feat: Disable challengeless registration without signing a waiver

src/api/client/account/register.rs

@@ -255,10 +255,7 @@ async fn create_registration_uiaa_session(
 		if flows.is_empty() {
 			// No flows are configured. Bail out by default
 			// unless open registration was explicitly enabled.
-			if !services
-				.config
-				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-			{
+			if !services.config.enable_challengeless_registration() {
 				return Err!(Request(Forbidden(
 					"This server is not accepting registrations at this time."
 				)));

src/core/config/check.rs

@@ -180,7 +180,7 @@ pub fn check(config: &Config) -> Result {
 	}
 
 	if config.allow_registration
-		&& config.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+		&& config.enable_challengeless_registration()
 		&& config.registration_token.is_none()
 		&& config.registration_token_file.is_none()
 	{

src/core/config/mod.rs

@@ -806,6 +806,9 @@ pub struct Config {
 
 	/// Enabling this setting opens registration to anyone without restrictions.
 	/// This makes your server vulnerable to abuse
+	///
+	/// Only works if continuwuity was compiled from source with the
+	/// "openreg" compile-time feature.
 	#[serde(default)]
 	pub yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: bool,
 
@@ -2896,6 +2899,19 @@ impl Config {
 	}
 
 	pub fn check(&self) -> Result<(), Error> { check(self) }
+
+	#[cfg(debug_assertions)]
+	#[inline]
+	#[must_use]
+	pub fn enable_challengeless_registration(&self) -> bool {
+		cfg!(feature = "openreg")
+			&& self.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+	}
+
+	#[cfg(not(debug_assertions))]
+	#[inline(always)]
+	#[must_use]
+	pub fn enable_challengeless_registration(&self) -> bool { false }
 }
 
 fn true_fn() -> bool { true }

src/service/firstrun/mod.rs

@@ -261,11 +261,7 @@ impl Service {
 			"Find a list of Matrix clients here:".bold()
 		);
 
-		if self
-			.services
-			.config
-			.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-		{
+		if self.services.config.enable_challengeless_registration() {
 			eprintln!();
 			eprintln!(
 				"{}",

src/service/uiaa/mod.rs

@@ -664,11 +664,7 @@ impl Service {
 				UntrustedFlowStatus::Unavailable
 			} else if self.services.config.recaptcha_private_site_key.is_some() || require_email {
 				UntrustedFlowStatus::Available { require_email }
-			} else if self
-				.services
-				.config
-				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-			{
+			} else if self.services.config.enable_challengeless_registration() {
 				UntrustedFlowStatus::Available { require_email: false }
 			} else {
 				UntrustedFlowStatus::Unavailable

src/web/pages/account/register.rs

@@ -326,9 +326,7 @@ async fn begin_registration(
 	next: Option<LoginTarget>,
 	client: &IpAddr,
 ) -> Result<Result<Response, ValidationErrors>> {
-	let open_registration = services
-		.config
-		.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse;
+	let open_registration = services.config.enable_challengeless_registration();
 	let mut errors = ValidationErrors::new();
 
 	let user_id = match services