Ruben Fiszel 0cfa131254 feat: add disable_password_login global setting (#8873) ...

Adds an instance-level toggle that hides the email/password form on the
login page and rejects password login, password reset request, and
password reset endpoints server-side. Useful for OAuth/SAML-only
deployments.

- New `disable_password_login` global setting + lazy_static AtomicBool
- `load_disable_password_login` loader wired into monitor initial_load
  and notify_global_setting_change listener
- Unauthenticated `GET /auth/is_password_login_disabled` endpoint so the
  login page can hide the password form when enabled
- Toggle in Instance Settings → Auth/OAuth/SAML
- Login.svelte hides the password form and the "Log in without
  third-party" toggle when the setting is on

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-17 18:12:30 +00:00

..

src

feat: add disable_password_login global setting (#8873)

2026-04-17 18:12:30 +00:00

Cargo.toml

rate limit token creation on CLOUD_HOSTED (10/min per user) (#8664)

2026-04-02 01:52:02 +00:00