* feat: add option to disable password login
Adds a global admin setting to hide the username/password form on the
login page, useful for deployments that rely solely on SSO/OIDC or
passkeys. The form defaults to enabled so existing deployments are
unaffected.
Changes:
- Add PASSWORD_LOGIN_ENABLED_KEY constant
- Add isPasswordLoginEnabled / setPasswordLoginEnabled to system service
(defaults to true when no DB record exists)
- Add GET/PUT /api/v1/system/password-login-status endpoints (GET
auth-gated for admin use; setting is exposed to the login page via
the existing getLoginOptions server function)
- Extend getLoginOptions to include passwordLoginEnabled
- Conditionally render the password login form in LoginPage
- Add "Enable password login" toggle in the admin System Settings tab,
next to "Enable new user registrations"
- Add corresponding entries to generated API client files
(types.gen.ts, sdk.gen.ts, @tanstack/react-query.gen.ts)
Closes#941
* fix(login): show errors even if password is disabled
* feat(cli): add command to re-enable password
---------
Co-authored-by: Nicolas Meienberger <github@thisprops.com>
* refactor(auth): mark desktop sessions with auth source
Makes it easier to filter out on session type in backend paths that
behave differently depending on the context
* chore: fix un-used import
* fix(auth): align desktop session guards
* refactor(auth): gate desktop sessions by runtime features
* chore: migrate to vitest
* test: speed up some suites by sharing sessions and mocking expensive non-tested actions
* test: refactor some tests to verify behavior instead of implementation details
* chore: fix linting issues
test: use better-auth built-in test plugin
refactor: map auth errors server side
refactor: native trusted providers callback usage
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Enhanced SSO authentication error messaging with specific guidance for different failure scenarios (account linking required, email verification needed, banned accounts, invite-only access).
* **Chores**
* Updated authentication dependencies to version 1.5.0.
* **Tests**
* Extended test coverage for SSO error code handling and authentication scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* test: backups service
* refactor: create hono app in a separate file
To avoid side effects like db migration or startup scripts when testing
test(backups): add security tests to the backups controller
* ci: run typechecks, build and tests on PR
* test: controllers security tests
* chore: update lock file
* refactor: pr feedbacks
