Block new user signups for service shutdown

apps/attached_mobile_host_web/src/app/mobile/login/complete/_client.tsx

@@ -318,6 +318,11 @@ function formatOAuthSignInError(err: unknown): string {
 
   const type =
     "type" in err && typeof err.type === "string" ? err.type : "unknown";
+
+  if (type === "signup_disabled") {
+    return "New signups are disabled as the service is winding down.";
+  }
+
   const detail =
     "error" in err && typeof err.error === "string" ? err.error : null;
 

apps/demo_web/src/components/widgets/account_widget/account_widget.tsx

@@ -11,7 +11,11 @@ import type { LoginMethod } from "@oko-wallet-demo-web/types/login";
 type SigningInState =
   | { status: "ready" }
   | { status: "signing-in" }
-  | { status: "failed"; error: string };
+  | {
+      status: "failed";
+      error: string;
+      errorKind: "signup_disabled" | "generic";
+    };
 
 function authTypeToLoginMethod(authType: AuthType | null): LoginMethod {
   if (!authType) {
@@ -78,7 +82,15 @@ export const AccountWidget: FC<AccountWidgetProps> = () => {
       const errorMessage =
         error instanceof Error ? error.message : "Login failed";
 
-      setSigningInState({ status: "failed", error: errorMessage });
+      const errorKind = errorMessage.includes("signup_disabled")
+        ? "signup_disabled"
+        : "generic";
+
+      setSigningInState({
+        status: "failed",
+        error: errorMessage,
+        errorKind,
+      });
     }
   }
 
@@ -107,11 +119,13 @@ export const AccountWidget: FC<AccountWidgetProps> = () => {
   }
 
   if (signingInState.status === "failed") {
+    const isSignupDisabled = signingInState.errorKind === "signup_disabled";
     return (
       <AuthProgressWidget
         method={loginMethod}
         status="failed"
-        onRetry={handleRetry}
+        errorKind={signingInState.errorKind}
+        onRetry={isSignupDisabled ? undefined : handleRetry}
       />
     );
   }

apps/demo_web/src/components/widgets/account_widget/auth_progress_widget.tsx

@@ -18,15 +18,18 @@ import type { LoginMethod } from "@oko-wallet-demo-web/types/login";
 type AuthProgressWidgetProps = {
   method: LoginMethod;
   status?: "loading" | "failed";
+  errorKind?: "signup_disabled" | "generic";
   onRetry?: () => void;
 };
 
 export const AuthProgressWidget: FC<AuthProgressWidgetProps> = ({
   method,
   status = "loading",
+  errorKind = "generic",
   onRetry,
 }) => {
   const isFailed = status === "failed";
+  const isSignupDisabled = isFailed && errorKind === "signup_disabled";
 
   return (
     <Widget>
@@ -50,7 +53,30 @@ export const AuthProgressWidget: FC<AuthProgressWidgetProps> = ({
           />
         </div>
         <Spacing height={9} />
-        {isFailed ? (
+        {isSignupDisabled ? (
+          <>
+            <Typography
+              size="md"
+              weight="medium"
+              color="primary"
+              style={{ textAlign: "center" }}
+            >
+              Signups are closed
+            </Typography>
+            <Spacing height={6} />
+            <Typography
+              size="sm"
+              weight="regular"
+              color="secondary"
+              style={{ textAlign: "center" }}
+            >
+              Oko is winding down. Existing accounts can still sign in to
+              withdraw assets,
+              <br />
+              but new signups are no longer accepted.
+            </Typography>
+          </>
+        ) : isFailed ? (
           <>
             <Typography size="md" weight="medium" color="primary">
               Login failed

apps/user_dashboard/src/components/widgets/account_widget/account_widget.tsx

@@ -17,7 +17,11 @@ import { refreshSvmEd25519Key } from "@oko-wallet-user-dashboard/utils/sdk";
 type SigningInState =
   | { status: "ready" }
   | { status: "signing-in" }
-  | { status: "failed"; error: string };
+  | {
+      status: "failed";
+      error: string;
+      errorKind: "signup_disabled" | "generic";
+    };
 
 export const AccountWidget: FC<AccountWidgetProps> = () => {
   const { wallet: okoWallet, isSignedIn } = useOko();
@@ -71,7 +75,15 @@ export const AccountWidget: FC<AccountWidgetProps> = () => {
       const errorMessage =
         error instanceof Error ? error.message : "Login failed";
 
-      setSigningInState({ status: "failed", error: errorMessage });
+      const errorKind = errorMessage.includes("signup_disabled")
+        ? "signup_disabled"
+        : "generic";
+
+      setSigningInState({
+        status: "failed",
+        error: errorMessage,
+        errorKind,
+      });
     }
   }
 
@@ -99,11 +111,13 @@ export const AccountWidget: FC<AccountWidgetProps> = () => {
   }
 
   if (signingInState.status === "failed") {
+    const isSignupDisabled = signingInState.errorKind === "signup_disabled";
     return (
       <AuthProgressWidget
         method={loginMethod}
         status="failed"
-        onRetry={handleRetry}
+        errorKind={signingInState.errorKind}
+        onRetry={isSignupDisabled ? undefined : handleRetry}
       />
     );
   }

apps/user_dashboard/src/components/widgets/account_widget/auth_progress_widget.tsx

@@ -16,15 +16,18 @@ import { Spinner } from "@oko-wallet-user-dashboard/components/spinner/spinner";
 type AuthProgressWidgetProps = {
   method: AuthType;
   status?: "loading" | "failed";
+  errorKind?: "signup_disabled" | "generic";
   onRetry?: () => void;
 };
 
 export const AuthProgressWidget: FC<AuthProgressWidgetProps> = ({
   method,
   status = "loading",
+  errorKind = "generic",
   onRetry,
 }) => {
   const isFailed = status === "failed";
+  const isSignupDisabled = isFailed && errorKind === "signup_disabled";
 
   return (
     <div className={cn(styles.signingInWrapper, { [styles.failed]: isFailed })}>
@@ -42,7 +45,30 @@ export const AuthProgressWidget: FC<AuthProgressWidgetProps> = ({
         />
       </div>
       <Spacing height={9} />
-      {isFailed ? (
+      {isSignupDisabled ? (
+        <>
+          <Typography
+            size="md"
+            weight="medium"
+            color="primary"
+            style={{ textAlign: "center" }}
+          >
+            Signups are closed
+          </Typography>
+          <Spacing height={6} />
+          <Typography
+            size="sm"
+            weight="regular"
+            color="secondary"
+            style={{ textAlign: "center" }}
+          >
+            Oko is winding down. Existing accounts can still sign in to withdraw
+            assets,
+            <br />
+            but new signups are no longer accepted.
+          </Typography>
+        </>
+      ) : isFailed ? (
         <>
           <Typography size="md" weight="medium" color="primary">
             Login failed

backend/oko_api/server/src/routes/tss_v1/keygen.ts

@@ -9,12 +9,13 @@ import {
   SignInSuccessResponseSchema,
 } from "@oko-wallet/oko-api-openapi/tss";
 import type { OkoApiResponse } from "@oko-wallet/oko-types/api_response";
-import type { AuthType } from "@oko-wallet/oko-types/auth";
+// Service shutdown: signups blocked. Imports below are unused while the handler body is commented out. Re-enable together if restoring.
+// import type { AuthType } from "@oko-wallet/oko-types/auth";
 import type { KeygenBody } from "@oko-wallet/oko-types/tss";
 import type { SignInResponse } from "@oko-wallet/oko-types/user";
 import type { Response, Router } from "express";
 
-import { runKeygen } from "@oko-wallet-api/api/tss/v1/keygen";
+// import { runKeygen } from "@oko-wallet-api/api/tss/v1/keygen";
 import { apiKeyMiddleware } from "@oko-wallet-api/middleware/auth/api_key_auth";
 import {
   type OAuthAuthenticatedRequest,
@@ -61,6 +62,14 @@ export function setKeygenV1Routes(router: Router) {
           },
         },
       },
+      403: {
+        description: "Forbidden - New signups are disabled",
+        content: {
+          "application/json": {
+            schema: ErrorResponseSchema,
+          },
+        },
+      },
       409: {
         description:
           "Conflict - Email already exists or public key already in use",
@@ -86,15 +95,24 @@ export function setKeygenV1Routes(router: Router) {
     oauthMiddleware,
     tssActivateMiddleware,
     async (
-      req: OAuthAuthenticatedRequest<KeygenBody>,
+      _req: OAuthAuthenticatedRequest<KeygenBody>,
       res: Response<OkoApiResponse<SignInResponse>, OAuthLocalsWithAPIKey>,
     ) => {
-      const state = req.app.locals;
+      // Service shutdown: signups permanently blocked. To restore, remove this response block and uncomment the block below.
+      res.status(ErrorCodeMap.SIGNUP_DISABLED).json({
+        success: false,
+        code: "SIGNUP_DISABLED",
+        msg: "New signups are disabled as the service is winding down.",
+      });
+      return;
+
+      /* === Disabled due to service shutdown. Uncomment to restore. ===
+      const state = _req.app.locals;
       const apiKey = res.locals.api_key;
       const oauthUser = res.locals.oauth_user;
       const auth_type = oauthUser.type as AuthType;
       const user_identifier = oauthUser.user_identifier;
-      const body = req.body;
+      const body = _req.body;
 
       if (!user_identifier) {
         res.status(401).json({
@@ -136,6 +154,7 @@ export function setKeygenV1Routes(router: Router) {
         data: runKeygenRes.data,
       });
       return;
+      */
     },
   );
 }

backend/oko_api/server/src/routes/tss_v2/keygen.ts

@@ -9,12 +9,13 @@ import {
   SignInSuccessResponseV2Schema,
 } from "@oko-wallet/oko-api-openapi/tss";
 import type { OkoApiResponse } from "@oko-wallet/oko-types/api_response";
-import type { AuthType } from "@oko-wallet/oko-types/auth";
+// Service shutdown: signups blocked. Imports below are unused while the handler body is commented out. Re-enable together if restoring.
+// import type { AuthType } from "@oko-wallet/oko-types/auth";
 import type { KeygenBodyV2 } from "@oko-wallet/oko-types/tss";
 import type { SignInResponseV2 } from "@oko-wallet/oko-types/user";
 import type { Response } from "express";
 
-import { runKeygenV2 } from "@oko-wallet-api/api/tss/v2/keygen";
+// import { runKeygenV2 } from "@oko-wallet-api/api/tss/v2/keygen";
 import type { OAuthAuthenticatedRequest } from "@oko-wallet-api/middleware/auth/oauth";
 import type { OAuthLocalsWithAPIKey } from "@oko-wallet-api/middleware/auth/types";
 
@@ -56,6 +57,14 @@ registry.registerPath({
         },
       },
     },
+    403: {
+      description: "Forbidden - New signups are disabled",
+      content: {
+        "application/json": {
+          schema: ErrorResponseSchema,
+        },
+      },
+    },
     409: {
       description:
         "Conflict - Email already exists or public key already in use",
@@ -77,14 +86,23 @@ registry.registerPath({
 });
 
 export async function keygenV2(
-  req: OAuthAuthenticatedRequest<KeygenBodyV2>,
+  _req: OAuthAuthenticatedRequest<KeygenBodyV2>,
   res: Response<OkoApiResponse<SignInResponseV2>, OAuthLocalsWithAPIKey>,
 ) {
-  const state = req.app.locals;
+  // Service shutdown: signups permanently blocked. To restore, remove this response block and uncomment the block below.
+  res.status(ErrorCodeMap.SIGNUP_DISABLED).json({
+    success: false,
+    code: "SIGNUP_DISABLED",
+    msg: "New signups are disabled as the service is winding down.",
+  });
+  return;
+
+  /* === Disabled due to service shutdown. Uncomment to restore. ===
+  const state = _req.app.locals;
   const oauthUser = res.locals.oauth_user;
   const auth_type = oauthUser.type as AuthType;
   const user_identifier = oauthUser.user_identifier;
-  const body = req.body;
+  const body = _req.body;
   const apiKey = res.locals.api_key;
 
   if (!user_identifier) {
@@ -129,4 +147,5 @@ export async function keygenV2(
     data: runKeygenRes.data,
   });
   return;
+  */
 }

backend/oko_api_error_codes/src/index.ts

@@ -63,5 +63,6 @@ export const ErrorCodeMap: Record<ErrorCode, number> = {
   TARGET_USER_NOT_FOUND: 404,
   INVALID_EMAIL_FORMAT: 400,
   SERVICE_UNAVAILABLE: 503,
+  SIGNUP_DISABLED: 403,
   UNKNOWN_ERROR: 500,
 };

common/oko_types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oko-wallet/oko-types",
-  "version": "0.1.2-alpha.13",
+  "version": "0.1.2-alpha.14",
   "type": "module",
   "publishConfig": {
     "access": "public"

common/oko_types/src/api_response/index.ts

@@ -74,4 +74,5 @@ export type ErrorCode =
   | "TARGET_USER_NOT_FOUND"
   | "INVALID_EMAIL_FORMAT"
   | "SERVICE_UNAVAILABLE"
+  | "SIGNUP_DISABLED"
   | "UNKNOWN_ERROR";

embed/oko_attached/src/window_msgs/oauth_info_pass/handlers/new_user.ts

@@ -209,6 +209,12 @@ export async function handleNewUserV2(
     apiKey,
   );
   if (reqKeygenV2Res.success === false) {
+    if (reqKeygenV2Res.code === "SIGNUP_DISABLED") {
+      return {
+        success: false,
+        err: { type: "signup_disabled" },
+      };
+    }
     return {
       success: false,
       err: { type: "sign_in_request_fail", error: reqKeygenV2Res.msg },

embed/oko_attached/src/window_msgs/oauth_info_pass/user.ts

@@ -263,6 +263,12 @@ export async function handleNewUser(
     apiKey,
   );
   if (reqKeygenRes.success === false) {
+    if (reqKeygenRes.code === "SIGNUP_DISABLED") {
+      return {
+        success: false,
+        err: { type: "signup_disabled" },
+      };
+    }
     return {
       success: false,
       err: { type: "sign_in_request_fail", error: reqKeygenRes.msg },

key_share_node/ksn_interface/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oko-wallet/ksn-interface",
-  "version": "0.1.2-alpha.13",
+  "version": "0.1.2-alpha.14",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@oko-wallet/bytes": "^0.1.2-alpha.12",
-    "@oko-wallet/oko-types": "^0.1.2-alpha.13"
+    "@oko-wallet/oko-types": "^0.1.2-alpha.14"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",