Self-hosted Fizzy continues to allow signups, despite account existing

[cmchittom]

I have installed self-hosted Fizzy via Once, as per README.md. It works great, except that it continues to allow signups, even though an account is already created.

https://github.com/basecamp/fizzy/blob/main/docs/docker-deployment.md says

By default, when you run the Fizzy Docker image you'll be limited to creating a single account (although that account can have as many users as you like). This is for convenience: typically when you self-host you'll be running a single account, so in this mode new account signups are automatically disabled as soon as you've created your first account.

If you do want to allow multiple accounts to be created in your instance, set MULTI_TENANT=true

I have tried setting MULTI_TENANT=false manually via the Once interface—as far as I can tell, there's no change in behavior.

[TanbirRamim]

Signups probably are closed, it just doesn't look like it from the login page. The check is Account.accepting_signups?, which is multi_tenant || Account.none? (app/models/account/multi_tenantable.rb), so with one account it is already false and MULTI_TENANT=false changes nothing.

What can be confusing is how the login form treats an unknown email. In SessionsController#create, if no identity exists and signups are closed, it calls redirect_to_fake_session_magic_link: you get the same "check your email" screen as a real user, but no identity is created and no email is sent. That's deliberate, so the form doesn't reveal which addresses have accounts.

Two quick ways to confirm:

• The login page no longer shows "New here? Sign up …", just "Enter your email and we'll get you signed in."
• Opening /signup/new redirects you back to the login page (enforce_tenant_limit).

If you do still see the Sign up link or /signup/new loads, then something is setting MULTI_TENANT to exactly true in that container, since that's the only other way the check passes in production.

[cmchittom]

Hmm. I am now seeing the behavior you describe with MULTI_TENANT set to false, but I would have sworn that I got it to create a new account despite that earlier. Perhaps I forgot to restart the container.

In any case, thank you for the clear explanation, @TanbirRamim!