Disable password change if password login is disabled

[Kogoro]

Describe the feature you'd like

When using an OAuth provider and disabling the password based login, I would expect that the change password form in the settings page is also disabled.

Describe the benefits this would bring to existing Hoarder users

Consistent behavior with oauth provider.

Can the goal of this request already be achieved via other means?

An alternative would be a separate environment variable for the like for signup or password-based login. Nevertheless, I would not think that it would be that great.

Have you searched for an existing open/closed issue?

• I have searched for existing issues and none cover my fundamental request

Additional context

First time user and therefore there is a possibility that I did not find the correct information. In this case, excuse my foolish request.

[kamtschatka]

I already tried to add that before, but it was patched out(cd07adb), so looks like this is intended

[MohamedBassem]

@kamtschatka that commit that you're pointing at only removes the message as it didn't look good. The functionality of hiding the form remained. So, no. This is not expected or intentional and it's indeed a bug.

[kamtschatka]

ok my bad, i thought that was the preparation to revert all of it.
But why would you intentionally keep users in the dark why they can't change their password or email address, when we already have users who struggle to find the most basic functionality in hoarder?

[MohamedBassem]

@kamtschatka When we get to it, we can decide how we want to communicate this to the users. We can also disable the "Save" button with a tooltip explaining why, etc.

[MohamedBassem]

@claude Implement this feature for me

[claude]

Claude finished @MohamedBassem's task —— View job • claude/issue-784-20250712_151609 • Create PR ➔

---

Implementation Complete ✅

I've successfully implemented the feature to disable password change functionality when password-based login is disabled.

Todo List:

• Read repository guidelines and understand project structure
• Find the password change form in settings page
• Locate password-based login configuration logic
• Implement conditional logic to disable password change form
• Add user-friendly messaging for disabled state
• Run linting and type checking (Requires bash permissions - please run pnpm typecheck and pnpm lint locally)
• Test the implementation
• Commit and push changes

Changes Made:

• Modified apps/web/components/settings/ChangePassword.tsx to check clientConfig.auth.disablePasswordAuth
• When password auth is disabled, shows an Alert with Lock icon and message: "Password authentication is currently disabled."
• When enabled, shows the normal password change form
• Follows the same pattern used in other components like CredentialsForm.tsx

How it works:

1. The component now imports and uses useClientConfig() hook
2. Checks clientConfig.auth.disablePasswordAuth flag
3. Conditionally renders either:
   • An Alert with disabled message (when password auth is disabled)
   • The normal password change form (when password auth is enabled)

This ensures consistent behavior when OAuth providers are configured and password authentication is disabled via the DISABLE_PASSWORD_AUTH environment variable.

Note: Please run pnpm typecheck and pnpm lint locally to verify the changes before merging.

[MohamedBassem]

@claude The FR is that if the user is an oauth user (doesn't have a password), we're supposed to not show them a password rest fields in the user info page.

[claude]

Claude finished @MohamedBassem's task —— View job • claude/issue-784-20250712_152528 • Create PR ➔

---

I understand the clarification! The feature should check if the current user is an OAuth user (doesn't have a password) rather than using a global configuration flag.

Todo List

• Understand current implementation and find password change form
• Research how to detect if user is OAuth user (has no password)
• Extend whoami endpoint to include localUser field
• Fix password change form to check user's authentication type
• Test the corrected implementation (Note: Cannot run pnpm typecheck and pnpm lint due to environment limitations - please run these locally)
• Commit and push the corrected changes

✅ Implementation Complete

I've successfully corrected the implementation to properly detect OAuth users vs local users and conditionally hide the password change form.

Changes Made

Extended zWhoAmIResponseSchema in packages/shared/types/users.ts:38

• Added localUser: z.boolean() field

Updated whoami tRPC endpoint in packages/trpc/routers/users.ts:298-315

• Fetch password field from database
• Return localUser: userDb.password !== null

Modified ChangePassword component in apps/web/components/settings/ChangePassword.tsx:77-84

• Import Alert components and Shield icon
• Use api.users.whoami.useQuery() to get user info
• Conditionally render Alert message for OAuth users (userInfo?.localUser === false)
• Show normal password form for local users

How it works

• OAuth users: See an Alert with Shield icon and message "Password changes are not available for OAuth users. You are currently signed in with an external provider."
• Local users: See the normal password change form
• Loading state: While user info loads, the form is hidden (graceful handling)

Testing Notes

Please run pnpm typecheck and pnpm lint locally to verify the changes. The implementation follows the same pattern used elsewhere in the codebase for detecting user authentication type.