From c17eb2a80409125dae3b5e5c4bf16f5ba79e2856 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Thu, 8 Oct 2026 12:44:39 +0200 Subject: [PATCH] :books: Document disable-email-verification team auto-add behavior (#11425) The configuration docs claimed it is not possible to add someone to a team without them accepting an invitation email, but the backend auto-adds existing profiles to the team when the email verification is disabled (create-invitation in app.rpc.commands.teams-invitations). Replace the incorrect sentence with an accurate exception note, add the missing disable-email-verification entry to the "Other flags" reference, document the CLI-created profile auto-add behavior in the docker getting-started guide, and describe the shortcut in the developer authentication docs. Closes #11424 Reported in #11376 AI-assisted-by: glm-5.3-flash --- docs/technical-guide/configuration.md | 19 ++++++++++++++++--- .../developer/subsystems/authentication.md | 7 +++++++ .../technical-guide/getting-started/docker.md | 4 ++++ 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/docs/technical-guide/configuration.md b/docs/technical-guide/configuration.md index d730abd8fc..95412109c9 100644 --- a/docs/technical-guide/configuration.md +++ b/docs/technical-guide/configuration.md @@ -386,9 +386,13 @@ By default, smtp flag is disabled, the email printed to the console, which means that the emails will be shown in the stdout. Note that if you plan to invite members to a team, it is recommended that you enable SMTP -as they will need to login to their account after receiving the invite link sent an in email. -It is currently not possible to just add someone to a team without them accepting an -invitation email. +as they will need to login to their account after receiving the invite link sent in an email. + +There is one exception: with the `disable-email-verification` flag set, inviting an email +that already has a profile adds that user to the team directly, without sending any +invitation email and without requiring acceptance. Emails without an existing profile +still follow the normal invitation flow. See the +[`disable-email-verification` flag][11] description for more detail. If you have an SMTP service, uncomment the appropriate settings section in docker-compose.yml and configure those @@ -926,6 +930,13 @@ for the user: penpot-mcp service. Check the [MCP section][8] to get more detail. - enable-prepl-server: enables PREPL server, used by manage.py and other additional tools to communicate internally with Penpot backend. Check the [CLI section][5] to get more detail. +- `disable-email-verification`: skips the email verification step on registration, making + newly registered profiles active immediately without any verification email. It also + changes the team invitation flow: inviting an email that already has a profile adds that + user to the team directly, without sending an invitation email (check the + [email configuration section][10] for more detail). Note that registering with an email + that already has an inactive profile is rejected as "email already exists" while this + flag is set. Not recommended for production environments. __Since version 1.13.0__ @@ -952,3 +963,5 @@ __Since version 2.0.0__ [7]: /technical-guide/integration/#access-tokens [8]: /mcp/ [9]: /technical-guide/developer/subsystems/link-preview/ +[10]: /technical-guide/configuration/#email-configuration +[11]: /technical-guide/configuration/#other-flags diff --git a/docs/technical-guide/developer/subsystems/authentication.md b/docs/technical-guide/developer/subsystems/authentication.md index b5946696ac..88d71f58ca 100644 --- a/docs/technical-guide/developer/subsystems/authentication.md +++ b/docs/technical-guide/developer/subsystems/authentication.md @@ -144,6 +144,13 @@ is routed, depending if the email corresponds to an existing account or not. The :register-profile or :login services are used, and the invitation token is attached so that the profile is linked to the team at the end. +There is a shortcut when the `:email-verification` flag is disabled: if the invited email +already corresponds to an existing profile, the `create-invitation` function (in +`app.rpc.commands.teams-invitations`) adds the profile to the team directly, without +creating an invitation token or sending an email, and marks the profile as active if it +was inactive. Emails without an existing profile follow the normal invitation flow +described above. + ## Handling unfinished registrations and bouncing users All tokens have an expiration date, and when they are put in a permanent diff --git a/docs/technical-guide/getting-started/docker.md b/docs/technical-guide/getting-started/docker.md index 92c8df6ca0..4d192aee11 100644 --- a/docs/technical-guide/getting-started/docker.md +++ b/docs/technical-guide/getting-started/docker.md @@ -98,6 +98,10 @@ or docker exec -ti penpot-penpot-backend-1 python3 manage.py create-profile --skip-tutorial --skip-walkthrough ``` +**NOTE:** profiles created with this command have no verified email. If the +`disable-email-verification` flag is set, inviting these users to a team adds them to it +directly, without sending any invitation email, so SMTP is not required for this flow. +Check the [Configuration][1] section for more detail. **NOTE:** the exact container name depends on your docker version and platform. For example it could be penpot-penpot-backend-1 or penpot_penpot-backend-1.