feat(registraton): add anti enumeration (cannot know if an account already exists)

Important: anti-enumeration is active only if SMTP is defined, welcome email can be used otherwise it is a classic registration with ok or conflic if account alrady exists
2026-06-02 22:50:13 +02:00
parent 46f5379def
commit 00af0e8a89
4 changed files with 248 additions and 73 deletions
@@ -22,6 +22,7 @@ RUST_LOG="warn,audit=info"
 # grow up limits for tests
 OXICLOUD_RATE_LIMIT_REFRESH_MAX=360
 OXICLOUD_RATE_LIMIT_LOGIN_MAX=360
+OXICLOUD_RATE_LIMIT_REGISTER_MAX=360

 # Magic-link / external-users flow (PR 9). The mock SMTP captures every
 # outbound message in-process so external_users.hurl can retrieve the