feat(admin): add registration policy settings and disabled register state

packages/db/prisma/migrations/20260210200148_admin_registration_policy_setting/migration.sql

@@ -0,0 +1,9 @@
+-- CreateTable
+CREATE TABLE "system_setting" (
+    "key" TEXT NOT NULL,
+    "value" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "system_setting_pkey" PRIMARY KEY ("key")
+);

packages/db/prisma/schema.prisma

@@ -87,3 +87,12 @@ model Verification {
   @@index([identifier])
   @@map("verification")
 }
+
+model SystemSetting {
+  key       String   @id
+  value     String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("system_setting")
+}

packages/db/src/index.ts

@@ -7,3 +7,4 @@ export {
   registerPostCrudAuditHook,
   updatePost,
 } from "./posts"
+export { isAdminSelfRegistrationEnabled, setAdminSelfRegistrationEnabled } from "./settings"

packages/db/src/settings.ts

@@ -0,0 +1,56 @@
+import { db } from "./client"
+
+const ADMIN_SELF_REGISTRATION_KEY = "admin.self_registration_enabled"
+
+function resolveEnvFallback(): boolean {
+  return process.env.CMS_ADMIN_SELF_REGISTRATION_ENABLED === "true"
+}
+
+function parseStoredBoolean(value: string): boolean | null {
+  if (value === "true") {
+    return true
+  }
+
+  if (value === "false") {
+    return false
+  }
+
+  return null
+}
+
+export async function isAdminSelfRegistrationEnabled(): Promise<boolean> {
+  try {
+    const setting = await db.systemSetting.findUnique({
+      where: { key: ADMIN_SELF_REGISTRATION_KEY },
+      select: { value: true },
+    })
+
+    if (!setting) {
+      return resolveEnvFallback()
+    }
+
+    const parsed = parseStoredBoolean(setting.value)
+
+    if (parsed === null) {
+      return resolveEnvFallback()
+    }
+
+    return parsed
+  } catch {
+    // Fallback while migrations are not yet applied in a local environment.
+    return resolveEnvFallback()
+  }
+}
+
+export async function setAdminSelfRegistrationEnabled(enabled: boolean): Promise<void> {
+  await db.systemSetting.upsert({
+    where: { key: ADMIN_SELF_REGISTRATION_KEY },
+    create: {
+      key: ADMIN_SELF_REGISTRATION_KEY,
+      value: enabled ? "true" : "false",
+    },
+    update: {
+      value: enabled ? "true" : "false",
+    },
+  })
+}