From 1f4f439f4c720841281277eb9208bc19c86b7247 Mon Sep 17 00:00:00 2001
From: Maksim Eltyshev <meltyshev@gmail.com>
Date: Wed, 14 Jan 2026 14:11:21 +0100
Subject: [PATCH] feat: Add demo mode with restricted user actions

---
 docker-compose-dev.yml                          | 1 +
 docker-compose.yml                              | 1 +
 server/.env.sample                              | 1 +
 server/api/controllers/users/update-email.js    | 6 +++++-
 server/api/controllers/users/update-password.js | 6 +++++-
 server/api/controllers/users/update-username.js | 2 +-
 server/api/controllers/users/update.js          | 2 +-
 server/api/helpers/users/present-one.js         | 4 +++-
 server/config/custom.js                         | 1 +
 9 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index 771e9e27..7bb728a6 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -44,6 +44,7 @@ services:
       # - STORAGE_LIMIT=
       # - ACTIVE_USER_LIMIT=
       # - CUSTOMER_PANEL_URL=
+      # - DEMO_MODE=true
 
       # Set to true to show more detailed authentication error messages.
       # It should not be enabled without a rate limiter for security reasons.
diff --git a/docker-compose.yml b/docker-compose.yml
index bc5f65f3..28c8b17b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -58,6 +58,7 @@ services:
       # - STORAGE_LIMIT=
       # - ACTIVE_USER_LIMIT=
       # - CUSTOMER_PANEL_URL=
+      # - DEMO_MODE=true
 
       # Set to true to show more detailed authentication error messages.
       # It should not be enabled without a rate limiter for security reasons.
diff --git a/server/.env.sample b/server/.env.sample
index d7bf6d91..b28cdb29 100644
--- a/server/.env.sample
+++ b/server/.env.sample
@@ -35,6 +35,7 @@ SECRET_KEY=notsecretkey
 # STORAGE_LIMIT=
 # ACTIVE_USER_LIMIT=
 # CUSTOMER_PANEL_URL=
+# DEMO_MODE=true
 
 # Set to true to show more detailed authentication error messages.
 # It should not be enabled without a rate limiter for security reasons.
diff --git a/server/api/controllers/users/update-email.js b/server/api/controllers/users/update-email.js
index 87f586fa..ec239883 100644
--- a/server/api/controllers/users/update-email.js
+++ b/server/api/controllers/users/update-email.js
@@ -134,7 +134,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 
diff --git a/server/api/controllers/users/update-password.js b/server/api/controllers/users/update-password.js
index 9467d81c..35f1edad 100644
--- a/server/api/controllers/users/update-password.js
+++ b/server/api/controllers/users/update-password.js
@@ -136,7 +136,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 
diff --git a/server/api/controllers/users/update-username.js b/server/api/controllers/users/update-username.js
index f402e6df..4d8ceb42 100644
--- a/server/api/controllers/users/update-username.js
+++ b/server/api/controllers/users/update-username.js
@@ -132,7 +132,7 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 
diff --git a/server/api/controllers/users/update.js b/server/api/controllers/users/update.js
index 415f9c1b..cd165f39 100755
--- a/server/api/controllers/users/update.js
+++ b/server/api/controllers/users/update.js
@@ -244,7 +244,7 @@ module.exports = {
     }
 
     // TODO: refactor
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       if (inputs.role || inputs.name) {
         throw Errors.NOT_ENOUGH_RIGHTS;
       }
diff --git a/server/api/helpers/users/present-one.js b/server/api/helpers/users/present-one.js
index 7fa9d447..31ef9f61 100644
--- a/server/api/helpers/users/present-one.js
+++ b/server/api/helpers/users/present-one.js
@@ -53,7 +53,9 @@ module.exports = {
         const isDefaultAdmin = inputs.record.email === sails.config.custom.defaultAdminEmail;
 
         const lockedFieldNames = [];
-        if (isDefaultAdmin || inputs.record.isSsoUser) {
+        if (sails.config.custom.demoMode) {
+          lockedFieldNames.push('email', 'password', 'role', 'name', 'username');
+        } else if (isDefaultAdmin || inputs.record.isSsoUser) {
           lockedFieldNames.push('email', 'password', 'name');
 
           if (isDefaultAdmin) {
diff --git a/server/config/custom.js b/server/config/custom.js
index b780b3b2..32569b44 100644
--- a/server/config/custom.js
+++ b/server/config/custom.js
@@ -63,6 +63,7 @@ module.exports.custom = {
   storageLimit: envToBytes(process.env.STORAGE_LIMIT),
   activeUserLimit: envToNumber(process.env.ACTIVE_USER_LIMIT),
   customerPanelUrl: process.env.CUSTOMER_PANEL_URL,
+  demoMode: process.env.DEMO_MODE === 'true',
 
   showDetailedAuthErrors: process.env.SHOW_DETAILED_AUTH_ERRORS === 'true',