inviteKey.used_by is not None:
-         redislock.release_lock("UserSignupLock", UserSignupLock)
-         flash("Invite key already used")
-         return redirect("/signup")
-    InviteKeyCreator : User = User.query.filter_by(id=inviteKey.created_by).first()
-    if InviteKeyCreator is not None:
-         if InviteKeyCreator.accountstatus != 1:
-             redislock.release_lock("UserSignupLock", UserSignupLock)
-             flash("Invite key creator's account is banned")
-             return redirect("/signup")
+    if InviteKeysEnabled:
+        try:
+            inviteKey : InviteKey = invitekeys.GetInviteKey(invitekey)
+        except invitekeys.InviteExceptions.InvalidInviteKey:
+            redislock.release_lock("UserSignupLock", UserSignupLock)
+            flash("Invalid invite key")
+            return redirect("/signup")
+        if inviteKey.used_by is not None:
+            redislock.release_lock("UserSignupLock", UserSignupLock)
+            flash("Invite key already used")
+            return redirect("/signup")
+        InviteKeyCreator : User = User.query.filter_by(id=inviteKey.created_by).first()
+        if InviteKeyCreator is not None:
+            if InviteKeyCreator.accountstatus != 1:
+                redislock.release_lock("UserSignupLock", UserSignupLock)
+                flash("Invite key creator's account is banned")
+                return redirect("/signup")
     
     if not turnstile.VerifyToken(request.form.get('cf-turnstile-response')):
         redislock.release_lock("UserSignupLock", UserSignupLock)
@@ -242,7 +245,9 @@ def signup_post():
     userAvatar.torso_color_id = random.choice(AllowedBodyColors)
     db.session.add(userAvatar)
 
-    invitekeys.UseInviteKey(invitekey, NewRegisteredUser)
+    if InviteKeysEnabled:
+        invitekeys.UseInviteKey(invitekey, NewRegisteredUser)
+
 
     db.session.commit()
     redislock.release_lock("UserSignupLock", UserSignupLock)