← Changelog
v2.7Feature18 April 2026

Public self-signup + admin kill-switch

/signup is now a four-step wizard that creates a TRIAL organisation and sends the OWNER invitation. Honeypot + per-IP rate limit. Kill-switch from admin if needed.

Major changes

  • /signup wizard (4 steps): hotel details, OWNER user details, chosen trial plan, confirmation. Creates Organization + User + password invitation in one transaction.
  • Anti-abuse: honeypot field + per-IP rate limit (Upstash Redis with in-memory fallback). Blocks bot signups without a visible captcha for real users.
  • Admin kill-switch: SUPERADMIN can disable self-signup from /admin/signup with a toggle. Useful when we need to pause for capacity or plan iteration.
  • Odoo Appointments link: if the user prefers an assisted demo instead of self-signup, the flow offers a link to an Odoo calendar (configurable from /admin/signup).
  • DEMO email: clear invitation with token TTL, tenant branding when configured.