feat(white-label): invite-only signup for brand domains (#1995)

* feat(white-label): invite-only signup for brand domains A brand domain belongs to the partner's people (founder decision 2026-08-27): only allowlisted or invited users may create an account on an invite-only brand domain; everyone else is shown an interstitial that sends them to the canonical Accounted signup. - brands.signup_mode ('open' default / 'invite_only') + brand_signup_allowlist (lowercase emails, team-scoped RLS, owner/admin writes) + create_company_for_brand_signup RPC, with pg-real coverage - server-side gate (lib/auth/brand-signup-gate.ts) enforced on every signup path: email signup moved to POST /api/auth/signup (the browser used to call GoTrue directly, so a client-side check would be bypassable), BankID gated in /bankid/complete, Google covered by the dashboard layout's brand-domain bounce - company invites bypass the allowlist: the invite is the authorization - register page interstitial on gated brands (no email in the outbound URL), sv+en strings - dashboard layout bounces non-belonging sessions off gated brand hosts to the canonical domain (navigation rule like WL-01, not a security boundary) - allowlisted signups' onboarding-created companies attach to the brand's byra team via the new RPC, so WL-01 homes them on the brand domain; the allowlist entry recorded by an owner/admin stands in for the WL-15 admin gate - byra cockpit page /clients/access + /api/clients/signup-access to manage the mode and the allowlist All existing brands default to 'open': behavior is byte-identical until a brand is flipped to invite_only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * fix(white-label): rollback brand-signup company with the service client Skeptic (correctness) found that a brand-signup company created under the service role rolled back with the cookie-session client: `companies` has RLS and no FOR DELETE policy, so the delete was a silent 0-row no-op, stranding a member-less ghost company on the partner's byra team. Pass an optional rollbackClient to createCompanyCore and hand it the service client on that path; user_preferences.active_company_id then clears itself via its ON DELETE SET NULL FK once the company row is actually deleted. Also map a validateBody 400 (flat envelope, no code) on the register page to the specific email-invalid field message instead of the generic one, since the client already pre-gates password strength. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * fix(white-label): fail-safe brand lookup, pg-test seed, anonymize fixtures Second resolve-pr cycle: skeptic + CodeRabbit findings and a green-up. - Fail safe on a brands-table error (CodeRabbit CWE-285): the gate treated a failed resolveBrandByHost as an unbranded host, opening invite-only signup during a transient DB blip. resolveBrandResultByHost now distinguishes "no brand" from "lookup failed"; the gate returns lookupFailed and the email + BankID routes answer 503 (retry), never creating an account. - pg-real: the RLS delete test seeded its row inside withUserContext, which always rolls back, so the owner DELETE saw zero rows. Seed on the superuser pool instead. - Anonymize every test/fixture brand to the repo's existing synthetic placeholder (Siffra / app.siffra.se): no real partner names in code. - SignupAccessManager: functional setData updates so a concurrent mode toggle and an add/remove do not clobber each other's snapshot (CodeRabbit). - Route a transient-error message through i18n instead of the raw envelope (raw-user-error guard); new register.error_temporary sv+en. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * test(white-label): anonymize new signup-gate fixtures; log oracle residual Rename the placeholder brand in the four new brand-signup test files to a clearly-fake, partner-unrelated name (Testbrand / app.testbrand.example); the previous placeholder echoed a real partner. Scoped to files this PR creates; the repo-wide legacy placeholder is left for a separate cleanup. Also record in DECISIONS.md that the feature ships accepting the low-severity allowlist-enumeration residual (captcha-free 403 vs 200 on the signup endpoint), with rate-limiting as the follow-up option. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-27 18:32:52 +02:00
parent 325c827322
commit 4f6ecad549
28 changed files with 2495 additions and 44 deletions
@@ -46,6 +46,7 @@ function makeBrand(overrides: Partial<Brand> = {}): Brand {
    senderDomain: 'post.siffra.se',
    senderDomainStatus: 'verified',
    resendDomainId: 'rd-1',
+    signupMode: 'open',
    ...overrides,
  }
 }
@@ -0,0 +1,179 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { parseJsonResponse } from '@/tests/helpers'
+
+const signUpMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: vi.fn(async () => ({ auth: { signUp: signUpMock } })),
+}))
+
+const gateMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/auth/brand-signup-gate', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/lib/auth/brand-signup-gate')>()
+  return {
+    ...actual,
+    evaluateBrandSignupGate: (...args: unknown[]) => gateMock(...args),
+  }
+})
+
+import { POST } from '../route'
+
+function makeRequest(
+  body: unknown,
+  headers: Record<string, string> = {},
+): Request {
+  return new Request('https://internal/api/auth/signup', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: JSON.stringify(body),
+  })
+}
+
+const validBody = { email: 'kund@example.com', password: 'Str0ng!Pass' }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  gateMock.mockResolvedValue({ allowed: true, brand: null, via: 'no_brand' })
+  signUpMock.mockResolvedValue({
+    data: { user: { identities: [{ id: 'i1' }] }, session: null },
+    error: null,
+  })
+})
+
+describe('POST /api/auth/signup', () => {
+  it('400s on invalid body', async () => {
+    const res = await POST(makeRequest({ email: 'not-an-email', password: 'x' }))
+    expect(res.status).toBe(400)
+    expect(signUpMock).not.toHaveBeenCalled()
+  })
+
+  it('403s with signup_not_allowed when the gate blocks', async () => {
+    gateMock.mockResolvedValue({ allowed: false, brand: { id: 'brand-1' } })
+
+    const res = await POST(
+      makeRequest(validBody, { host: 'app.testbrand.example' }),
+    )
+    const { body: json } = await parseJsonResponse<{ error: { code: string } }>(res)
+
+    expect(res.status).toBe(403)
+    expect(json.error.code).toBe('signup_not_allowed')
+    expect(signUpMock).not.toHaveBeenCalled()
+  })
+
+  it('503s (fail safe) when the brand lookup errors, without creating an account', async () => {
+    gateMock.mockResolvedValue({ allowed: false, brand: null, lookupFailed: true })
+
+    const res = await POST(
+      makeRequest(validBody, { host: 'app.testbrand.example' }),
+    )
+    const { body: json } = await parseJsonResponse<{ error: { code: string } }>(res)
+
+    expect(res.status).toBe(503)
+    expect(json.error.code).toBe('brand_lookup_failed')
+    expect(signUpMock).not.toHaveBeenCalled()
+  })
+
+  it('feeds the gate the forwarded host, normalized email and invite cookie', async () => {
+    await POST(
+      makeRequest(
+        { ...validBody, email: '  Kund@Example.COM ' },
+        {
+          host: 'internal',
+          'x-forwarded-host': 'app.testbrand.example',
+          cookie: 'gnubok-invite-token=gnubok_inv_x',
+        },
+      ),
+    )
+
+    expect(gateMock).toHaveBeenCalledWith({
+      host: 'app.testbrand.example',
+      email: 'kund@example.com',
+      inviteToken: 'gnubok_inv_x',
+    })
+  })
+
+  it('signs up with a confirmation callback on the originating host', async () => {
+    const res = await POST(
+      makeRequest(validBody, {
+        'x-forwarded-host': 'app.testbrand.example',
+        'x-forwarded-proto': 'https',
+      }),
+    )
+    const { body: json } = await parseJsonResponse<{ data: { status: string } }>(res)
+
+    expect(res.status).toBe(200)
+    expect(json.data.status).toBe('confirmation_sent')
+    expect(signUpMock).toHaveBeenCalledWith({
+      email: 'kund@example.com',
+      password: 'Str0ng!Pass',
+      options: {
+        emailRedirectTo: 'https://app.testbrand.example/auth/callback',
+      },
+    })
+  })
+
+  it('forwards the captcha token and a safe next path', async () => {
+    await POST(
+      makeRequest(
+        { ...validBody, captchaToken: 'tok', next: '/api/mcp-oauth/authorize?x=1' },
+        { host: 'app.accounted.se' },
+      ),
+    )
+
+    const call = signUpMock.mock.calls[0][0]
+    expect(call.options.captchaToken).toBe('tok')
+    expect(call.options.emailRedirectTo).toBe(
+      'https://app.accounted.se/auth/callback?next=%2Fapi%2Fmcp-oauth%2Fauthorize%3Fx%3D1',
+    )
+  })
+
+  it('drops an unsafe next path instead of forwarding it', async () => {
+    await POST(
+      makeRequest(
+        { ...validBody, next: 'https://evil.example.com/phish' },
+        { host: 'app.accounted.se' },
+      ),
+    )
+    const call = signUpMock.mock.calls[0][0]
+    expect(call.options.emailRedirectTo).toBe(
+      'https://app.accounted.se/auth/callback',
+    )
+  })
+
+  it('maps a GoTrue error to the canonical envelope', async () => {
+    signUpMock.mockResolvedValue({
+      data: { user: null, session: null },
+      error: { code: 'weak_password', message: 'Password is too weak', status: 422 },
+    })
+
+    const res = await POST(makeRequest(validBody, { host: 'app.accounted.se' }))
+    const { body: json } = await parseJsonResponse<{ error: { code: string; message: string } }>(res)
+
+    expect(res.status).toBe(422)
+    expect(json.error.code).toBe('weak_password')
+  })
+
+  it('reports duplicate for the obfuscated existing-account response', async () => {
+    signUpMock.mockResolvedValue({
+      data: { user: { identities: [] }, session: null },
+      error: null,
+    })
+
+    const res = await POST(makeRequest(validBody, { host: 'app.accounted.se' }))
+    const { body: json } = await parseJsonResponse<{ data: { status: string } }>(res)
+
+    expect(json.data.status).toBe('duplicate')
+  })
+
+  it('reports session for auto-confirmed signups', async () => {
+    signUpMock.mockResolvedValue({
+      data: { user: { identities: [{ id: 'i1' }] }, session: { access_token: 'x' } },
+      error: null,
+    })
+
+    const res = await POST(makeRequest(validBody, { host: 'app.accounted.se' }))
+    const { body: json } = await parseJsonResponse<{ data: { status: string } }>(res)
+
+    expect(json.data.status).toBe('session')
+  })
+})
@@ -0,0 +1,131 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createClient } from '@/lib/supabase/server'
+import { validateBody } from '@/lib/api/validate'
+import {
+  evaluateBrandSignupGate,
+  readInviteTokenFromCookieHeader,
+} from '@/lib/auth/brand-signup-gate'
+import { safeReturnTo } from '@/lib/auth/safe-return-to'
+import { getErrorMessage } from '@/lib/errors/get-error-message'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('auth-signup')
+
+/**
+ * POST /api/auth/signup: email+password signup, moved server-side so the
+ * invite-only brand-domain gate (lib/auth/brand-signup-gate.ts) cannot be
+ * bypassed. The register page used to call supabase.auth.signUp straight
+ * from the browser; that call never touched Next.js, so any host-based
+ * gating there would have been cosmetic. This route is now the only
+ * email-signup path on every host: on canonical and open-brand hosts the
+ * behavior is byte-identical to the old direct call (same GoTrue request,
+ * same captcha, same emailRedirectTo shape), on invite-only brand hosts it
+ * refuses with signup_not_allowed unless the email is allowlisted or a
+ * valid invite cookie rides along.
+ *
+ * Anonymous by design: there is no session to authenticate at signup time,
+ * so no withRouteContext / requireAuth. Abuse is bounded the same way the
+ * direct GoTrue call was: the forwarded Turnstile token (verified by
+ * GoTrue) plus GoTrue's own signup rate limits.
+ */
+
+const SignupSchema = z.object({
+  email: z.string().trim().toLowerCase().max(320).pipe(z.string().email()),
+  password: z.string().min(8).max(256),
+  captchaToken: z.string().max(4096).nullish(),
+  /** Post-signup resume path (MCP OAuth consent); same-origin enforced. */
+  next: z.string().max(2048).nullish(),
+})
+
+export async function POST(request: Request) {
+  const validation = await validateBody(request, SignupSchema)
+  if (!validation.success) return validation.response
+  const { email, password, captchaToken } = validation.data
+
+  const host =
+    request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? ''
+
+  // The invite cookie is set by /invite/[token] before it redirects to
+  // /register, so an invitee's signup carries it automatically.
+  const inviteToken = readInviteTokenFromCookieHeader(request.headers.get('cookie'))
+
+  const gate = await evaluateBrandSignupGate({ host, email, inviteToken })
+  if (!gate.allowed && 'lookupFailed' in gate) {
+    // Transient brands-table error: fail safe, do not create the account.
+    // 503 tells the client to retry rather than the misleading "not allowed".
+    return NextResponse.json(
+      {
+        error: {
+          code: 'brand_lookup_failed',
+          message: 'Tillfälligt fel. Försök igen om en stund.',
+          message_en: 'Temporary error. Please try again shortly.',
+        },
+      },
+      { status: 503 },
+    )
+  }
+  if (!gate.allowed) {
+    return NextResponse.json(
+      {
+        error: {
+          code: 'signup_not_allowed',
+          // Brand-neutral copy: the interstitial on the register page owns
+          // the user-facing story; this message is the API-level fallback.
+          message: 'Registrering på den här domänen kräver inbjudan.',
+          message_en: 'Signing up on this domain requires an invitation.',
+        },
+      },
+      { status: 403 },
+    )
+  }
+
+  // Confirmation links must land back on the ORIGINATING host (WL-05 brand
+  // mail resolves its brand from this URL), so build the callback from the
+  // forwarded host rather than request.url, which can be an internal origin
+  // behind the proxy.
+  const proto = request.headers.get('x-forwarded-proto') ?? 'https'
+  const confirmationCallback = new URL(`${proto}://${host}/auth/callback`)
+  const nextPath = safeReturnTo(validation.data.next ?? null, '/')
+  if (nextPath !== '/') confirmationCallback.searchParams.set('next', nextPath)
+
+  const supabase = await createClient()
+  const { data, error } = await supabase.auth.signUp({
+    email,
+    password,
+    options: {
+      emailRedirectTo: confirmationCallback.toString(),
+      ...(captchaToken ? { captchaToken } : {}),
+    },
+  })
+
+  if (error) {
+    log.warn('signUp rejected', { status: error.status, code: error.code })
+    // The register page feeds this envelope to classifyAuthError, which
+    // keys on the GoTrue code (and the HTTP status); the display message is
+    // localized through getErrorMessage like every other auth surface.
+    return NextResponse.json(
+      {
+        error: {
+          code: error.code ?? 'auth_error',
+          message: getErrorMessage(error, { context: 'auth', locale: 'sv' }),
+          message_en: getErrorMessage(error, { context: 'auth', locale: 'en' }),
+        },
+      },
+      { status: error.status && error.status >= 400 ? error.status : 400 },
+    )
+  }
+
+  // Supabase obfuscates duplicate signups (anti-enumeration): a confirmed
+  // existing email returns a user with identities: [] and sends no mail.
+  // Surface that as a distinct status so the page can skip the misleading
+  // "check your email" screen; the information is the same the browser call
+  // exposed, so nothing new leaks.
+  const status = data.session
+    ? 'session'
+    : data.user && (data.user.identities?.length ?? 0) === 0
+      ? 'duplicate'
+      : 'confirmation_sent'
+
+  return NextResponse.json({ data: { status } })
+}
@@ -0,0 +1,171 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { createQueuedMockSupabase, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+const service = createQueuedMockSupabase()
+
+const requireAuthMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+const byraMembershipMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/clients/fetch-client-overview', () => ({
+  getByraMembership: (...args: unknown[]) => byraMembershipMock(...args),
+}))
+
+const brandForTeamMock = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/branding/resolve', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/lib/branding/resolve')>()
+  return {
+    ...actual,
+    resolveBrandForTeam: (...args: unknown[]) => brandForTeamMock(...args),
+    clearBrandCache: vi.fn(),
+  }
+})
+
+vi.mock('@/lib/auth/api-keys', () => ({
+  createServiceClientNoCookies: vi.fn(() => service.supabase),
+}))
+
+import { GET, PATCH, POST, DELETE } from '../route'
+
+const BRAND = {
+  id: 'brand-1',
+  teamId: 'team-1',
+  domain: 'app.testbrand.example',
+  appName: 'Testbrand',
+  signupMode: 'invite_only',
+}
+
+function makeRequest(method: string, body?: unknown): Request {
+  return new Request('https://app.test/api/clients/signup-access', {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+}
+
+function authed() {
+  requireAuthMock.mockResolvedValue({
+    user: { id: 'user-1', email: 'byra@example.com' },
+    supabase,
+    error: null,
+  })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  service.reset()
+  authed()
+  byraMembershipMock.mockResolvedValue({
+    teamId: 'team-1',
+    teamName: 'Byrån',
+    role: 'owner',
+  })
+  brandForTeamMock.mockResolvedValue(BRAND)
+})
+
+describe('/api/clients/signup-access', () => {
+  it('401s when unauthenticated', async () => {
+    requireAuthMock.mockResolvedValue({
+      user: null,
+      supabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
+    const res = await GET()
+    expect(res.status).toBe(401)
+  })
+
+  it('403s for non-byrå users', async () => {
+    byraMembershipMock.mockResolvedValue(null)
+    const res = await GET()
+    expect(res.status).toBe(403)
+  })
+
+  it('404s when the team has no brand', async () => {
+    brandForTeamMock.mockResolvedValue(null)
+    const res = await GET()
+    expect(res.status).toBe(404)
+  })
+
+  it('returns mode, role and entries', async () => {
+    enqueue({
+      data: [{ id: 'e1', email: 'kund@example.com', note: null, created_at: '2026-08-27' }],
+    })
+
+    const res = await GET()
+    const { body } = await parseJsonResponse<{
+      data: {
+        brand: { domain: string; signupMode: string }
+        role: string
+        entries: unknown[]
+      }
+    }>(res)
+
+    expect(res.status).toBe(200)
+    expect(body.data.brand.signupMode).toBe('invite_only')
+    expect(body.data.role).toBe('owner')
+    expect(body.data.entries).toHaveLength(1)
+  })
+
+  it('PATCH 403s for plain members', async () => {
+    byraMembershipMock.mockResolvedValue({
+      teamId: 'team-1',
+      teamName: 'Byrån',
+      role: 'member',
+    })
+    const res = await PATCH(makeRequest('PATCH', { signup_mode: 'invite_only' }))
+    expect(res.status).toBe(403)
+    expect(service.supabase.from).not.toHaveBeenCalled()
+  })
+
+  it('PATCH 400s on an unknown mode', async () => {
+    const res = await PATCH(makeRequest('PATCH', { signup_mode: 'wide_open' }))
+    expect(res.status).toBe(400)
+  })
+
+  it('PATCH flips the mode through the service client', async () => {
+    service.enqueue({ data: null, error: null })
+    const res = await PATCH(makeRequest('PATCH', { signup_mode: 'invite_only' }))
+    expect(res.status).toBe(200)
+    expect(service.findCall('brands', 'update')).toEqual([
+      { signup_mode: 'invite_only' },
+    ])
+    expect(service.findCall('brands', 'eq')).toEqual(['id', 'brand-1'])
+  })
+
+  it('POST adds a lowercased entry', async () => {
+    enqueue({
+      data: { id: 'e1', email: 'ny@example.com', note: 'VD', created_at: '2026-08-27' },
+    })
+
+    const res = await POST(
+      makeRequest('POST', { email: '  NY@Example.com ', note: 'VD' }),
+    )
+    expect(res.status).toBe(200)
+    const insert = supabase.from as unknown as ReturnType<typeof vi.fn>
+    expect(insert).toHaveBeenCalledWith('brand_signup_allowlist')
+  })
+
+  it('POST 409s on a duplicate email', async () => {
+    enqueue({ data: null, error: { code: '23505', message: 'duplicate' } })
+    const res = await POST(makeRequest('POST', { email: 'kund@example.com' }))
+    expect(res.status).toBe(409)
+  })
+
+  it('POST 400s on an invalid email', async () => {
+    const res = await POST(makeRequest('POST', { email: 'not-an-email' }))
+    expect(res.status).toBe(400)
+  })
+
+  it('DELETE removes scoped to the brand', async () => {
+    enqueue({ data: null, error: null })
+    const res = await DELETE(
+      makeRequest('DELETE', { id: '11111111-1111-4111-8111-111111111111' }),
+    )
+    expect(res.status).toBe(200)
+  })
+})
@@ -0,0 +1,220 @@
+import { NextResponse } from 'next/server'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
+import { getByraMembership } from '@/lib/clients/fetch-client-overview'
+import { clearBrandCache, resolveBrandForTeam, type Brand } from '@/lib/branding/resolve'
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { validateBody } from '@/lib/api/validate'
+import {
+  BrandAllowlistAddSchema,
+  BrandAllowlistRemoveSchema,
+  BrandSignupModeSchema,
+} from '@/lib/api/schemas'
+
+/**
+ * /api/clients/signup-access: the byrå cockpit's management surface for
+ * invite-only signup on the team's brand domain (2026-08-27).
+ *
+ *   GET    signup mode + allowlist entries (any byrå team member)
+ *   PATCH  { signup_mode }    flip open/invite_only        (owner/admin)
+ *   POST   { email, note? }   add an allowlist entry       (owner/admin)
+ *   DELETE { id }             remove an allowlist entry    (owner/admin)
+ *
+ * Uses requireAuth() directly (the sanctioned withRouteContext opt-out, MFA
+ * still enforced): byrå staff without a company of their own are the
+ * cockpit's primary persona, and this surface needs no active company.
+ *
+ * Allowlist reads/writes go through the caller's client so RLS enforces the
+ * same team/role rules a second time. The signup_mode flip uses the service
+ * client because brands rows are ops-managed (no user write policies); the
+ * owner/admin check here is the authorization for that single column.
+ */
+
+type Access =
+  | {
+      ok: true
+      supabase: SupabaseClient
+      userId: string
+      role: 'owner' | 'admin' | 'member'
+      brand: Brand
+    }
+  | { ok: false; response: NextResponse }
+
+async function resolveAccess(opts: { write: boolean }): Promise<Access> {
+  const auth = await requireAuth()
+  if (auth.error) return { ok: false, response: auth.error }
+  const { user, supabase } = auth
+
+  const membership = await getByraMembership(supabase, user.id)
+  if (!membership) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        {
+          error: {
+            code: 'FORBIDDEN',
+            message: 'Endast byråteam har åtkomst till registreringsinställningarna.',
+            message_en: 'Signup access settings are only available to byrå teams.',
+          },
+        },
+        { status: 403 },
+      ),
+    }
+  }
+
+  if (opts.write && membership.role !== 'owner' && membership.role !== 'admin') {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        {
+          error: {
+            code: 'FORBIDDEN',
+            message: 'Endast byråns ägare och administratörer kan ändra registreringsåtkomst.',
+            message_en: 'Only byrå owners and admins can change signup access.',
+          },
+        },
+        { status: 403 },
+      ),
+    }
+  }
+
+  const brand = await resolveBrandForTeam(membership.teamId)
+  if (!brand) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        {
+          error: {
+            code: 'NOT_FOUND',
+            message: 'Byrån har ingen egen domän ännu.',
+            message_en: 'The byrå has no white-label domain yet.',
+          },
+        },
+        { status: 404 },
+      ),
+    }
+  }
+
+  return { ok: true, supabase, userId: user.id, role: membership.role, brand }
+}
+
+export async function GET() {
+  const access = await resolveAccess({ write: false })
+  if (!access.ok) return access.response
+
+  const { data: entries, error } = await access.supabase
+    .from('brand_signup_allowlist')
+    .select('id, email, note, created_at')
+    .eq('brand_id', access.brand.id)
+    .order('created_at', { ascending: false })
+
+  if (error) {
+    return NextResponse.json(
+      { error: { code: 'INTERNAL', message: 'Kunde inte hämta listan.', message_en: 'Could not load the list.' } },
+      { status: 500 },
+    )
+  }
+
+  return NextResponse.json({
+    data: {
+      brand: {
+        domain: access.brand.domain,
+        appName: access.brand.appName,
+        signupMode: access.brand.signupMode,
+      },
+      role: access.role,
+      entries: entries ?? [],
+    },
+  })
+}
+
+export async function PATCH(request: Request) {
+  const access = await resolveAccess({ write: true })
+  if (!access.ok) return access.response
+
+  const validation = await validateBody(request, BrandSignupModeSchema)
+  if (!validation.success) return validation.response
+
+  const service = createServiceClientNoCookies()
+  const { error } = await service
+    .from('brands')
+    .update({ signup_mode: validation.data.signup_mode })
+    .eq('id', access.brand.id)
+
+  if (error) {
+    return NextResponse.json(
+      { error: { code: 'INTERNAL', message: 'Kunde inte spara.', message_en: 'Could not save.' } },
+      { status: 500 },
+    )
+  }
+
+  // The host-resolution cache holds the old mode for up to ~60s; drop it so
+  // the gate on this server instance flips immediately. Other instances
+  // converge within the TTL, same as every other brand edit.
+  clearBrandCache()
+
+  return NextResponse.json({ data: { signupMode: validation.data.signup_mode } })
+}
+
+export async function POST(request: Request) {
+  const access = await resolveAccess({ write: true })
+  if (!access.ok) return access.response
+
+  const validation = await validateBody(request, BrandAllowlistAddSchema)
+  if (!validation.success) return validation.response
+
+  const { data: entry, error } = await access.supabase
+    .from('brand_signup_allowlist')
+    .insert({
+      brand_id: access.brand.id,
+      email: validation.data.email,
+      note: validation.data.note ?? null,
+      created_by: access.userId,
+    })
+    .select('id, email, note, created_at')
+    .single()
+
+  if (error) {
+    if (error.code === '23505') {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'CONFLICT',
+            message: 'E-postadressen finns redan i listan.',
+            message_en: 'That email is already on the list.',
+          },
+        },
+        { status: 409 },
+      )
+    }
+    return NextResponse.json(
+      { error: { code: 'INTERNAL', message: 'Kunde inte lägga till.', message_en: 'Could not add the email.' } },
+      { status: 500 },
+    )
+  }
+
+  return NextResponse.json({ data: entry })
+}
+
+export async function DELETE(request: Request) {
+  const access = await resolveAccess({ write: true })
+  if (!access.ok) return access.response
+
+  const validation = await validateBody(request, BrandAllowlistRemoveSchema)
+  if (!validation.success) return validation.response
+
+  const { error } = await access.supabase
+    .from('brand_signup_allowlist')
+    .delete()
+    .eq('id', validation.data.id)
+    .eq('brand_id', access.brand.id)
+
+  if (error) {
+    return NextResponse.json(
+      { error: { code: 'INTERNAL', message: 'Kunde inte ta bort.', message_en: 'Could not remove the email.' } },
+      { status: 500 },
+    )
+  }
+
+  return NextResponse.json({ data: { removed: validation.data.id } })
+}
@@ -57,6 +57,7 @@ const SIFFRA_BRAND = {
  senderDomain: 'post.siffra.se',
  senderDomainStatus: 'verified',
  resendDomainId: 'rd-1',
+  signupMode: 'open',
 }

 const mockUser = { id: 'user-1', email: 'admin@byra.se' }