Add invite-only registration mode

Support configurable on, invite-only, and off registration modes, including case-insensitive invitation checks and test coverage.

.env.example

@@ -5,7 +5,8 @@ APP_KEY=base64:UNQNf1SXeASNkWux01Rj8EnHYx8FO0kAxWNDwktclkk=
 APP_DEBUG=true
 APP_URL=https://solidtime.test
 APP_FORCE_HTTPS=false
-APP_ENABLE_REGISTRATION=true
+# Supported values: on, off, invite-only (true/false are supported for backwards compatibility)
+APP_ENABLE_REGISTRATION=on
 SUPER_ADMINS=admin@example.com
 PAGINATION_PER_PAGE_DEFAULT=500
 

.github/VOUCHED.td

@@ -18,6 +18,7 @@ bufferhead-code
 candideu
 kasparrosin
 korridor
+nikbucher tasks table sorting
 onatcer
 shrootbuck
 smilebeda

app/Actions/Fortify/CreateNewUser.php

@@ -4,9 +4,11 @@ declare(strict_types=1);
 
 namespace App\Actions\Fortify;
 
+use App\Enums\RegistrationMode;
 use App\Enums\Weekday;
 use App\Events\NewsletterRegistered;
 use App\Models\User;
+use App\Service\InvitationService;
 use App\Service\IpLookup\IpLookupServiceContract;
 use App\Service\TimezoneService;
 use App\Service\UserService;
@@ -31,13 +33,14 @@ class CreateNewUser implements CreatesNewUsers
      */
     public function create(array $input): User
     {
-        if (! config('app.enable_registration')) {
+        $registrationMode = RegistrationMode::fromConfig(config('app.enable_registration'));
+        if ($registrationMode === RegistrationMode::Off) {
             throw ValidationException::withMessages([
                 'email' => [__('Registration is disabled.')],
             ]);
         }
 
-        Validator::make($input, [
+        $validated = Validator::make($input, [
             'name' => [
                 'required',
                 'string',
@@ -60,6 +63,20 @@ class CreateNewUser implements CreatesNewUsers
             ],
         ])->validate();
 
+        if ($registrationMode === RegistrationMode::InviteOnly) {
+            $invitationService = app(InvitationService::class);
+            $email = (string) $validated['email'];
+            if (! $invitationService->hasAcceptedInvitationForEmail($email)) {
+                $message = $invitationService->hasPendingInvitationForEmail($email)
+                    ? __('Please accept the organization invitation sent to your email address before registering.')
+                    : __('Registration is only available to invited users.');
+
+                throw ValidationException::withMessages([
+                    'email' => [$message],
+                ]);
+            }
+        }
+
         $timezone = null;
         if (array_key_exists('timezone', $input) && is_string($input['timezone'])) {
             if (app(TimezoneService::class)->isValid($input['timezone'])) {

app/Enums/RegistrationMode.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+enum RegistrationMode: string
+{
+    case On = 'on';
+    case InviteOnly = 'invite-only';
+    case Off = 'off';
+
+    public static function fromConfig(mixed $value): self
+    {
+        if ($value === true) {
+            return self::On;
+        }
+
+        if ($value === false || $value === null) {
+            return self::Off;
+        }
+
+        return match (strtolower(trim((string) $value))) {
+            '1', 'on', 'true' => self::On,
+            'invite-only' => self::InviteOnly,
+            default => self::Off,
+        };
+    }
+}

app/Http/Controllers/Web/OrganizationInvitationController.php

@@ -36,6 +36,7 @@ class OrganizationInvitationController extends Controller
             }
 
             return redirect(route('register'))
+                ->with('registration_email', $email)
                 ->with('bannerText', __('Please create an account to finish joining the :organization organization.', [
                     'organization' => $organization->name,
                 ]))

app/Providers/FortifyServiceProvider.php

@@ -45,6 +45,7 @@ class FortifyServiceProvider extends ServiceProvider
 
         Fortify::registerView(function () {
             return Inertia::render('Auth/Register', [
+                'email' => session('registration_email', ''),
                 'terms_url' => config('auth.terms_url'),
                 'privacy_policy_url' => config('auth.privacy_policy_url'),
                 'newsletter_consent' => config('auth.newsletter_consent'),

app/Providers/RouteServiceProvider.php

@@ -33,8 +33,8 @@ class RouteServiceProvider extends ServiceProvider
             }
 
             return $request->user()
-                ? Limit::perMinute(200)->by($request->user()->id)
-                : Limit::perMinute(60)->by($request->ip());
+                ? Limit::perMinute(config('app.api_rate_limit_authenticated_per_minute'))->by($request->user()->id)
+                : Limit::perMinute(config('app.api_rate_limit_guest_per_minute'))->by($request->ip());
         });
 
         $this->routes(function (): void {

app/Service/InvitationService.php

@@ -18,6 +18,22 @@ use Illuminate\Support\Facades\Mail;
 
 class InvitationService
 {
+    public function hasAcceptedInvitationForEmail(string $email): bool
+    {
+        return OrganizationInvitation::query()
+            ->whereRaw('lower(email) = ?', [strtolower($email)])
+            ->whereNotNull('accepted_at')
+            ->exists();
+    }
+
+    public function hasPendingInvitationForEmail(string $email): bool
+    {
+        return OrganizationInvitation::query()
+            ->whereRaw('lower(email) = ?', [strtolower($email)])
+            ->whereNull('accepted_at')
+            ->exists();
+    }
+
     /**
      * @throws UserIsAlreadyMemberOfOrganizationApiException|InvitationForTheEmailAlreadyExistsApiException
      */

config/app.php

@@ -100,7 +100,7 @@ return [
 
     'force_https' => (bool) env('APP_FORCE_HTTPS', false),
 
-    'enable_registration' => (bool) env('APP_ENABLE_REGISTRATION', false),
+    'enable_registration' => env('APP_ENABLE_REGISTRATION', 'off'),
 
     'local_email_verification' => (bool) env('APP_LOCAL_EMAIL_VERIFICATION', false),
 
@@ -158,6 +158,21 @@ return [
 
     'pagination_per_page_default' => (int) env('PAGINATION_PER_PAGE_DEFAULT', 15),
 
+    /*
+    |--------------------------------------------------------------------------
+    | API Rate Limiting
+    |--------------------------------------------------------------------------
+    |
+    | The number of API requests allowed per minute, counted per user for
+    | authenticated requests and per IP address for guest requests. These
+    | limits are only enforced when the application runs in production.
+    |
+    */
+
+    'api_rate_limit_authenticated_per_minute' => (int) (env('API_RATE_LIMIT_AUTH_PER_MINUTE') ?: 200),
+
+    'api_rate_limit_guest_per_minute' => (int) (env('API_RATE_LIMIT_GUEST_PER_MINUTE') ?: 60),
+
     /*
     |--------------------------------------------------------------------------
     | Encryption Key

database/migrations/2026_08_24_000001_add_application_query_indexes.php

@@ -0,0 +1,230 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+use function Laravel\Prompts\info as consoleInfo;
+
+return new class extends Migration
+{
+    /**
+     * PostgreSQL cannot build or drop an index concurrently inside a transaction.
+     * Keeping this migration non-transactional prevents long write locks in production.
+     *
+     * @var bool
+     */
+    public $withinTransaction = false;
+
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        // Tenant-scoped client pagination ordered by newest first; also covers the organization FK.
+        $this->runIndexOperation('create', 'clients_organization_created_id_index', 'CREATE INDEX CONCURRENTLY clients_organization_created_id_index ON clients (organization_id, created_at DESC, id)');
+
+        // Tenant-scoped project pagination ordered by newest first; also covers the organization FK.
+        $this->runIndexOperation('create', 'projects_organization_created_id_index', 'CREATE INDEX CONCURRENTLY projects_organization_created_id_index ON projects (organization_id, created_at DESC, id)');
+        // Speeds client relationship loads and the FK check when a client is deleted or its ID changes.
+        $this->runIndexOperation('create', 'projects_client_id_index', 'CREATE INDEX CONCURRENTLY projects_client_id_index ON projects (client_id)');
+
+        // Tenant-scoped task pagination ordered by newest first; also covers the organization FK.
+        $this->runIndexOperation('create', 'tasks_organization_created_id_index', 'CREATE INDEX CONCURRENTLY tasks_organization_created_id_index ON tasks (organization_id, created_at DESC, id)');
+        // Speeds project task lists and the FK check when a project is deleted or its ID changes.
+        $this->runIndexOperation('create', 'tasks_project_id_index', 'CREATE INDEX CONCURRENTLY tasks_project_id_index ON tasks (project_id)');
+
+        // Tenant-scoped tag pagination ordered by newest first; also covers the organization FK.
+        $this->runIndexOperation('create', 'tags_organization_created_id_index', 'CREATE INDEX CONCURRENTLY tags_organization_created_id_index ON tags (organization_id, created_at DESC, id)');
+
+        // Tenant-scoped report pagination ordered by newest first; also covers the organization FK.
+        $this->runIndexOperation('create', 'reports_organization_created_id_index', 'CREATE INDEX CONCURRENTLY reports_organization_created_id_index ON reports (organization_id, created_at DESC, id)');
+
+        // Tenant-scoped member pagination; the existing (organization_id, user_id) unique index remains for membership lookup.
+        $this->runIndexOperation('create', 'members_organization_created_id_index', 'CREATE INDEX CONCURRENTLY members_organization_created_id_index ON members (organization_id, created_at DESC, id)');
+        // Supports reverse user-to-membership lookups and the FK check when a user is deleted or its ID changes.
+        $this->runIndexOperation('create', 'members_user_id_index', 'CREATE INDEX CONCURRENTLY members_user_id_index ON members (user_id)');
+
+        // The existing (project_id, user_id) unique index covers project_id, but member_id and legacy user_id need reverse indexes.
+        $this->runIndexOperation('create', 'project_members_member_id_index', 'CREATE INDEX CONCURRENTLY project_members_member_id_index ON project_members (member_id)');
+        $this->runIndexOperation('create', 'project_members_user_id_index', 'CREATE INDEX CONCURRENTLY project_members_user_id_index ON project_members (user_id)');
+
+        // Supports organization deletion/current-team cleanup and the FK check on users.current_team_id.
+        $this->runIndexOperation('create', 'users_current_team_id_index', 'CREATE INDEX CONCURRENTLY users_current_team_id_index ON users (current_team_id)');
+
+        // Filament loads the newest audits first; this avoids scanning and sorting the large append-only audit table.
+        $this->runIndexOperation('create', 'audits_created_at_index', 'CREATE INDEX CONCURRENTLY audits_created_at_index ON audits (created_at DESC)');
+
+        // Main tenant time-entry range/pagination path, including its start DESC, id ordering; also covers the organization FK.
+        $this->runIndexOperation('create', 'time_entries_organization_start_id_index', 'CREATE INDEX CONCURRENTLY time_entries_organization_start_id_index ON time_entries (organization_id, start DESC, id)');
+        // Filament lists time entries globally by creation time, so the tenant-prefixed index cannot provide this ordering.
+        $this->runIndexOperation('create', 'time_entries_created_at_index', 'CREATE INDEX CONCURRENTLY time_entries_created_at_index ON time_entries (created_at DESC)');
+        // Dashboard history is consistently filtered by user and organization, then bounded by start; user first also covers its FK.
+        $this->runIndexOperation('create', 'time_entries_user_organization_start_index', 'CREATE INDEX CONCURRENTLY time_entries_user_organization_start_index ON time_entries (user_id, organization_id, start)');
+        // Member timelines, overlap checks, and billable-rate updates start with member_id; also covers its FK.
+        $this->runIndexOperation('create', 'time_entries_member_start_index', 'CREATE INDEX CONCURRENTLY time_entries_member_start_index ON time_entries (member_id, start)');
+        // These relationship/filter indexes also prevent full scans for FK checks when parent rows change or are deleted.
+        $this->runIndexOperation('create', 'time_entries_project_id_index', 'CREATE INDEX CONCURRENTLY time_entries_project_id_index ON time_entries (project_id)');
+        $this->runIndexOperation('create', 'time_entries_task_id_index', 'CREATE INDEX CONCURRENTLY time_entries_task_id_index ON time_entries (task_id)');
+        $this->runIndexOperation('create', 'time_entries_client_id_index', 'CREATE INDEX CONCURRENTLY time_entries_client_id_index ON time_entries (client_id)');
+        // Active-timer checks touch only open entries, so a partial index stays small while serving the hot member_id lookup.
+        $this->runIndexOperation('create', 'time_entries_active_member_index', 'CREATE INDEX CONCURRENTLY time_entries_active_member_index ON time_entries (member_id) WHERE "end" IS NULL');
+        // whereJsonContains(tags, tag_id) compiles to JSONB containment, which is supported by a GIN index.
+        $this->runIndexOperation('create', 'time_entries_tags_gin_index', 'CREATE INDEX CONCURRENTLY time_entries_tags_gin_index ON time_entries USING GIN (tags)');
+
+        // Passport already indexes user_id; these indexes cover the other FK used during OAuth client deletion/update.
+        $this->runIndexOperation('create', 'oauth_access_tokens_client_id_index', 'CREATE INDEX CONCURRENTLY oauth_access_tokens_client_id_index ON oauth_access_tokens (client_id)');
+        $this->runIndexOperation('create', 'oauth_auth_codes_client_id_index', 'CREATE INDEX CONCURRENTLY oauth_auth_codes_client_id_index ON oauth_auth_codes (client_id)');
+
+        // owner_id is already the leading column of oauth_clients_owner_id_owner_type_index.
+        $this->runIndexOperation('drop', 'oauth_clients_user_id_index', 'DROP INDEX CONCURRENTLY oauth_clients_user_id_index');
+        // Public report lookup starts with the unique share_secret index; no query filters only by this boolean.
+        $this->runIndexOperation('drop', 'reports_is_public_index', 'DROP INDEX CONCURRENTLY reports_is_public_index');
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        $indexes = [
+            'clients_organization_created_id_index',
+            'projects_organization_created_id_index',
+            'projects_client_id_index',
+            'tasks_organization_created_id_index',
+            'tasks_project_id_index',
+            'tags_organization_created_id_index',
+            'reports_organization_created_id_index',
+            'members_organization_created_id_index',
+            'members_user_id_index',
+            'project_members_member_id_index',
+            'project_members_user_id_index',
+            'users_current_team_id_index',
+            'audits_created_at_index',
+            'time_entries_organization_start_id_index',
+            'time_entries_created_at_index',
+            'time_entries_user_organization_start_index',
+            'time_entries_member_start_index',
+            'time_entries_project_id_index',
+            'time_entries_task_id_index',
+            'time_entries_client_id_index',
+            'time_entries_active_member_index',
+            'time_entries_tags_gin_index',
+            'oauth_access_tokens_client_id_index',
+            'oauth_auth_codes_client_id_index',
+        ];
+
+        $concurrently = DB::transactionLevel() === 0 ? ' CONCURRENTLY' : '';
+        foreach ($indexes as $index) {
+            $this->runIndexOperation('drop', $index, 'DROP INDEX'.$concurrently.' IF EXISTS '.$index);
+        }
+
+        $this->runIndexOperation('create', 'oauth_clients_user_id_index', 'CREATE INDEX'.$concurrently.' oauth_clients_user_id_index ON oauth_clients (owner_id)');
+        $this->runIndexOperation('create', 'reports_is_public_index', 'CREATE INDEX'.$concurrently.' reports_is_public_index ON reports (is_public)');
+    }
+
+    private function runIndexOperation(string $operation, string $index, string $statement): void
+    {
+        $indexState = $this->indexState($index);
+
+        if ($operation === 'create' && $indexState === ['valid' => true, 'ready' => true]) {
+            $this->writeProgress(sprintf('Skipping index [%s] because it already exists and is valid', $index));
+
+            return;
+        }
+
+        if ($operation === 'drop' && $indexState === null) {
+            $this->writeProgress(sprintf('Skipping index [%s] because it does not exist', $index));
+
+            return;
+        }
+
+        if ($operation === 'create' && $indexState !== null) {
+            $this->writeProgress(sprintf(
+                'Index [%s] exists but is incomplete (valid=%s, ready=%s); dropping it before rebuilding',
+                $index,
+                $indexState['valid'] ? 'true' : 'false',
+                $indexState['ready'] ? 'true' : 'false',
+            ));
+            $this->executeIndexStatement(
+                'drop incomplete',
+                $index,
+                (DB::transactionLevel() === 0 ? 'DROP INDEX CONCURRENTLY ' : 'DROP INDEX ').$this->quoteIdentifier($index),
+            );
+        }
+
+        $this->executeIndexStatement($operation, $index, $statement);
+    }
+
+    private function executeIndexStatement(string $operation, string $index, string $statement): void
+    {
+        $startedAt = microtime(true);
+        $this->writeProgress(sprintf('Starting to %s index [%s]', $operation, $index));
+
+        try {
+            DB::statement($statement);
+        } catch (Throwable $exception) {
+            $this->writeProgress(sprintf(
+                'Failed to %s index [%s] after %.2f seconds: %s',
+                $operation,
+                $index,
+                microtime(true) - $startedAt,
+                $exception->getMessage(),
+            ));
+
+            throw $exception;
+        }
+
+        $this->writeProgress(sprintf(
+            'Finished %s index [%s] in %.2f seconds',
+            $operation === 'create' ? 'creating' : 'dropping',
+            $index,
+            microtime(true) - $startedAt,
+        ));
+    }
+
+    /**
+     * @return array{valid: bool, ready: bool}|null
+     */
+    private function indexState(string $index): ?array
+    {
+        $state = DB::selectOne(
+            <<<'SQL'
+                SELECT pg_index.indisvalid::int AS valid, pg_index.indisready::int AS ready
+                FROM pg_index
+                JOIN pg_class ON pg_class.oid = pg_index.indexrelid
+                JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace
+                WHERE pg_namespace.nspname = current_schema()
+                  AND pg_class.relname = ?
+                SQL,
+            [$index],
+        );
+
+        if ($state === null) {
+            return null;
+        }
+
+        return [
+            'valid' => (bool) $state->valid,
+            'ready' => (bool) $state->ready,
+        ];
+    }
+
+    private function quoteIdentifier(string $identifier): string
+    {
+        return DB::connection()->getQueryGrammar()->wrap($identifier);
+    }
+
+    private function writeProgress(string $message): void
+    {
+        if (app()->runningUnitTests()) {
+            return;
+        }
+
+        $message = sprintf('[%s] %s', date(DATE_ATOM), $message);
+        Log::info($message);
+        consoleInfo($message);
+    }
+};

e2e/invitation-registration-prefill.spec.ts

@@ -0,0 +1,32 @@
+import { expect, test } from '../playwright/fixtures';
+import { PLAYWRIGHT_BASE_URL } from '../playwright/config';
+import { getInvitationAcceptUrl } from './utils/mailpit';
+
+test('prefills the registration email after accepting an invitation', async ({ page, browser }) => {
+    const memberId = `${Date.now()}-${Math.floor(Math.random() * 100000)}`;
+    const memberEmail = `prefill-${memberId}@invitation.test`;
+
+    await page.goto(PLAYWRIGHT_BASE_URL + '/members');
+    await page.getByRole('button', { name: 'Invite Member' }).click();
+    await page.getByPlaceholder('Member Email').fill(memberEmail);
+    await page.getByRole('button', { name: 'Employee' }).click();
+    await Promise.all([
+        page.waitForResponse(
+            (response) =>
+                response.url().includes('/invitations') &&
+                response.request().method() === 'POST' &&
+                response.status() === 204
+        ),
+        page.getByRole('button', { name: 'Invite Member', exact: true }).click(),
+    ]);
+
+    const inviteeContext = await browser.newContext();
+    const inviteePage = await inviteeContext.newPage();
+    const acceptUrl = await getInvitationAcceptUrl(inviteePage.request, memberEmail);
+    await inviteePage.goto(acceptUrl);
+    await inviteePage.waitForURL(/\/register$/);
+
+    await expect(inviteePage.getByLabel('Email')).toHaveValue(memberEmail);
+
+    await inviteeContext.close();
+});

extensions/manifest.json

@@ -1,11 +1,11 @@
 {
     "Billing": {
         "repository": "solidtime-io/extension-billing",
-        "ref": "v0.0.3"
+        "ref": "v0.0.5"
     },
     "Services": {
         "repository": "solidtime-io/extension-services",
-        "ref": "v0.0.1"
+        "ref": "v0.0.2"
     },
     "Invoicing": {
         "repository": "solidtime-io/extension-invoicing",

resources/js/Pages/Auth/Register.vue

@@ -8,9 +8,13 @@ import { Field, FieldLabel, FieldError } from '@/packages/ui/src/field';
 import PrimaryButton from '@/packages/ui/src/Buttons/PrimaryButton.vue';
 import TextInput from '@/packages/ui/src/Input/TextInput.vue';
 
+const props = defineProps<{
+    email: string;
+}>();
+
 const form = useForm({
     name: '',
-    email: '',
+    email: props.email,
     password: '',
     password_confirmation: '',
     terms: false,

resources/js/Pages/Teams/Partials/ImportData.vue

@@ -198,7 +198,7 @@ const showResultModal = ref(false);
                                 for="file-upload"
                                 class="relative cursor-pointer rounded-md font-semibold text-text-primary focus-within:outline-none focus-within:ring-2 focus-within:ring-indigo-600 focus-within:ring-offset-2 focus-within:ring-offset-gray-900 hover:text-indigo-500">
                                 <span v-if="files">{{ filenames }}</span>
-                                <span v-else>Upload a Toggl/Clockify Export</span>
+                                <span v-else>Upload the Export file</span>
                                 <input
                                     id="file-upload"
                                     ref="importFile"

resources/js/packages/ui/src/dialog/DialogContent.vue

@@ -25,25 +25,21 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
 <template>
     <DialogPortal>
         <DialogOverlay
-            class="fixed inset-0 z-50 backdrop-blur-sm data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0">
+            class="fixed top-0 left-0 z-50 w-screen h-screen [height:100dvh] backdrop-blur-sm data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0">
             <div class="absolute inset-0 bg-default-background opacity-30" />
+            <div
+                class="absolute inset-0 overflow-y-auto overscroll-contain flex items-start justify-center px-2">
+                <DialogContent
+                    v-bind="forwarded"
+                    :class="
+                        cn(
+                            'my-3 md:my-14 xl:my-24 bg-default-background grid w-full max-w-lg border border-border-tertiary shadow-lg duration-200 rounded-lg outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
+                            props.class
+                        )
+                    ">
+                    <slot />
+                </DialogContent>
+            </div>
         </DialogOverlay>
-        <div
-            :class="
-                cn(
-                    'fixed top-0 left-0 z-50 pointer-events-none w-screen h-screen flex items-start px-2 pt-3 md:pt-14 xl:pt-24 justify-center overflow-auto'
-                )
-            ">
-            <DialogContent
-                v-bind="forwarded"
-                :class="
-                    cn(
-                        'pointer-events-auto bg-default-background grid w-full max-w-lg border border-border-tertiary shadow-lg duration-200 rounded-lg outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
-                        props.class
-                    )
-                ">
-                <slot />
-            </DialogContent>
-        </div>
     </DialogPortal>
 </template>

tests/Feature/RegistrationTest.php

@@ -22,6 +22,13 @@ use TiMacDonald\Log\LogEntry;
 
 class RegistrationTest extends TestCaseWithDatabase
 {
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Config::set('app.enable_registration', 'on');
+    }
+
     public function test_registration_screen_can_be_rendered(): void
     {
         if (! Features::enabled(Features::registration())) {
@@ -89,6 +96,77 @@ class RegistrationTest extends TestCaseWithDatabase
         Event::assertNotDispatched(NewsletterRegistered::class);
     }
 
+    public function test_user_registration_fails_without_an_invitation_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertInvalid([
+            'email' => 'Registration is only available to invited users.',
+        ]);
+        $this->assertFalse(User::query()->where('email', 'test@example.com')->exists());
+    }
+
+    public function test_invited_user_can_register_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+        $user = $this->createUserWithPermission();
+        OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->role(Role::Employee)
+            ->accepted()
+            ->create([
+                'email' => 'Invited.User@example.com',
+            ]);
+
+        $response = $this->post('/register', [
+            'name' => 'Invited User',
+            'email' => 'invited.user@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertValid();
+        $this->assertAuthenticated();
+        $response->assertRedirect(RouteServiceProvider::HOME);
+        $newUser = User::query()->where('email', 'invited.user@example.com')->firstOrFail();
+        $this->assertSame($user->organization->getKey(), $newUser->organizations()->firstOrFail()->getKey());
+    }
+
+    public function test_user_must_accept_pending_invitation_before_registration_if_registration_is_invite_only(): void
+    {
+        Config::set('app.enable_registration', 'invite-only');
+        $user = $this->createUserWithPermission();
+        OrganizationInvitation::factory()
+            ->forOrganization($user->organization)
+            ->role(Role::Employee)
+            ->create([
+                'email' => 'test@example.com',
+            ]);
+
+        $response = $this->post('/register', [
+            'name' => 'Test User',
+            'email' => 'test@example.com',
+            'password' => 'password',
+            'password_confirmation' => 'password',
+            'terms' => true,
+        ]);
+
+        $response->assertInvalid([
+            'email' => 'Please accept the organization invitation sent to your email address before registering.',
+        ]);
+        $this->assertGuest();
+        $this->assertFalse(User::query()->where('email', 'test@example.com')->exists());
+    }
+
     public function test_new_user_can_not_register_with_likely_invalid_domain(): void
     {
         // Act

tests/Unit/Endpoint/Web/OrganizationInvitationEndpointTest.php

@@ -38,6 +38,7 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $response->assertRedirect(route('register'));
         $response->assertSessionHas('bannerText', 'Please create an account to finish joining the '.$user->organization->name.' organization.');
         $response->assertSessionHas('bannerStyle', 'info');
+        $response->assertSessionHas('registration_email', strtolower($invitation->email));
         $invitation->refresh();
         $this->assertNotNull($invitation->accepted_at);
     }
@@ -64,6 +65,7 @@ class OrganizationInvitationEndpointTest extends EndpointTestAbstract
         $response->assertRedirect(route('register'));
         $response->assertSessionHas('bannerText', 'Please create an account to finish joining the '.$user->organization->name.' organization.');
         $response->assertSessionHas('bannerStyle', 'info');
+        $response->assertSessionHas('registration_email', strtolower($invitation->email));
         $invitation->refresh();
         $this->assertNotNull($invitation->accepted_at);
     }

tests/Unit/Enums/RegistrationModeTest.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit\Enums;
+
+use App\Enums\RegistrationMode;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+#[CoversClass(RegistrationMode::class)]
+class RegistrationModeTest extends TestCase
+{
+    /**
+     * @return array<string, array{mixed, RegistrationMode}>
+     */
+    public static function configValueProvider(): array
+    {
+        return [
+            'boolean true' => [true, RegistrationMode::On],
+            'on' => ['on', RegistrationMode::On],
+            'true' => ['true', RegistrationMode::On],
+            'invite-only' => ['invite-only', RegistrationMode::InviteOnly],
+            'boolean false' => [false, RegistrationMode::Off],
+            'off' => ['off', RegistrationMode::Off],
+            'false' => ['false', RegistrationMode::Off],
+            'unsupported invite alias' => ['invite', RegistrationMode::Off],
+            'unknown' => ['unknown', RegistrationMode::Off],
+        ];
+    }
+
+    #[DataProvider('configValueProvider')]
+    public function test_registration_mode_is_created_from_config_value(mixed $value, RegistrationMode $expected): void
+    {
+        $this->assertSame($expected, RegistrationMode::fromConfig($value));
+    }
+}