Show registration unavailable page when signup is disabled

Instead of showing the signup form and returning an internal error on
submit, the SignUpPage now queries signUpEnabled upfront and displays a
friendly message explaining that registration is not available, with a
link back to login.

Adds a signUpEnabled GraphQL query field on the connect/v1 API and
handles ErrSignupDisabled as a FORBIDDEN error in the SignUp resolver.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/connect/v1/schema.graphql

@@ -55,6 +55,9 @@ type Query {
   oidcProviders: [OIDCProviderInfo!]!
     @goField(forceResolver: true)
     @session(required: OPTIONAL)
+  signUpEnabled: Boolean!
+    @goField(forceResolver: true)
+    @session(required: NONE)
 }
 
 type Mutation {

pkg/server/api/connect/v1/v1_resolver.go

@@ -346,6 +346,11 @@ func (r *mutationResolver) SignUp(ctx context.Context, input types.SignUpInput)
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
+		var errSignupDisabled *iam.ErrSignupDisabled
+		if errors.As(err, &errSignupDisabled) {
+			return nil, gqlutils.Forbidden(ctx, err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot create identity with password", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1777,6 +1782,11 @@ func (r *queryResolver) OidcProviders(ctx context.Context) ([]*types.OIDCProvide
 	return result, nil
 }
 
+// SignUpEnabled is the resolver for the signUpEnabled field.
+func (r *queryResolver) SignUpEnabled(ctx context.Context) (bool, error) {
+	return r.iam.IsSignUpEnabled(), nil
+}
+
 // TestLoginURL is the resolver for the testLoginUrl field.
 func (r *sAMLConfigurationResolver) TestLoginURL(ctx context.Context, obj *types.SAMLConfiguration) (string, error) {
 	return r.baseURL.WithPath("/api/connect/v1/saml/2.0/" + obj.ID.String()).MustString(), nil