[PR #5460] [CLOSED] Self-Hosting User Management Enhancement #5223

New issue

Closed

opened 2026-03-17 02:41:29 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:41:29 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5460
Author: @Sambhram1
Created: 10/7/2025
Status: ❌ Closed

Base: main ← Head: ftr-5

📝 Commits (1)

9406183 ftr-5

📊 Changes

9 files changed (+1271 additions, -39 deletions)

View changed files

➕ .azure/user-management-implementation.md (+404 -0)
➕ PR_DESCRIPTION.md (+293 -0)
➕ SELFHOST_USER_MANAGEMENT_SOLUTION.md (+237 -0)
📝 packages/hoppscotch-backend/src/auth/auth.service.ts (+60 -0)
📝 packages/hoppscotch-backend/src/types/InfraConfig.ts (+7 -0)
➕ packages/hoppscotch-backend/src/types/UserManagement.ts (+20 -0)
➕ packages/hoppscotch-backend/src/user/user-management.resolver.ts (+81 -0)
➕ packages/hoppscotch-backend/src/user/user-management.service.ts (+148 -0)
📝 packages/hoppscotch-backend/src/user/user.service.ts (+21 -39)

📄 Description

📋 Overview

This PR adds comprehensive user management controls for self-hosted Hoppscotch instances, addressing critical enterprise needs for registration control, admin-only account management, and improved user experience.

🎯 Problem Statement

Self-hosted Hoppscotch instances currently lack essential user management capabilities:

❌ No Registration Control - Anyone can register and access the application
❌ Account Deletion Risk - Users can delete accounts, potentially losing workspace data
❌ Instance Selection Friction - Users must manually reconnect to instances each session
❌ Limited Admin Control - Insufficient controls for managing user access and permissions

✨ Solution

🔐 1. Registration Control System

New Configuration Options:

ALLOW_USER_REGISTRATION      // Global registration toggle
REGISTRATION_MODE           // OPEN | INVITATION_ONLY | DISABLED  
REQUIRE_ADMIN_APPROVAL      // Require admin approval for new users

Registration Modes:

OPEN - Anyone can register (current behavior, default)
INVITATION_ONLY - Only users with invite links can register
DISABLED - No new registrations allowed

🛡️ 2. Admin-Only Account Management

Enhanced Security:

ALLOW_USER_ACCOUNT_DELETION  // Control account deletion globally

Features:

Only administrators can delete user accounts
Configuration-based deletion control
Enhanced user status management (Active, Pending, Disabled, Suspended)
Invitation system for controlled access

🔄 3. Instance Auto-Selection

Improved UX:

AUTO_SELECT_LAST_INSTANCE    // Remember and auto-connect to last instance

Benefits:

Seamless reconnection to last used instance
Reduced friction for daily usage
Configurable per-instance basis

📂 Files Changed

Backend Infrastructure

src/types/InfraConfig.ts - New configuration enums
src/types/UserManagement.ts - User status and registration types
src/auth/auth.service.ts - Registration validation logic
src/user/user.service.ts - Admin-only deletion controls
src/user/user-management.service.ts - Comprehensive user management
src/user/user-management.resolver.ts - GraphQL API endpoints

Documentation

.azure/user-management-implementation.md - Comprehensive implementation guide
SELFHOST_USER_MANAGEMENT_SOLUTION.md - Solution architecture

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5460 **Author:** [@Sambhram1](https://github.com/Sambhram1) **Created:** 10/7/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `ftr-5` --- ### 📝 Commits (1) - [`9406183`](https://github.com/hoppscotch/hoppscotch/commit/9406183e1b251d4397a7492c27f959b48dca8518) ftr-5 ### 📊 Changes **9 files changed** (+1271 additions, -39 deletions) <details> <summary>View changed files</summary> ➕ `.azure/user-management-implementation.md` (+404 -0) ➕ `PR_DESCRIPTION.md` (+293 -0) ➕ `SELFHOST_USER_MANAGEMENT_SOLUTION.md` (+237 -0) 📝 `packages/hoppscotch-backend/src/auth/auth.service.ts` (+60 -0) 📝 `packages/hoppscotch-backend/src/types/InfraConfig.ts` (+7 -0) ➕ `packages/hoppscotch-backend/src/types/UserManagement.ts` (+20 -0) ➕ `packages/hoppscotch-backend/src/user/user-management.resolver.ts` (+81 -0) ➕ `packages/hoppscotch-backend/src/user/user-management.service.ts` (+148 -0) 📝 `packages/hoppscotch-backend/src/user/user.service.ts` (+21 -39) </details> ### 📄 Description # 📋 **Overview** This PR adds comprehensive user management controls for self-hosted Hoppscotch instances, addressing critical enterprise needs for registration control, admin-only account management, and improved user experience. ## 🎯 **Problem Statement** Self-hosted Hoppscotch instances currently lack essential user management capabilities: - ❌ **No Registration Control** - Anyone can register and access the application - ❌ **Account Deletion Risk** - Users can delete accounts, potentially losing workspace data - ❌ **Instance Selection Friction** - Users must manually reconnect to instances each session - ❌ **Limited Admin Control** - Insufficient controls for managing user access and permissions ## ✨ **Solution** ### 🔐 **1. Registration Control System** **New Configuration Options:** ```typescript ALLOW_USER_REGISTRATION // Global registration toggle REGISTRATION_MODE // OPEN | INVITATION_ONLY | DISABLED REQUIRE_ADMIN_APPROVAL // Require admin approval for new users ``` **Registration Modes:** - **OPEN** - Anyone can register (current behavior, default) - **INVITATION_ONLY** - Only users with invite links can register - **DISABLED** - No new registrations allowed ### 🛡️ **2. Admin-Only Account Management** **Enhanced Security:** ```typescript ALLOW_USER_ACCOUNT_DELETION // Control account deletion globally ``` **Features:** - Only administrators can delete user accounts - Configuration-based deletion control - Enhanced user status management (Active, Pending, Disabled, Suspended) - Invitation system for controlled access ### 🔄 **3. Instance Auto-Selection** **Improved UX:** ```typescript AUTO_SELECT_LAST_INSTANCE // Remember and auto-connect to last instance ``` **Benefits:** - Seamless reconnection to last used instance - Reduced friction for daily usage - Configurable per-instance basis ## 📂 **Files Changed** ### Backend Infrastructure - `src/types/InfraConfig.ts` - New configuration enums - `src/types/UserManagement.ts` - User status and registration types - `src/auth/auth.service.ts` - Registration validation logic - `src/user/user.service.ts` - Admin-only deletion controls - `src/user/user-management.service.ts` - Comprehensive user management - `src/user/user-management.resolver.ts` - GraphQL API endpoints ### Documentation - `.azure/user-management-implementation.md` - Comprehensive implementation guide - `SELFHOST_USER_MANAGEMENT_SOLUTION.md` - Solution architecture --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>