feat: add login type 'none' to prevent login

Users with this login type must use tokens to authenticate. Tokens must come from some other source, not a /login with password authentication
coder · Emyrk · Jun 14, 2023 · Jun 13, 2023 · Jun 13, 2023 · Jun 13, 2023
commit 22f0fa7ea76f4ed956d5fc2bad15b8148ce966df
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/users.go b/coderd/users.go
@@ -351,21 +351,34 @@ func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	err = userpassword.Validate(req.Password)
-	if err != nil {
+	if req.DisableLogin && req.Password != "" {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Password not strong enough!",
-			Validations: []codersdk.ValidationError{{
-				Field:  "password",
-				Detail: err.Error(),
-			}},
+			Message: "Cannot set password when disabling login.",
 		})
 		return
 	}
 
+	var loginType database.LoginType = "unknown"
+	if req.DisableLogin {
+		loginType = database.LoginTypeNone
+	} else {
+		err = userpassword.Validate(req.Password)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Password not strong enough!",
+				Validations: []codersdk.ValidationError{{
+					Field:  "password",
+					Detail: err.Error(),
+				}},
+			})
+			return
+		}
+		loginType = database.LoginTypePassword
+	}
+
 	user, _, err := api.CreateUser(ctx, api.Database, CreateUserRequest{
 		CreateUserRequest: req,
-		LoginType:         database.LoginTypePassword,
+		LoginType:         loginType,
 	})
 	if dbauthz.IsNotAuthorizedError(err) {
 		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

diff --git a/codersdk/users.go b/codersdk/users.go
@@ -66,9 +66,12 @@ type CreateFirstUserResponse struct {
 }
 
 type CreateUserRequest struct {
-	Email          string    `json:"email" validate:"required,email" format:"email"`
-	Username       string    `json:"username" validate:"required,username"`
-	Password       string    `json:"password" validate:"required"`
+	Email    string `json:"email" validate:"required,email" format:"email"`
+	Username string `json:"username" validate:"required,username"`
+	Password string `json:"password" validate:"required"`
+	// DisableLogin sets the user's login type to 'none'. This prevents the user
+	// from being able to use a password or any other authentication method to login.
+	DisableLogin   bool      `json:"disable_login"`
 	OrganizationID uuid.UUID `json:"organization_id" validate:"" format:"uuid"`
 }