no-password

backend/src/bin/admin.rs

@@ -7,7 +7,6 @@ use reqwest::{Client, Method, StatusCode};
 use uuid::Uuid;
 
 use backend::{
-    auth::password,
     config::AppConfig,
     db::{self, PgPool},
     documents::search::ensure_quickwit_index,
@@ -28,11 +27,6 @@ use backend::{
 enum Command {
     CreateUser {
         username: String,
-        password: String,
-    },
-    SetPassword {
-        username: String,
-        password: String,
     },
     ListUsers,
     DeleteUser {
@@ -66,8 +60,7 @@ enum Command {
 impl Command {
     fn usage() -> &'static str {
         "Usage: admin\n\
-            create-user <username> <password>\n\
-            set-password <username> <password>\n\
+            create-user <username>\n\
             list-users\n\
             delete-user <username>\n\
             create-tenant <name> [storage_root] [quickwit_index]\n\
@@ -91,11 +84,6 @@ impl Command {
         match args.next().as_deref() {
             Some("create-user") => Ok(Self::CreateUser {
                 username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                password: args.next().ok_or_else(|| anyhow!("password required"))?,
-            }),
-            Some("set-password") => Ok(Self::SetPassword {
-                username: args.next().ok_or_else(|| anyhow!("username required"))?,
-                password: args.next().ok_or_else(|| anyhow!("password required"))?,
             }),
             Some("list-users") => Ok(Self::ListUsers),
             Some("delete-user") => Ok(Self::DeleteUser {
@@ -141,8 +129,7 @@ async fn main() -> Result<()> {
     let pool = db::init_pool_with_size(&config.database_url, config.database_max_pool_size)?;
 
     match command {
-        Command::CreateUser { username, password } => create_user(&pool, &username, &password)?,
-        Command::SetPassword { username, password } => set_password(&pool, &username, &password)?,
+        Command::CreateUser { username } => create_user(&pool, &username)?,
         Command::ListUsers => list_users(&pool)?,
         Command::DeleteUser { username } => delete_user(&pool, &username)?,
         Command::CreateTenant {
@@ -175,13 +162,10 @@ async fn main() -> Result<()> {
     Ok(())
 }
 
-fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
+fn create_user(pool: &PgPool, username: &str) -> Result<()> {
     if username.trim().is_empty() {
         bail!("username must not be empty");
     }
-    if password.is_empty() {
-        bail!("password must not be empty");
-    }
 
     let mut conn = pool.get().context("failed to get database connection")?;
     let exists: bool =
@@ -190,11 +174,9 @@ fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
         bail!("user '{}' already exists", username);
     }
 
-    let password_hash = password::hash_password(password).map_err(|err| anyhow!(err))?;
     let new_user = NewUser {
         id: Uuid::new_v4(),
         username: username.to_string(),
-        password_hash,
     };
 
     diesel::insert_into(users::table)
@@ -205,26 +187,6 @@ fn create_user(pool: &PgPool, username: &str, password: &str) -> Result<()> {
     Ok(())
 }
 
-fn set_password(pool: &PgPool, username: &str, password: &str) -> Result<()> {
-    if password.is_empty() {
-        bail!("password must not be empty");
-    }
-
-    let mut conn = pool.get().context("failed to get database connection")?;
-    let password_hash = password::hash_password(password).map_err(|err| anyhow!(err))?;
-
-    let updated = diesel::update(users::table.filter(users::username.eq(username)))
-        .set(users::password_hash.eq(password_hash))
-        .execute(&mut conn)?;
-
-    if updated == 0 {
-        bail!("user '{}' not found", username);
-    }
-
-    println!("updated password for '{}'", username);
-    Ok(())
-}
-
 fn list_users(pool: &PgPool) -> Result<()> {
     let mut conn = pool.get().context("failed to get database connection")?;
 

backend/src/models.rs

@@ -112,7 +112,6 @@ pub struct Tenant {
 pub struct User {
     pub id: Uuid,
     pub username: String,
-    pub password_hash: String,
     pub created_at: NaiveDateTime,
     pub updated_at: NaiveDateTime,
 }
@@ -122,7 +121,6 @@ pub struct User {
 pub struct NewUser {
     pub id: Uuid,
     pub username: String,
-    pub password_hash: String,
 }
 
 #[derive(Debug, Clone, Queryable, Identifiable, Associations, Selectable)]

backend/src/routes/auth.rs

@@ -21,7 +21,7 @@ use crate::{
             AuthenticationChallengeResponse, PasskeyLoginFinishPayload, PasskeyLoginStartPayload,
             PasskeyRegistrationFinishPayload, PasskeySummary, RegistrationChallengeResponse,
         },
-        password, AuthenticatedUser,
+        AuthenticatedUser,
     },
     error::{AppError, AppResult},
     models::{NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus, User, UserMembership},
@@ -93,30 +93,10 @@ pub struct SignupFinishRequest {
     pub nickname: Option<String>,
 }
 
-pub async fn login(
-    State(state): State<AppState>,
-    Json(payload): Json<LoginRequest>,
-) -> AppResult<Response> {
-    let mut conn = state.db_unscoped()?;
-
-    let user: Option<User> = dsl::users
-        .filter(dsl::username.eq(&payload.username))
-        .first(&mut conn)
-        .optional()?;
-
-    let user = match user {
-        Some(user) => user,
-        None => return Err(AppError::unauthorized()),
-    };
-
-    let valid = password::verify_password(&payload.password, &user.password_hash)
-        .map_err(|_| AppError::unauthorized())?;
-
-    if !valid {
-        return Err(AppError::unauthorized());
-    }
-
-    complete_login(&state, &mut conn, &user, payload.preferred_tenant_id)
+pub async fn login(_state: State<AppState>, _payload: Json<LoginRequest>) -> AppResult<Response> {
+    Err(AppError::bad_request(
+        "password authentication is no longer supported",
+    ))
 }
 
 pub async fn signup_start(
@@ -186,9 +166,7 @@ pub async fn signup_finish(
 
     let state_clone = state.clone();
     let response = conn.transaction::<Response, AppError, _>(|conn| {
-        let password_seed = format!("passkey-only-{}", claims.sub);
-        let password_hash = password::hash_password(&password_seed)?;
-        insert_user(conn, claims.sub, &claims.username, &password_hash)?;
+        insert_user(conn, claims.sub, &claims.username)?;
 
         let tenant = state_clone.tenants.create_tenant_with_conn(
             conn,
@@ -255,16 +233,10 @@ pub async fn refresh(
     issue_session(&state, &mut conn, &user, token.tenant_id)
 }
 
-fn insert_user(
-    conn: &mut PgConnection,
-    id: Uuid,
-    username: &str,
-    password_hash: &str,
-) -> AppResult<()> {
+fn insert_user(conn: &mut PgConnection, id: Uuid, username: &str) -> AppResult<()> {
     let new_user = NewUser {
         id,
         username: username.to_string(),
-        password_hash: password_hash.to_string(),
     };
 
     diesel::insert_into(dsl::users)

backend/src/schema.rs

@@ -205,8 +205,6 @@ diesel::table! {
         id -> Uuid,
         #[max_length = 100]
         username -> Varchar,
-        #[max_length = 255]
-        password_hash -> Varchar,
         created_at -> Timestamptz,
         updated_at -> Timestamptz,
     }