fix: fail closed on production signup

Production configuration accepted publicSignupEnabled: true and started a
working Identity/API runtime, even though Ekklesia has no verified email,
invitation requirement, CAPTCHA, or durable shared/edge limiter — Doctor
merely reported "Public signup is explicitly ENABLED" as a pass.

validatePublicSignupEnabled now takes the same IdentityEnvironment the rest
of this config validates against and throws the stable
PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION whenever the parsed value is true in
production. Parsing stays separate from the policy, so a malformed value
still reports PUBLIC_SIGNUP_ENABLED_INVALID everywhere. Because the
executable entry point validates configuration before startApi, such a
deployment fails before any pool, Better Auth instance, module runtime, or
listener exists, and Doctor reports NOT READY via its existing
IdentityConfigError path. Development and test composition still enable it
explicitly through the identical typed path.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor.test.ts

@@ -635,7 +635,27 @@ describe("Ekklesia Doctor diagnostics", () => {
     );
   });
 
-  it("reports public signup as explicitly enabled when configured", async () => {
+  it("reports public signup as explicitly enabled when configured in development", async () => {
+    const report = await diagnoseEkklesia(
+      {
+        ...options(),
+        identityConfiguration: {
+          baseUrl: "http://localhost:3000",
+          environment: "development",
+          publicSignupEnabled: "true",
+          secret: "correct-horse-battery-staple-0123456789",
+          trustedOrigins: ["http://localhost:3000"],
+        },
+      },
+      dependencies(),
+    );
+
+    const identity = check(report, "identity.configuration");
+    expect(identity.status).toBe("pass");
+    expect(identity.details.some((detail) => detail.includes("explicitly ENABLED"))).toBe(true);
+  });
+
+  it("blocks readiness — not merely warns — when production configuration enables public signup", async () => {
     const report = await diagnoseEkklesia(
       {
         ...options(),
@@ -651,8 +671,12 @@ describe("Ekklesia Doctor diagnostics", () => {
     );
 
     const identity = check(report, "identity.configuration");
-    expect(identity.status).toBe("pass");
-    expect(identity.details.some((detail) => detail.includes("explicitly ENABLED"))).toBe(true);
+    expect(identity.status).toBe("failure");
+    expect(
+      identity.details.some((detail) => detail.includes("PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION")),
+    ).toBe(true);
+    expect(report.result).toBe("not-ready");
+    expect(doctorExitCode(report)).toBe(1);
   });
 
   it("fails identity configuration for a misspelled public-signup value, never silently disabling or enabling it", async () => {

core/tests/identity-config.test.ts

@@ -9,6 +9,17 @@ function validInput() {
   return { baseUrl: validBaseUrl, secret: validSecret, trustedOrigins: validTrustedOrigins };
 }
 
+/** The loopback/`http` shape only `{ environment: "development" }` accepts — used by the tests that
+ * exercise development-only behavior (such as explicitly enabling public signup) so they never
+ * accidentally pass through production validation. */
+function developmentInput() {
+  return {
+    baseUrl: "http://localhost:3000",
+    secret: validSecret,
+    trustedOrigins: ["http://localhost:3000"],
+  };
+}
+
 describe("Core identity configuration", () => {
   it("accepts a valid secret, base URL, and trusted origins", () => {
     const config = createIdentityConfig(validInput(), { environment: "production" });
@@ -173,24 +184,89 @@ describe("Core identity configuration", () => {
     expect(config.publicSignupEnabled).toBe(false);
   });
 
-  it("accepts an explicit boolean publicSignupEnabled", () => {
+  it("accepts an explicit boolean publicSignupEnabled in development", () => {
     expect(
-      createIdentityConfig({ ...validInput(), publicSignupEnabled: true }).publicSignupEnabled,
+      createIdentityConfig(
+        { ...developmentInput(), publicSignupEnabled: true },
+        { environment: "development" },
+      ).publicSignupEnabled,
     ).toBe(true);
     expect(
-      createIdentityConfig({ ...validInput(), publicSignupEnabled: false }).publicSignupEnabled,
+      createIdentityConfig(
+        { ...developmentInput(), publicSignupEnabled: false },
+        { environment: "development" },
+      ).publicSignupEnabled,
     ).toBe(false);
   });
 
-  it('accepts the exact strings "true"/"false" (environment variables are always strings)', () => {
+  it('accepts the exact strings "true"/"false" in development (environment variables are always strings)', () => {
     expect(
-      createIdentityConfig({ ...validInput(), publicSignupEnabled: "true" }).publicSignupEnabled,
+      createIdentityConfig(
+        { ...developmentInput(), publicSignupEnabled: "true" },
+        { environment: "development" },
+      ).publicSignupEnabled,
     ).toBe(true);
     expect(
-      createIdentityConfig({ ...validInput(), publicSignupEnabled: "false" }).publicSignupEnabled,
+      createIdentityConfig(
+        { ...developmentInput(), publicSignupEnabled: "false" },
+        { environment: "development" },
+      ).publicSignupEnabled,
     ).toBe(false);
   });
 
+  it("accepts an explicitly disabled publicSignupEnabled in production", () => {
+    for (const publicSignupEnabled of [false, "false"]) {
+      expect(
+        createIdentityConfig(
+          { ...validInput(), publicSignupEnabled },
+          { environment: "production" },
+        ).publicSignupEnabled,
+      ).toBe(false);
+    }
+  });
+
+  it("refuses to enable public signup in production until durable abuse controls exist", () => {
+    // Ekklesia has no verified email, invitation requirement, CAPTCHA, or durable shared/edge
+    // limiter yet, so a production deployment must not be able to open public registration at all
+    // — not even deliberately. This is a fail-closed configuration error, never a warning.
+    for (const publicSignupEnabled of [true, "true"]) {
+      let captured: unknown;
+      try {
+        createIdentityConfig(
+          { ...validInput(), publicSignupEnabled },
+          { environment: "production" },
+        );
+      } catch (error) {
+        captured = error;
+      }
+      expect(captured).toBeInstanceOf(IdentityConfigError);
+      expect(captured).toMatchObject({ code: "PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION" });
+    }
+  });
+
+  it("defaults to production validation for public signup when environment is not specified", () => {
+    let captured: unknown;
+    try {
+      createIdentityConfig({ ...validInput(), publicSignupEnabled: "true" });
+    } catch (error) {
+      captured = error;
+    }
+    expect(captured).toMatchObject({ code: "PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION" });
+  });
+
+  it("reports a malformed public-signup value as malformed even in production, never as unsupported", () => {
+    let captured: unknown;
+    try {
+      createIdentityConfig(
+        { ...validInput(), publicSignupEnabled: "TRUE" },
+        { environment: "production" },
+      );
+    } catch (error) {
+      captured = error;
+    }
+    expect(captured).toMatchObject({ code: "PUBLIC_SIGNUP_ENABLED_INVALID" });
+  });
+
   it("rejects a misspelled, loosely-truthy, or malformed publicSignupEnabled rather than silently defaulting", () => {
     for (const publicSignupEnabled of ["1", "0", "yes", "no", "TRUE", "True", " true", "", 1, 0]) {
       let captured: unknown;