Disable New User Signins

[sheckandar]

Problem

Right now I can just spam people by entering legit email addresses into the web interface. Also, I don't want users who have no licenses to be able to create accounts.

Proposed solution

A settings should exist where only users with assigned licenses should be able to sign on. Everyone else should be denied.

Alternatives considered

No response

[j2l]

I guess the problem is that currently the email is used to automatically link a license to a customer's account, so in License Detail modal, we would need a button to manually search and link the license to the account with this email.
So this also mean that a customer could be manually created by admin too.

[baotrang220897-hue]

I don't think there should be a customer portal.

[alanisme]

Added in v0.1.3: Settings → Security → Sign-ups, set it to licensed-only. Codes then only go to addresses that already have an account, a license or a seat, and unknown addresses still get a "sent" reply so it can't be used to probe your customer list.

otp/send also has its own per-IP limit now (RATE_LIMIT_OTP_SEND, 30/hour).