no-password

backend/src/routes/auth.rs

@@ -21,7 +21,7 @@ use crate::{
             AuthenticationChallengeResponse, PasskeyLoginFinishPayload, PasskeyLoginStartPayload,
             PasskeyRegistrationFinishPayload, PasskeySummary, RegistrationChallengeResponse,
         },
-        password, AuthenticatedUser,
+        AuthenticatedUser,
     },
     error::{AppError, AppResult},
     models::{NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus, User, UserMembership},
@@ -93,30 +93,10 @@ pub struct SignupFinishRequest {
     pub nickname: Option<String>,
 }
 
-pub async fn login(
-    State(state): State<AppState>,
-    Json(payload): Json<LoginRequest>,
-) -> AppResult<Response> {
-    let mut conn = state.db_unscoped()?;
-
-    let user: Option<User> = dsl::users
-        .filter(dsl::username.eq(&payload.username))
-        .first(&mut conn)
-        .optional()?;
-
-    let user = match user {
-        Some(user) => user,
-        None => return Err(AppError::unauthorized()),
-    };
-
-    let valid = password::verify_password(&payload.password, &user.password_hash)
-        .map_err(|_| AppError::unauthorized())?;
-
-    if !valid {
-        return Err(AppError::unauthorized());
-    }
-
-    complete_login(&state, &mut conn, &user, payload.preferred_tenant_id)
+pub async fn login(_state: State<AppState>, _payload: Json<LoginRequest>) -> AppResult<Response> {
+    Err(AppError::bad_request(
+        "password authentication is no longer supported",
+    ))
 }
 
 pub async fn signup_start(
@@ -186,9 +166,7 @@ pub async fn signup_finish(
 
     let state_clone = state.clone();
     let response = conn.transaction::<Response, AppError, _>(|conn| {
-        let password_seed = format!("passkey-only-{}", claims.sub);
-        let password_hash = password::hash_password(&password_seed)?;
-        insert_user(conn, claims.sub, &claims.username, &password_hash)?;
+        insert_user(conn, claims.sub, &claims.username)?;
 
         let tenant = state_clone.tenants.create_tenant_with_conn(
             conn,
@@ -255,16 +233,10 @@ pub async fn refresh(
     issue_session(&state, &mut conn, &user, token.tenant_id)
 }
 
-fn insert_user(
-    conn: &mut PgConnection,
-    id: Uuid,
-    username: &str,
-    password_hash: &str,
-) -> AppResult<()> {
+fn insert_user(conn: &mut PgConnection, id: Uuid, username: &str) -> AppResult<()> {
     let new_user = NewUser {
         id,
         username: username.to_string(),
-        password_hash: password_hash.to_string(),
     };
 
     diesel::insert_into(dsl::users)