From 113923ca17cfc7069ced540d943125964e98745d Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Fri, 28 Aug 2026 15:12:57 +0000 Subject: [PATCH] :books: Document disable-email-verification team auto-add behavior The configuration docs claimed it is not possible to add someone to a team without them accepting an invitation email, but the backend auto-adds existing profiles to the team when the email verification is disabled (create-invitation in app.rpc.commands.teams-invitations). Replace the incorrect sentence with an accurate exception note, add the missing disable-email-verification entry to the "Other flags" reference, document the CLI-created profile auto-add behavior in the docker getting-started guide, and describe the shortcut in the developer authentication docs. Closes #11424 Reported in #11376 AI-assisted-by: glm-5.3-flash --- docs/technical-guide/configuration.md | 18 +++++++++++++++--- .../developer/subsystems/authentication.md | 7 +++++++ docs/technical-guide/getting-started/docker.md | 4 ++++ 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/docs/technical-guide/configuration.md b/docs/technical-guide/configuration.md index 1541f1d3b8..b79b67674b 100644 --- a/docs/technical-guide/configuration.md +++ b/docs/technical-guide/configuration.md @@ -343,9 +343,13 @@ By default, smtp flag is disabled, the email printed to the console, which means that the emails will be shown in the stdout. Note that if you plan to invite members to a team, it is recommended that you enable SMTP -as they will need to login to their account after receiving the invite link sent an in email. -It is currently not possible to just add someone to a team without them accepting an -invitation email. +as they will need to login to their account after receiving the invite link sent in an email. + +There is one exception: with the `disable-email-verification` flag set, inviting an email +that already has a profile adds that user to the team directly, without sending any +invitation email and without requiring acceptance. Emails without an existing profile +still follow the normal invitation flow. See the +[`disable-email-verification` flag][8] description for more detail. If you have an SMTP service, uncomment the appropriate settings section in docker-compose.yml and configure those @@ -672,6 +676,13 @@ for the user: - disable-login-with-password: allows disable password based login form - enable-prepl-server: enables PREPL server, used by manage.py and other additional tools to communicate internally with Penpot backend. Check the [CLI section][5] to get more detail. +- `disable-email-verification`: skips the email verification step on registration, making + newly registered profiles active immediately without any verification email. It also + changes the team invitation flow: inviting an email that already has a profile adds that + user to the team directly, without sending an invitation email (check the + [email configuration section][8] for more detail). Note that registering with an email + that already has an inactive profile is rejected as "email already exists" while this + flag is set. Not recommended for production environments. __Since version 1.13.0__ @@ -693,3 +704,4 @@ __Since version 2.0.0__ [5]: /technical-guide/getting-started/docker#using-the-cli-for-administrative-tasks [6]: /technical-guide/integration/#webhooks [7]: /technical-guide/integration/#access-tokens +[8]: /technical-guide/configuration/#email-configuration diff --git a/docs/technical-guide/developer/subsystems/authentication.md b/docs/technical-guide/developer/subsystems/authentication.md index da437194ee..1a76ff3074 100644 --- a/docs/technical-guide/developer/subsystems/authentication.md +++ b/docs/technical-guide/developer/subsystems/authentication.md @@ -113,6 +113,13 @@ is routed, depending if the email corresponds to an existing account or not. The :register-profile or :login services are used, and the invitation token is attached so that the profile is linked to the team at the end. +There is a shortcut when the `:email-verification` flag is disabled: if the invited email +already corresponds to an existing profile, the `create-invitation` function (in +`app.rpc.commands.teams-invitations`) adds the profile to the team directly, without +creating an invitation token or sending an email, and marks the profile as active if it +was inactive. Emails without an existing profile follow the normal invitation flow +described above. + ## Handling unfinished registrations and bouncing users All tokens have an expiration date, and when they are put in a permanent diff --git a/docs/technical-guide/getting-started/docker.md b/docs/technical-guide/getting-started/docker.md index a8c7b55ffa..6b99666388 100644 --- a/docs/technical-guide/getting-started/docker.md +++ b/docs/technical-guide/getting-started/docker.md @@ -95,6 +95,10 @@ or docker exec -ti penpot-penpot-backend-1 python3 manage.py create-profile --skip-tutorial --skip-walkthrough ``` +**NOTE:** profiles created with this command have no verified email. If the +`disable-email-verification` flag is set, inviting these users to a team adds them to it +directly, without sending any invitation email, so SMTP is not required for this flow. +Check the [Configuration][1] section for more detail. **NOTE:** the exact container name depends on your docker version and platform. For example it could be penpot-penpot-backend-1 or penpot_penpot-backend-1.