From 0819f51c3afea557a3ddee7b76f8e84fc4dea2e1 Mon Sep 17 00:00:00 2001
From: Vlad Stan <stan.v.vlad@gmail.com>
Date: Tue, 3 Feb 2026 11:21:47 +0200
Subject: [PATCH] feat: check invitation code

---
 lnbits/core/views/auth_api.py   | 14 +++++++-------
 lnbits/static/js/api.js         |  5 +++--
 lnbits/static/js/components.js  | 11 ++++++++++-
 lnbits/static/js/pages/home.js  |  5 ++++-
 lnbits/templates/pages/home.vue |  1 +
 5 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/lnbits/core/views/auth_api.py b/lnbits/core/views/auth_api.py
index 85cc35281..674c7f58a 100644
--- a/lnbits/core/views/auth_api.py
+++ b/lnbits/core/views/auth_api.py
@@ -367,8 +367,7 @@ async def register(data: RegisterUser) -> JSONResponse:
     if data.email and not is_valid_email_address(data.email):
         raise HTTPException(HTTPStatus.BAD_REQUEST, "Invalid email.")
 
-    if not await check_register_activation_settings(data):
-        raise HTTPException(HTTPStatus.FORBIDDEN, "User activation failed.")
+    await check_register_activation_settings(data)
 
     account = Account(
         id=uuid4().hex,
@@ -380,22 +379,23 @@ async def register(data: RegisterUser) -> JSONResponse:
     return _auth_success_response(account.username, account.id, account.email)
 
 
-async def check_register_activation_settings(data: RegisterUser) -> bool:
+async def check_register_activation_settings(data: RegisterUser):
     if not settings.lnbits_require_user_activation:
-        return True
+        return None
     if settings.lnbits_user_activation_by_invitation_code and data.invitation_code:
         code = data.invitation_code.strip()
         if code == settings.lnbits_register_reusable_activation_code:
-            return True
+            return None
         if code in settings.lnbits_register_one_time_activation_codes:
             settings.lnbits_register_one_time_activation_codes.remove(code)
             await set_settings_field(
                 "lnbits_register_one_time_activation_codes",
                 settings.lnbits_register_one_time_activation_codes,
             )
-            return True
+            return None
+        raise ValueError("Invalid invitation code.")
 
-    return False
+    raise ValueError("No activation method provided.")
 
 
 @auth_router.put("/pubkey")
diff --git a/lnbits/static/js/api.js b/lnbits/static/js/api.js
index 1617a1a9f..ba1936790 100644
--- a/lnbits/static/js/api.js
+++ b/lnbits/static/js/api.js
@@ -66,7 +66,7 @@ window._lnbitsApi = {
       name: name
     })
   },
-  register(username, email, password, password_repeat) {
+  register(username, email, password, password_repeat, invitation_code) {
     return axios({
       method: 'POST',
       url: '/api/v1/auth/register',
@@ -74,7 +74,8 @@ window._lnbitsApi = {
         username,
         email,
         password,
-        password_repeat
+        password_repeat,
+        invitation_code
       }
     })
   },
diff --git a/lnbits/static/js/components.js b/lnbits/static/js/components.js
index adc561f5e..bb0dcfc56 100644
--- a/lnbits/static/js/components.js
+++ b/lnbits/static/js/components.js
@@ -432,6 +432,7 @@ window.app.component('username-password', {
     username: String,
     password_1: String,
     password_2: String,
+    invitationCode: String,
     resetKey: String
   },
 
@@ -449,7 +450,7 @@ window.app.component('username-password', {
       reset_key: this.resetKey,
       confirmationMethod: 'code',
       confirmationEmail: '',
-      confirmationCode: '',
+      confirmationCode: this.invitationCode || '',
       showConfirmationCode: false,
       nostrConfirmationIdentifier: ''
     }
@@ -464,6 +465,7 @@ window.app.component('username-password', {
       this.$emit('update:userName', this.username)
       this.$emit('update:password_1', this.password)
       this.$emit('update:password_2', this.passwordRepeat)
+      this.$emit('update:invitationCode', this.confirmationCode)
       this.$emit('register')
     },
     reset() {
@@ -570,6 +572,13 @@ window.app.component('username-password', {
         this.confirmationMethod !== 'nostr' ||
         this.nostrConfirmationIdentifier.length > 0
 
+      console.log('### disableRegister', {
+        usernameOK,
+        passwordOK,
+        passwordsMatch,
+        codeOk,
+        nostrOk
+      })
       return (
         !usernameOK || !passwordOK || !passwordsMatch || !codeOk || !nostrOk
       )
diff --git a/lnbits/static/js/pages/home.js b/lnbits/static/js/pages/home.js
index 4ed43e8c1..ed8dd52c0 100644
--- a/lnbits/static/js/pages/home.js
+++ b/lnbits/static/js/pages/home.js
@@ -11,6 +11,7 @@ window.PageHome = {
       email: '',
       password: '',
       passwordRepeat: '',
+      invitationCode: '',
       walletName: '',
       signup: false
     }
@@ -40,6 +41,7 @@ window.PageHome = {
       this.username = null
       this.password = null
       this.passwordRepeat = null
+      this.invitationCode = null
 
       this.authAction = 'register'
       this.authMethod = authMethod
@@ -51,7 +53,8 @@ window.PageHome = {
           this.username,
           this.email,
           this.password,
-          this.passwordRepeat
+          this.passwordRepeat,
+          this.invitationCode
         )
         this.refreshAuthUser()
       } catch (e) {
diff --git a/lnbits/templates/pages/home.vue b/lnbits/templates/pages/home.vue
index 988ac0acb..f630082b6 100644
--- a/lnbits/templates/pages/home.vue
+++ b/lnbits/templates/pages/home.vue
@@ -63,6 +63,7 @@
                   v-model:user-name="username"
                   v-model:password_1="password"
                   v-model:password_2="passwordRepeat"
+                  v-model:invitation-code="invitationCode"
                   v-model:reset-key="reset_key"
                   @login="login"
                   @register="register"