flaskbb-plugin-inviteonly 1.0.0__py3-none-any.whl

flaskbb_plugin_inviteonly-1.0.0.dist-info/METADATA

@@ -0,0 +1,91 @@
+Metadata-Version: 2.5
+Name: flaskbb-plugin-inviteonly
+Version: 1.0.0
+Summary: Invite-only registration for FlaskBB - let admins and quota-holding members invite new users even while registration is closed
+Project-URL: Homepage, https://github.com/flaskbb/flaskbb-plugin-inviteonly
+Project-URL: Repository, https://github.com/flaskbb/flaskbb-plugin-inviteonly
+Project-URL: Issues, https://github.com/flaskbb/flaskbb-plugin-inviteonly/issues
+Project-URL: Changelog, https://github.com/flaskbb/flaskbb-plugin-inviteonly/blob/master/CHANGELOG.md
+Author-email: Peter Justin <peter@peterjustin.com>
+Maintainer-email: Peter Justin <peter@peterjustin.com>
+License-Expression: BSD-3-Clause
+License-File: LICENSE
+Keywords: flaskbb,invitation,invite,plugin,registration
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Flask
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.12
+Requires-Dist: flaskbb>=3.0.0
+Description-Content-Type: text/markdown
+
+Invite-only
+===========
+
+Invite-only registration for FlaskBB. Lets an admin, or a member with an
+invitation quota, generate an invitation code/link (optionally emailed)
+that lets someone register even while registration is otherwise closed.
+
+
+Installation
+------------
+
+Install *flaskbb-plugin-inviteonly* with
+``pip install flaskbb-plugin-inviteonly``
+
+For local development against a FlaskBB checkout, see "Developing a new,
+standalone plugin" in FlaskBB's own
+[plugin development docs](https://flaskbb.readthedocs.io/en/latest/development/plugin/developing.html) -
+in short, from FlaskBB's root folder:
+
+```
+uv pip install -e ../flaskbb-plugin-inviteonly
+```
+
+
+Usage
+-----
+
+Any logged-in member with a nonzero (or unlimited) invitation quota can
+create invitations from "My Invitations" (linked in the user menu). Each
+invitation is a one-time code/link; an email address can optionally be
+given to send it directly, otherwise the code/link is shown to copy and
+share manually.
+
+The recipient registers either by following the link
+(`/invite/<code>`) or by entering the code on the "Have an invitation
+code?" page (`/invite`) - both work even while FlaskBB's own
+registration is closed (`REGISTRATION_ENABLED` off).
+
+Admins manage every invitation and grant/adjust any user's quota from
+the admin panel's "Invitations" page.
+
+
+Settings
+--------
+
+*Invite-only Settings*, under the admin panel's Plugin Settings, has
+three options:
+
+* **Enable invite-only registration** - master toggle for the invitation
+  routes (default: on).
+* **Default invitation quota** - how many invitations a user can create
+  before an admin has granted them a quota (default: 0, meaning
+  invitations are admin-only until granted).
+* **Invitation expiry (days)** - how long an invitation stays valid
+  (default: 7, 0 means it never expires).
+
+Admins always bypass the quota check and can create invitations
+regardless of their own quota.
+
+
+License
+-------
+This project is licensed under the terms of the [BSD License](/LICENSE).

flaskbb_plugin_inviteonly-1.0.0.dist-info/RECORD

@@ -0,0 +1,19 @@
+inviteonly/__init__.py,sha256=BSURCEIcL24uIwtxH1GUMAY4oLvhxfVWfzz7uFKgYlk,3437
+inviteonly/forms.py,sha256=D8VV0zGHoGO-1woz7q1Kb6GIsbY6ynZSZ5gr6yc-jPY,1569
+inviteonly/models.py,sha256=9svlhZTg2BStq6tZOge9ffKTyvJjq6zL6d08DWZV8NU,2488
+inviteonly/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+inviteonly/utils.py,sha256=XM1x2RAP2BXOvGIIZZodT1xSMyEHWHxf8-qqIPaTw8U,3626
+inviteonly/views.py,sha256=7xKWPH6NFXkN95JObx15iRs1YCmQXig0f4p4pvxgiFE,11534
+inviteonly/migrations/202607301400_c3e7a1f9b8d2_add_inviteonly.py,sha256=s3iqd-8OoROV1tJRfqHi5JKAuQAn8UhATkS8jnitRGY,2866
+inviteonly/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+inviteonly/templates/inviteonly/_macros.html,sha256=qxY4dOnyBE779TIIY3REi33cvI-LqB3rFGdigFB8mGY,460
+inviteonly/templates/inviteonly/_navlink.html,sha256=yRFJnz1VWHiDY-DFeHX84jbbgrs80ugxIFnkDJPIpCo,432
+inviteonly/templates/inviteonly/admin.html,sha256=pYsdqpfslq-D3dN-P1I1FV8keQC127IN-DZUqJmzjBs,4494
+inviteonly/templates/inviteonly/enter_code.html,sha256=aBHKb7yqJOX_b89Mx9tXgNSsuNjI_n_B_i01PpH63-w,624
+inviteonly/templates/inviteonly/mine.html,sha256=u7I-o7K_HEnWuksPJkqfol7CJmPyU1QZrb_rFL9zZJ4,3888
+inviteonly/templates/inviteonly/register.html,sha256=6hzBi34MhPjkgFLrnSt-WmVcDq2JmCiVIP4Z1wjG2tM,1419
+flaskbb_plugin_inviteonly-1.0.0.dist-info/METADATA,sha256=e3gMHcUvZ4jaIshHjWxZUFYumJdHD-e1YXdhQvjXuSc,3410
+flaskbb_plugin_inviteonly-1.0.0.dist-info/WHEEL,sha256=THafob7ofN-NsuMN7Mg4qZyHaQI7KkD-QlcQatYhXPo,87
+flaskbb_plugin_inviteonly-1.0.0.dist-info/entry_points.txt,sha256=RS0OgCBk4qfdM8K7evYssWPQjcfXfo9NqnxJnefbVCA,42
+flaskbb_plugin_inviteonly-1.0.0.dist-info/licenses/LICENSE,sha256=ebP4t6o_-IT9SPVkjzUZTaUR3CX0QsZ8qLSFbbUSSUM,1500
+flaskbb_plugin_inviteonly-1.0.0.dist-info/RECORD,,

flaskbb_plugin_inviteonly-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.3
+Root-Is-Purelib: true
+Tag: py3-none-any

flaskbb_plugin_inviteonly-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[flaskbb_plugins]
+inviteonly = inviteonly

flaskbb_plugin_inviteonly-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,31 @@
+Copyright (c) 2026 by Peter Justin and contributors. See AUTHORS for more
+details.
+
+Some rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+* Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+* The names of the contributors may not be used to endorse or
+  promote products derived from this software without specific
+  prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

inviteonly/__init__.py

@@ -0,0 +1,118 @@
+"""
+inviteonly
+~~~~~~~~~~
+
+An invite-only registration plugin for FlaskBB. Lets an admin or a user
+with an invitation quota generate a code/link (optionally emailed) that
+lets someone register even while registration is globally closed.
+
+:copyright: (c) 2026 by Peter Justin.
+:license: BSD License, see LICENSE for more details.
+"""
+
+import os
+
+from flask import Flask
+from flask_allows2 import Permission
+from flask_login import current_user
+from flaskbb.settings import BoolSetting, IntSetting, SettingGroup
+from flaskbb.user.models import User
+from flaskbb.utils.helpers import real, render_template
+from flaskbb.utils.requirements import IsAdmin
+from pluggy import HookimplMarker
+
+from .utils import (
+    DEFAULT_ENABLED,
+    DEFAULT_EXPIRY_DAYS,
+    DEFAULT_QUOTA,
+    default_quota,
+    display_remaining,
+    grant_quota,
+)
+from .views import inviteonly_bp
+
+__version__ = "1.0.0"
+
+hookimpl = HookimplMarker("flaskbb")
+
+
+@hookimpl
+def flaskbb_load_migrations():
+    return os.path.join(os.path.dirname(__file__), "migrations")
+
+
+@hookimpl
+def flaskbb_load_translations():
+    return os.path.join(os.path.dirname(__file__), "translations")
+
+
+@hookimpl
+def flaskbb_load_blueprints(app: Flask):
+    app.register_blueprint(
+        inviteonly_bp,
+        url_prefix=app.config.get("PLUGIN_INVITEONLY_URL_PREFIX", "/invite"),
+    )
+
+
+SETTINGS = SettingGroup(
+    key="inviteonly",
+    name="Invite-only Settings",
+    description="Settings for invite-only registration.",
+    settings=(
+        BoolSetting(
+            key="ENABLED",
+            value=DEFAULT_ENABLED,
+            name="Enable invite-only registration",
+            description=(
+                "When enabled, invitation links/codes let someone register "
+                "even while registration is otherwise closed."
+            ),
+        ),
+        IntSetting(
+            key="DEFAULT_QUOTA",
+            value=DEFAULT_QUOTA,
+            min=0,
+            name="Default invitation quota",
+            description=(
+                "How many invitations a user can create before an admin has "
+                "granted them a quota. 0 means invitations are admin-only "
+                "until a quota is granted."
+            ),
+        ),
+        IntSetting(
+            key="EXPIRY_DAYS",
+            value=DEFAULT_EXPIRY_DAYS,
+            min=0,
+            name="Invitation expiry (days)",
+            description=("How many days an invitation stays valid. 0 means it never expires."),
+        ),
+    ),
+)
+
+
+@hookimpl
+def flaskbb_load_setting_groups():
+    return SETTINGS
+
+
+@hookimpl
+def flaskbb_registration_post_processor(user: User):
+    # Seeds a quota row for every newly registered user (open or
+    # invite-based - both paths call RegistrationService.register(), which
+    # fires this hook) so the default quota setting takes effect immediately
+    # instead of only lazily on first invite creation.
+    grant_quota(user, default_quota())
+
+
+@hookimpl
+def flaskbb_tpl_user_nav_loggedin_before():
+    user = real(current_user)
+    remaining = display_remaining(user, default_quota())
+    has_invites = remaining is None or remaining > 0
+    return render_template("inviteonly/_navlink.html", remaining=remaining, has_invites=has_invites)
+
+
+@hookimpl(trylast=True)
+def flaskbb_tpl_admin_settings_menu(user: User):
+    if Permission(IsAdmin, identity=user):
+        return [("inviteonly.admin_invitations", "Invitations", "fa fa-envelope-open-text")]

inviteonly/forms.py

@@ -0,0 +1,54 @@
+"""
+inviteonly.forms
+~~~~~~~~~~~~~~~~
+
+Forms used to enter an invite code, create an invite, revoke an invite,
+and (for admins) set a user's invitation quota.
+
+:copyright: (c) 2026 by Peter Justin.
+:license: BSD License, see LICENSE for more details.
+"""
+
+from flask_babelplus import gettext as _
+from flask_wtf import FlaskForm
+from flaskbb.utils.forms import FlaskBBForm
+from wtforms import BooleanField, IntegerField, StringField, SubmitField
+from wtforms.validators import DataRequired, Length, NumberRange, Optional
+
+
+class InviteCodeForm(FlaskBBForm):
+    code = StringField(
+        _("Invitation code"),
+        validators=[DataRequired(message=_("Please enter an invitation code."))],
+    )
+    submit = SubmitField(_("Continue"))
+
+
+class CreateInviteForm(FlaskBBForm):
+    email = StringField(
+        _("Email address (optional)"),
+        validators=[Optional(), Length(max=255)],
+    )
+    submit = SubmitField(_("Create invitation"))
+
+
+class AdminQuotaForm(FlaskBBForm):
+    remaining = IntegerField(
+        _("Remaining invitations"),
+        validators=[Optional(), NumberRange(min=0)],
+    )
+    unlimited = BooleanField(_("Unlimited"), default=False)
+    submit = SubmitField(_("Save"))
+
+
+class AdminGrantQuotaForm(AdminQuotaForm):
+    username = StringField(
+        _("Username"),
+        validators=[DataRequired(message=_("Please enter a username."))],
+    )
+
+
+class RevokeInviteForm(FlaskForm):
+    """Carries the CSRF token for a revoke request - the invitation id
+    comes from the URL, so there's nothing else for this form to hold.
+    """

inviteonly/migrations/202607301400_c3e7a1f9b8d2_add_inviteonly.py

@@ -0,0 +1,84 @@
+"""Add inviteonly_invitations and inviteonly_quotas
+
+Revision ID: c3e7a1f9b8d2
+Revises:
+Create Date: 2026-07-30 14:00:00.000000
+
+"""
+
+import flaskbb
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "c3e7a1f9b8d2"
+down_revision = None
+branch_labels = ("inviteonly",)
+depends_on = "8ad96e49dc6"  # flaskbb core init migration - creates users
+
+
+def upgrade():
+    con = op.get_bind()
+
+    if not sa.inspect(con).has_table("inviteonly_invitations"):
+        op.create_table(
+            "inviteonly_invitations",
+            sa.Column("id", sa.Integer(), nullable=False),
+            sa.Column("code", sa.String(length=64), nullable=False),
+            sa.Column("created_by_id", sa.Integer(), nullable=True),
+            sa.Column("invited_email", sa.String(length=255), nullable=True),
+            sa.Column(
+                "created_at",
+                flaskbb.utils.database.UTCDateTime(timezone=True),
+                nullable=False,
+            ),
+            sa.Column(
+                "expires_at",
+                flaskbb.utils.database.UTCDateTime(timezone=True),
+                nullable=True,
+            ),
+            sa.Column(
+                "accepted_at",
+                flaskbb.utils.database.UTCDateTime(timezone=True),
+                nullable=True,
+            ),
+            sa.Column("accepted_by_id", sa.Integer(), nullable=True),
+            sa.Column(
+                "revoked_at",
+                flaskbb.utils.database.UTCDateTime(timezone=True),
+                nullable=True,
+            ),
+            sa.ForeignKeyConstraint(
+                ["created_by_id"],
+                ["users.id"],
+                name=op.f("fk_inviteonly_invitations_created_by_id_users"),
+                ondelete="SET NULL",
+            ),
+            sa.ForeignKeyConstraint(
+                ["accepted_by_id"],
+                ["users.id"],
+                name=op.f("fk_inviteonly_invitations_accepted_by_id_users"),
+                ondelete="SET NULL",
+            ),
+            sa.PrimaryKeyConstraint("id", name=op.f("pk_inviteonly_invitations")),
+            sa.UniqueConstraint("code", name=op.f("uq_inviteonly_invitations_code")),
+        )
+
+    if not sa.inspect(con).has_table("inviteonly_quotas"):
+        op.create_table(
+            "inviteonly_quotas",
+            sa.Column("user_id", sa.Integer(), nullable=False),
+            sa.Column("remaining", sa.Integer(), nullable=True),
+            sa.ForeignKeyConstraint(
+                ["user_id"],
+                ["users.id"],
+                name=op.f("fk_inviteonly_quotas_user_id_users"),
+                ondelete="CASCADE",
+            ),
+            sa.PrimaryKeyConstraint("user_id", name=op.f("pk_inviteonly_quotas")),
+        )
+
+
+def downgrade():
+    op.drop_table("inviteonly_quotas")
+    op.drop_table("inviteonly_invitations")

inviteonly/models.py

@@ -0,0 +1,74 @@
+"""
+inviteonly.models
+~~~~~~~~~~~~~~~~~
+
+The models for invitations and per-user invitation quotas.
+
+:copyright: (c) 2026 by Peter Justin.
+:license: BSD License, see LICENSE for more details.
+"""
+
+import datetime
+
+from flaskbb.utils.database import BaseModel, UTCDateTime
+from flaskbb.utils.helpers import time_utcnow
+from sqlalchemy import ForeignKey, Integer, String
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+
+class Invitation(BaseModel):
+    __tablename__ = "inviteonly_invitations"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    code: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
+    created_by_id: Mapped[int | None] = mapped_column(
+        ForeignKey("users.id", ondelete="SET NULL"), nullable=True
+    )
+    invited_email: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    created_at: Mapped[datetime.datetime] = mapped_column(
+        UTCDateTime(timezone=True), default=time_utcnow, nullable=False
+    )
+    expires_at: Mapped[datetime.datetime | None] = mapped_column(
+        UTCDateTime(timezone=True), nullable=True
+    )
+    accepted_at: Mapped[datetime.datetime | None] = mapped_column(
+        UTCDateTime(timezone=True), nullable=True
+    )
+    accepted_by_id: Mapped[int | None] = mapped_column(
+        ForeignKey("users.id", ondelete="SET NULL"), nullable=True
+    )
+    revoked_at: Mapped[datetime.datetime | None] = mapped_column(
+        UTCDateTime(timezone=True), nullable=True
+    )
+
+    created_by = relationship("User", foreign_keys=[created_by_id])
+    accepted_by = relationship("User", foreign_keys=[accepted_by_id])
+
+    @property
+    def is_expired(self) -> bool:
+        return self.expires_at is not None and self.expires_at <= time_utcnow()
+
+    @property
+    def is_valid(self) -> bool:
+        return self.accepted_at is None and self.revoked_at is None and not self.is_expired
+
+    @property
+    def status(self) -> str:
+        if self.accepted_at is not None:
+            return "accepted"
+        if self.revoked_at is not None:
+            return "revoked"
+        if self.is_expired:
+            return "expired"
+        return "pending"
+
+
+class InviteQuota(BaseModel):
+    __tablename__ = "inviteonly_quotas"
+
+    user_id: Mapped[int] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), primary_key=True
+    )
+    remaining: Mapped[int | None] = mapped_column(Integer, nullable=True)
+
+    user = relationship("User", foreign_keys=[user_id])

inviteonly/templates/inviteonly/_macros.html

@@ -0,0 +1,11 @@
+{%- macro status_badge(status) -%}
+{%- if status == "accepted" -%}
+<span class="badge bg-success">{% trans %}accepted{% endtrans %}</span>
+{%- elif status == "revoked" -%}
+<span class="badge bg-danger">{% trans %}revoked{% endtrans %}</span>
+{%- elif status == "expired" -%}
+<span class="badge bg-secondary">{% trans %}expired{% endtrans %}</span>
+{%- else -%}
+<span class="badge bg-info">{% trans %}pending{% endtrans %}</span>
+{%- endif -%}
+{%- endmacro -%}

inviteonly/templates/inviteonly/_navlink.html

@@ -0,0 +1,12 @@
+{%- if has_invites -%}
+<ul class="navbar-nav me-2">
+    <li class="nav-item">
+        <a class="nav-link" href="{{ url_for('inviteonly.mine') }}">
+            <span class="fas fa-envelope-open-text fa-fw"></span> {% trans %}Invitations{% endtrans %}
+            {%- if remaining is not none -%}
+            <span class="badge bg-secondary">{{ remaining }}</span>
+            {%- endif -%}
+        </a>
+    </li>
+</ul>
+{%- endif -%}

inviteonly/templates/inviteonly/admin.html

@@ -0,0 +1,90 @@
+{% set page_title = _("Invitations") %}
+{% set active = "inviteonly.admin_invitations" %}
+
+{% extends theme("management/management_layout.html") %}
+
+{% block breadcrumb %}
+<ol class="breadcrumb flaskbb-breadcrumb">
+    <li class="breadcrumb-item"><a href="{{ url_for('forum.index') }}">{% trans %}Forum{% endtrans %}</a></li>
+    <li class="breadcrumb-item"><a href="{{ url_for('management.overview') }}">{% trans %}Management{% endtrans %}</a></li>
+    <li class="breadcrumb-item active">{% trans %}Invitations{% endtrans %}</li>
+</ol>
+{% endblock %}
+
+{% block management_content %}
+{%- from theme('_macros/form.html') import render_field, action_confirm -%}
+{%- from theme('_macros/pagination.html') import render_pagination -%}
+{%- from theme('inviteonly/_macros.html') import status_badge -%}
+
+<div class="col-md-12 settings-col">
+    <div class="card settings">
+        <div class="card-header settings-header">
+            <span class="fa fa-envelope-open-text"></span> {% trans %}Grant a user's quota{% endtrans %}
+        </div>
+        <div class="card-body settings-body">
+            <form class="row p-2" role="form" method="POST" action="{{ url_for('inviteonly.admin_grant_quota') }}">
+                {{ grant_form.hidden_tag() }}
+                {{ render_field(grant_form.username, div_class="mb-3 col-md-6") }}
+                {{ render_field(grant_form.remaining, div_class="mb-3 col-md-6") }}
+                {{ render_field(grant_form.unlimited) }}
+                {{ render_field(grant_form.submit) }}
+            </form>
+        </div>
+    </div>
+</div>
+
+<div class="col-md-12 settings-col">
+    <div class="card settings">
+        <div class="card-header settings-header border-top">
+            <span class="fa fa-list"></span> {% trans %}All Invitations{% endtrans %}
+        </div>
+        <div class="card-body settings-body">
+            <div class="settings-content">
+                <div class="settings-meta row">
+                    <div class="col-md-2 col-sm-2 col-3 ps-3 meta-item">{% trans %}Code{% endtrans %}</div>
+                    <div class="col-md-2 col-sm-2 col-3 meta-item">{% trans %}Created by{% endtrans %}</div>
+                    <div class="col-md-3 col-sm-3 d-none d-sm-block meta-item">{% trans %}Invited email{% endtrans %}</div>
+                    <div class="col-md-2 col-sm-2 col-3 meta-item">{% trans %}Status{% endtrans %}</div>
+                    <div class="col-md-2 col-sm-2 d-none d-sm-block meta-item">{% trans %}Created{% endtrans %}</div>
+                    <div class="col-md-1 col-sm-1 col-3 meta-item">{% trans %}Actions{% endtrans %}</div>
+                </div>
+            {% for invite in invites.items %}
+                <div class="row settings-row hover">
+                    <div class="col-md-2 col-sm-2 col-3 ps-3"><code>{{ invite.code }}</code></div>
+                    <div class="col-md-2 col-sm-2 col-3">
+                        {%- if invite.created_by -%}
+                        <a href="{{ invite.created_by.url }}">{{ invite.created_by.username }}</a>
+                        {%- else -%}
+                        -
+                        {%- endif -%}
+                    </div>
+                    <div class="col-md-3 col-sm-3 d-none d-sm-block">{{ invite.invited_email or "-" }}</div>
+                    <div class="col-md-2 col-sm-2 col-3">{{ status_badge(invite.status) }}</div>
+                    <div class="col-md-2 col-sm-2 d-none d-sm-block">{{ invite.created_at|format_date }}</div>
+                    <div class="col-md-1 col-sm-1 col-3">
+                        {% if invite.status == "pending" %}
+                        {{ action_confirm(
+                            "revoke-" ~ invite.id,
+                            url_for("inviteonly.revoke_invite", invite_id=invite.id),
+                            _("Revoke"),
+                            icon="fas fa-ban text-danger"
+                        ) }}
+                        {% endif %}
+                    </div>
+                </div>
+            {% else %}
+                <div class="row settings-row">
+                    <div class="col-12 ps-3">{% trans %}No invitations yet.{% endtrans %}</div>
+                </div>
+            {% endfor %}
+            </div>
+        </div>
+
+        <div class="card-footer settings-footer p-2">
+            {{ render_pagination(invites, url_for('inviteonly.admin_invitations')) }}
+        </div>
+    </div>
+</div>
+
+{% include theme('_partials/confirm_dialog.html') %}
+{% endblock %}

inviteonly/templates/inviteonly/enter_code.html

@@ -0,0 +1,22 @@
+{% set page_title = _("Enter Invitation Code") %}
+{% set active_forum_nav=True %}
+
+{% extends theme("layout.html") %}
+{% block content %}
+{% from theme("_macros/form.html") import horizontal_field %}
+
+<div class="card page">
+    <div class="card-header page-header">
+        {% trans %}Have an invitation code?{% endtrans %}
+    </div>
+
+    <div class="card-body page-body">
+        <form role="form" method="POST">
+            {{ form.hidden_tag() }}
+            {{ horizontal_field(form.code) }}
+            {{ horizontal_field(form.submit, div_class="offset-3 col-4") }}
+        </form>
+    </div>
+</div>
+
+{% endblock %}

inviteonly/templates/inviteonly/mine.html

@@ -0,0 +1,76 @@
+{% set page_title = _("My Invitations") %}
+
+{% extends theme("layout.html") %}
+{% block content %}
+{% from theme("_macros/form.html") import render_field, action_confirm %}
+{% from theme("inviteonly/_macros.html") import status_badge %}
+
+<div class="page-view">
+    <ol class="breadcrumb flaskbb-breadcrumb bg-light">
+        <li class="breadcrumb-item"><a href="{{ url_for('forum.index') }}">{% trans %}Forum{% endtrans %}</a></li>
+        <li class="breadcrumb-item"><a href="{{ url_for('user.profile', username=current_user.username) }}">{{ current_user.username }}</a></li>
+        <li class="breadcrumb-item active">{% trans %}My Invitations{% endtrans %}</li>
+    </ol>
+
+    <div class="card page">
+        <div class="card-header page-header">
+            <span class="fas fa-envelope-open-text"></span> {% trans %}My Invitations{% endtrans %}
+        </div>
+
+        <div class="card-body page-body">
+            <div class="p-3">
+                <p{% if not can_create %} class="mb-0"{% endif %}>
+                    {% if remaining is none %}
+                        {% trans %}You have unlimited invitations.{% endtrans %}
+                    {% else %}
+                        {% trans %}You have {% endtrans %}<strong>{{ remaining }}</strong>
+                        {% trans %}invitation(s) left.{% endtrans %}
+                    {% endif %}
+                </p>
+
+                {% if can_create %}
+                <form class="row g-2 align-items-end" role="form" method="POST">
+                    {{ form.hidden_tag() }}
+                    {{ render_field(form.email, div_class="col-md-6") }}
+                    {{ render_field(form.submit, div_class="col-auto") }}
+                </form>
+                {% endif %}
+            </div>
+
+            <div class="row m-0 page-meta">
+                <div class="col-md-2 col-sm-2 col-4 ps-3 meta-item">{% trans %}Code{% endtrans %}</div>
+                <div class="col-md-3 col-sm-3 d-none d-sm-block meta-item">{% trans %}Invited email{% endtrans %}</div>
+                <div class="col-md-2 col-sm-2 col-4 meta-item">{% trans %}Status{% endtrans %}</div>
+                <div class="col-md-2 col-sm-2 d-none d-sm-block meta-item">{% trans %}Created{% endtrans %}</div>
+                <div class="col-md-2 col-sm-2 d-none d-sm-block meta-item">{% trans %}Expires{% endtrans %}</div>
+                <div class="col-md-1 col-sm-1 col-4 meta-item">{% trans %}Actions{% endtrans %}</div>
+            </div>
+            {% for invite in invites %}
+            <div class="row page-row hover">
+                <div class="col-md-2 col-sm-2 col-4 ps-3"><code>{{ invite.code }}</code></div>
+                <div class="col-md-3 col-sm-3 d-none d-sm-block">{{ invite.invited_email or "-" }}</div>
+                <div class="col-md-2 col-sm-2 col-4">{{ status_badge(invite.status) }}</div>
+                <div class="col-md-2 col-sm-2 d-none d-sm-block">{{ invite.created_at|format_date }}</div>
+                <div class="col-md-2 col-sm-2 d-none d-sm-block">{{ invite.expires_at|format_date if invite.expires_at else "-" }}</div>
+                <div class="col-md-1 col-sm-1 col-4">
+                    {% if invite.status == "pending" %}
+                    {{ action_confirm(
+                        "revoke-" ~ invite.id,
+                        url_for("inviteonly.revoke_invite", invite_id=invite.id),
+                        _("Revoke"),
+                        icon="fas fa-ban text-danger"
+                    ) }}
+                    {% endif %}
+                </div>
+            </div>
+            {% else %}
+            <div class="row page-row">
+                <div class="col-12 ps-3">{% trans %}You haven't created any invitations yet.{% endtrans %}</div>
+            </div>
+            {% endfor %}
+        </div>
+    </div>
+</div>
+
+{% include theme('_partials/confirm_dialog.html') %}
+{% endblock %}

inviteonly/templates/inviteonly/register.html

@@ -0,0 +1,40 @@
+{% set page_title = _("Register") %}
+{% set active_forum_nav=True %}
+
+{% extends theme("layout.html") %}
+{% block content %}
+{% from theme("_macros/form.html") import horizontal_field %}
+
+<div class="card page">
+    <div class="card-header page-header">
+        {% trans %}Register with invitation{% endtrans %}
+    </div>
+
+    <div class="card-body page-body">
+        {% if invite.invited_email %}
+        <p class="text-muted">
+            {% trans %}This invitation is for {% endtrans %}<strong>{{ invite.invited_email }}</strong>.
+        </p>
+        {% endif %}
+
+        <form role="form" method="POST">
+            {{ form.hidden_tag() }}
+            {{ run_hook('flaskbb_tpl_form_registration_before', form=form) }}
+            {{ horizontal_field(form.username)}}
+            {{ horizontal_field(form.email)}}
+            {{ horizontal_field(form.password)}}
+            {{ horizontal_field(form.confirm_password)}}
+
+            {% if flaskbb_config["RECAPTCHA_ENABLED"] and 'recaptcha' in form %}
+                {{ horizontal_field(form.recaptcha) }}
+            {% endif %}
+
+            {{ horizontal_field(form.language) }}
+            {{ horizontal_field(form.accept_tos, div_class="offset-3 col-4")}}
+            {{ run_hook('flaskbb_tpl_form_registration_after', form=form) }}
+            {{ horizontal_field(form.submit, div_class="offset-3 col-4")}}
+        </form>
+    </div>
+</div>
+
+{% endblock %}

inviteonly/utils.py

@@ -0,0 +1,117 @@
+"""
+inviteonly.utils
+~~~~~~~~~~~~~~~~
+
+Helpers for generating invite codes, tracking invitation quotas, and
+emailing invites.
+
+:copyright: (c) 2026 by Peter Justin.
+:license: BSD License, see LICENSE for more details.
+"""
+
+import secrets
+
+from flask_allows2 import Permission
+from flaskbb.email import send_email
+from flaskbb.settings import flaskbb_config
+from flaskbb.user.models import User
+from flaskbb.utils.requirements import IsAdmin
+
+from .models import Invitation, InviteQuota
+
+CODE_LENGTH = 10
+
+# Setting defaults - also used as the SettingGroup's defaults in __init__.py,
+# kept here (rather than there) so views.py can read config without a
+# circular import between __init__.py and views.py.
+DEFAULT_ENABLED = True
+DEFAULT_QUOTA = 0
+DEFAULT_EXPIRY_DAYS = 7
+
+
+def is_enabled() -> bool:
+    value = flaskbb_config["INVITEONLY_ENABLED"]
+    return DEFAULT_ENABLED if value is None else bool(value)
+
+
+def default_quota() -> int:
+    value = flaskbb_config["INVITEONLY_DEFAULT_QUOTA"]
+    return DEFAULT_QUOTA if value is None else int(value)
+
+
+def expiry_days() -> int:
+    value = flaskbb_config["INVITEONLY_EXPIRY_DAYS"]
+    return DEFAULT_EXPIRY_DAYS if value is None else int(value)
+
+
+def generate_code() -> str:
+    while True:
+        code = secrets.token_urlsafe(CODE_LENGTH)[:CODE_LENGTH]
+        if Invitation.get(Invitation.code == code) is None:
+            return code
+
+
+def effective_remaining(user: User, default_quota: int) -> int | None:
+    """The number of invitations ``user`` can still create, or ``None``
+    for unlimited. Falls back to ``default_quota`` if the user has no
+    quota row yet (nobody has granted or consumed a quota for them).
+    """
+    quota = InviteQuota.get(InviteQuota.user_id == user.id)
+    if quota is None:
+        return default_quota
+    return quota.remaining
+
+
+def display_remaining(user: User, default_quota: int) -> int | None:
+    """Remaining invitations to show in the UI - ``None`` both for a real
+    unlimited quota and for admins, who always bypass the quota check (see
+    ``can_create_invite``) so showing their actual quota row would mislead.
+    """
+    if Permission(IsAdmin, identity=user):
+        return None
+    return effective_remaining(user, default_quota)
+
+
+def can_create_invite(user: User, default_quota: int) -> bool:
+    if Permission(IsAdmin, identity=user):
+        return True
+    remaining = effective_remaining(user, default_quota)
+    return remaining is None or remaining > 0
+
+
+def consume_quota(user: User, default_quota: int) -> None:
+    if Permission(IsAdmin, identity=user):
+        return
+
+    quota = InviteQuota.get(InviteQuota.user_id == user.id)
+    if quota is None:
+        quota = InviteQuota(user_id=user.id, remaining=default_quota)
+
+    if quota.remaining is not None:
+        quota.remaining = max(0, quota.remaining - 1)
+
+    quota.save()
+
+
+def grant_quota(user: User, remaining: int | None) -> None:
+    quota = InviteQuota.get(InviteQuota.user_id == user.id)
+    if quota is None:
+        quota = InviteQuota(user_id=user.id, remaining=remaining)
+    else:
+        quota.remaining = remaining
+    quota.save()
+
+
+def send_invite_email(email: str, link: str, invited_by: User) -> None:
+    send_email(
+        subject="You've been invited to join the forum",
+        recipients=[email],
+        text_body=(
+            f"{invited_by.username} has invited you to join the forum.\n\n"
+            f"Follow this link to register: {link}\n"
+        ),
+        html_body=(
+            f"<p>{invited_by.username} has invited you to join the forum.</p>"
+            f'<p><a href="{link}">{link}</a></p>'
+        ),
+    )

inviteonly/views.py

@@ -0,0 +1,364 @@
+"""
+inviteonly.views
+~~~~~~~~~~~~~~~~
+
+Views for entering/redeeming an invitation code, managing your own
+invitations, and (for admins) managing every invitation and user quota.
+
+:copyright: (c) 2026 by Peter Justin.
+:license: BSD License, see LICENSE for more details.
+"""
+
+import logging
+from datetime import timedelta
+
+from flask import abort, Blueprint, flash, redirect, request, url_for
+from flask.views import MethodView
+from flask_allows2 import Permission
+from flask_babelplus import gettext as _
+from flask_login import current_user, login_required
+from flaskbb.auth.forms import RegisterForm
+from flaskbb.auth.services.factories import registration_service_factory
+from flaskbb.core.auth.registration import UserRegistrationInfo
+from flaskbb.core.exceptions import PersistenceError, StopValidation
+from flaskbb.extensions import allows, db, pluggy
+from flaskbb.settings import flaskbb_config
+from flaskbb.user.models import User
+from flaskbb.utils.helpers import (
+    anonymous_required,
+    FlashAndRedirect,
+    get_available_languages,
+    real,
+    redirect_or_next,
+    register_view,
+    render_template,
+    time_utcnow,
+)
+from flaskbb.utils.requirements import IsAdmin
+from sqlalchemy import func, select
+
+from .forms import (
+    AdminGrantQuotaForm,
+    AdminQuotaForm,
+    CreateInviteForm,
+    InviteCodeForm,
+    RevokeInviteForm,
+)
+from .models import Invitation
+from .utils import (
+    can_create_invite,
+    consume_quota,
+    default_quota,
+    display_remaining,
+    expiry_days,
+    generate_code,
+    grant_quota,
+    is_enabled,
+    send_invite_email,
+)
+
+logger = logging.getLogger(__name__)
+
+inviteonly_bp = Blueprint(
+    "inviteonly", __name__, template_folder="templates", static_folder="static"
+)
+
+
+def _expires_at(days: int):
+    return None if days <= 0 else time_utcnow() + timedelta(days=days)
+
+
+class EnterInviteCode(MethodView):
+    decorators = [anonymous_required]
+
+    def get(self):
+        return render_template("inviteonly/enter_code.html", form=InviteCodeForm())
+
+    def post(self):
+        form = InviteCodeForm()
+        if form.validate_on_submit():
+            return redirect(url_for("inviteonly.register_with_invite", code=form.code.data.strip()))
+        return render_template("inviteonly/enter_code.html", form=form)
+
+
+class RegisterWithInvite(MethodView):
+    decorators = [anonymous_required]
+
+    def _invite(self, code: str) -> Invitation | None:
+        if not is_enabled():
+            return None
+        invite = Invitation.get(Invitation.code == code)
+        if invite is None or not invite.is_valid:
+            return None
+        return invite
+
+    def form(self, invite: Invitation):
+        pluggy.hook.flaskbb_form_registration(form=RegisterForm)
+        form = RegisterForm()
+        form.language.choices = get_available_languages()  # pyright: ignore
+        form.language.default = flaskbb_config["DEFAULT_LANGUAGE"]
+        form.process(request.form)  # needed because a default is overriden
+
+        if invite.invited_email:
+            # Locked to the invited address - reassigned after processing so
+            # a tampered client-side submission can't register under a
+            # different email than the one the invite was issued to.
+            form.email.data = invite.invited_email
+            form.email.render_kw = {"readonly": True}
+
+        return form
+
+    def get(self, code: str):
+        invite = self._invite(code)
+        if invite is None:
+            flash(_("This invitation link is invalid or has expired."), "danger")
+            return redirect(url_for("forum.index"))
+        return render_template("inviteonly/register.html", form=self.form(invite), invite=invite)
+
+    def post(self, code: str):
+        invite = self._invite(code)
+        if invite is None:
+            flash(_("This invitation link is invalid or has expired."), "danger")
+            return redirect(url_for("forum.index"))
+
+        form = self.form(invite)
+        if form.validate_on_submit():
+            registration_info = UserRegistrationInfo(
+                username=form.username.data,
+                password=form.password.data,
+                group=4,
+                email=form.email.data,
+                language=form.language.data,
+            )
+
+            service = registration_service_factory()
+            try:
+                user = service.register(registration_info)
+            except StopValidation as e:
+                form.populate_errors(e.reasons)
+                return render_template("inviteonly/register.html", form=form, invite=invite)
+            except PersistenceError:
+                logger.exception("Database error while persisting user")
+                flash(
+                    _("Could not process registration due to an unrecoverable error"),
+                    "danger",
+                )
+                return render_template("inviteonly/register.html", form=form, invite=invite)
+
+            invite.accepted_at = time_utcnow()
+            invite.accepted_by_id = user.id
+            invite.save()
+
+            return redirect_or_next(url_for("forum.index"))
+
+        return render_template("inviteonly/register.html", form=form, invite=invite)
+
+
+class MyInvitations(MethodView):
+    decorators = [login_required]
+
+    def _render(self, form):
+        user = real(current_user)
+        invites = Invitation.get_all(Invitation.created_by_id == user.id)
+        invites.sort(key=lambda i: i.created_at, reverse=True)
+
+        return render_template(
+            "inviteonly/mine.html",
+            invites=invites,
+            remaining=display_remaining(user, default_quota()),
+            can_create=can_create_invite(user, default_quota()),
+            form=form,
+            revoke_form=RevokeInviteForm(),
+        )
+
+    def get(self):
+        return self._render(CreateInviteForm())
+
+    def post(self):
+        user = real(current_user)
+        form = CreateInviteForm()
+
+        if not can_create_invite(user, default_quota()):
+            flash(_("You have no invitations left."), "danger")
+            return redirect(url_for("inviteonly.mine"))
+
+        if not form.validate_on_submit():
+            return self._render(form)
+
+        invite = Invitation(
+            code=generate_code(),
+            created_by_id=user.id,
+            invited_email=form.email.data or None,
+            expires_at=_expires_at(expiry_days()),
+        )
+        invite.save()
+        consume_quota(user, default_quota())
+
+        link = url_for("inviteonly.register_with_invite", code=invite.code, _external=True)
+        if form.email.data:
+            send_invite_email(form.email.data, link, user)
+            flash(
+                _(
+                    "Invitation sent to %(email)s: %(link)s",
+                    email=form.email.data,
+                    link=link,
+                ),
+                "success",
+            )
+        else:
+            flash(_("Invitation created: %(link)s", link=link), "success")
+
+        return redirect(url_for("inviteonly.mine"))
+
+
+class RevokeInvite(MethodView):
+    decorators = [login_required]
+
+    def post(self, invite_id: int):
+        invite = Invitation.get_or_404(Invitation.id == invite_id)
+        user = real(current_user)
+
+        is_owner = invite.created_by_id == user.id
+        if not is_owner and not Permission(IsAdmin, identity=user):
+            abort(404)
+
+        if invite.status != "pending":
+            flash(_("That invitation can no longer be revoked."), "info")
+        else:
+            invite.revoked_at = time_utcnow()
+            invite.save()
+            flash(_("Invitation revoked."), "success")
+
+        return redirect_or_next(url_for("inviteonly.mine"))
+
+
+class AdminInvitations(MethodView):
+    decorators = [
+        allows.requires(
+            IsAdmin,
+            on_fail=FlashAndRedirect(
+                message=_("You are not allowed to manage invitations"),
+                level="danger",
+                endpoint="forum.index",
+            ),
+        )
+    ]
+
+    def get(self):
+        page = request.args.get("page", 1, type=int)
+        invites = db.paginate(
+            select(Invitation).order_by(Invitation.created_at.desc()),
+            page=page,
+            per_page=flaskbb_config["USERS_PER_PAGE"],
+            error_out=False,
+        )
+        return render_template(
+            "inviteonly/admin.html",
+            invites=invites,
+            revoke_form=RevokeInviteForm(),
+            quota_form=AdminQuotaForm(),
+            grant_form=AdminGrantQuotaForm(),
+        )
+
+
+class AdminSetQuota(MethodView):
+    decorators = [
+        allows.requires(
+            IsAdmin,
+            on_fail=FlashAndRedirect(
+                message=_("You are not allowed to manage invitations"),
+                level="danger",
+                endpoint="forum.index",
+            ),
+        )
+    ]
+
+    def post(self, user_id: int):
+        target = User.get_or_404(User.id == user_id)
+        form = AdminQuotaForm()
+
+        if form.validate_on_submit():
+            remaining = None if form.unlimited.data else (form.remaining.data or 0)
+            grant_quota(target, remaining)
+            flash(
+                _(
+                    "Updated invitation quota for %(username)s.",
+                    username=target.username,
+                ),
+                "success",
+            )
+        else:
+            flash(_("Could not update the quota."), "danger")
+
+        return redirect_or_next(url_for("inviteonly.admin_invitations"))
+
+
+class AdminGrantQuota(MethodView):
+    decorators = [
+        allows.requires(
+            IsAdmin,
+            on_fail=FlashAndRedirect(
+                message=_("You are not allowed to manage invitations"),
+                level="danger",
+                endpoint="forum.index",
+            ),
+        )
+    ]
+
+    def post(self):
+        form = AdminGrantQuotaForm()
+
+        if form.validate_on_submit():
+            target = User.get(func.lower(User.username) == form.username.data.lower())
+            if target is None:
+                flash(
+                    _("No user named %(username)s.", username=form.username.data),
+                    "danger",
+                )
+            else:
+                remaining = None if form.unlimited.data else (form.remaining.data or 0)
+                grant_quota(target, remaining)
+                flash(
+                    _(
+                        "Updated invitation quota for %(username)s.",
+                        username=target.username,
+                    ),
+                    "success",
+                )
+        else:
+            flash(_("Could not update the quota."), "danger")
+
+        return redirect_or_next(url_for("inviteonly.admin_invitations"))
+
+
+register_view(inviteonly_bp, routes=[""], view_func=EnterInviteCode.as_view("enter_code"))
+register_view(
+    inviteonly_bp,
+    routes=["/mine"],
+    view_func=MyInvitations.as_view("mine"),
+)
+register_view(
+    inviteonly_bp,
+    routes=["/admin"],
+    view_func=AdminInvitations.as_view("admin_invitations"),
+)
+register_view(
+    inviteonly_bp,
+    routes=["/admin/quota/<int:user_id>"],
+    view_func=AdminSetQuota.as_view("admin_set_quota"),
+)
+register_view(
+    inviteonly_bp,
+    routes=["/admin/quota"],
+    view_func=AdminGrantQuota.as_view("admin_grant_quota"),
+)
+register_view(
+    inviteonly_bp,
+    routes=["/<int:invite_id>/revoke"],
+    view_func=RevokeInvite.as_view("revoke_invite"),
+)
+register_view(
+    inviteonly_bp,
+    routes=["/<code>"],
+    view_func=RegisterWithInvite.as_view("register_with_invite"),
+)