From 4900d4b24a03e9cb5b09d71be61afbc22ecc280a Mon Sep 17 00:00:00 2001 From: Juanfran Date: Thu, 23 Jul 2026 09:33:32 +0200 Subject: [PATCH] :sparkles: Gate nitrate bulk-create-profiles behind a flag (#10785) The bulk profile creation endpoint creates already active profiles that skip email verification and onboarding, so it should not be reachable on production deployments. Add the `nitrate-bulk-create-profiles` flag, disabled by default, and reject the call when it is not enabled. Signed-off-by: Juanfran --- backend/src/app/rpc/management/nitrate.clj | 9 ++++++++- common/src/app/common/flags.cljc | 5 +++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/backend/src/app/rpc/management/nitrate.clj b/backend/src/app/rpc/management/nitrate.clj index 5b0fe91d4b..9ba5764ce2 100644 --- a/backend/src/app/rpc/management/nitrate.clj +++ b/backend/src/app/rpc/management/nitrate.clj @@ -980,12 +980,19 @@ RETURNING id, deleted_at;") created users skip email verification and onboarding. Emails that already belong to an existing profile are skipped. Intended for the Nitrate admin bulk-creation screen; access is gated by the shared key and, in Nitrate, an - email allow-list." + email allow-list. Requires the `nitrate-bulk-create-profiles` flag, disabled + by default so it is only available on test environments." {::doc/added "2.19" ::sm/params schema:bulk-create-profiles-params ::sm/result schema:bulk-create-profiles-result ::rpc/auth false} [cfg {:keys [password emails]}] + + (when-not (contains? cf/flags :nitrate-bulk-create-profiles) + (ex/raise :type :restriction + :code :nitrate-bulk-create-profiles-not-allowed + :hint "Bulk profile creation is disabled by config.")) + (let [derived (aauth/derive-password password)] (db/tx-run! cfg diff --git a/common/src/app/common/flags.cljc b/common/src/app/common/flags.cljc index 61edd184c5..41dedb5b94 100644 --- a/common/src/app/common/flags.cljc +++ b/common/src/app/common/flags.cljc @@ -167,6 +167,11 @@ ;; Activates the nitrate module :nitrate + ;; disabled by default. When enabled, allows the nitrate + ;; `bulk-create-profiles` method to create batches of already + ;; active profiles. Only intended for test environments. + :nitrate-bulk-create-profiles + :mcp :background-blur :available-viewer-wasm