Skip to content

Add DisableEmailPasswordLogin setting for Microsoft-only sign-in #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hamzahalq merged 1 commit into from
Jul 23, 2026
Merged

Add DisableEmailPasswordLogin setting for Microsoft-only sign-in #230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions SW.Bitween.Api/Resources/Accounts/Create.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,28 +12,34 @@ public class Create : ICommandHandler<CreateAccountModel,object>
{
private readonly BitweenDbContext dbContext;
private readonly RequestContext _requestContext;
private readonly BitweenOptions _bitweenOptions;

public Create(BitweenDbContext dbContext, RequestContext requestContext)
public Create(BitweenDbContext dbContext, RequestContext requestContext, BitweenOptions bitweenOptions)
{
this.dbContext = dbContext;
_requestContext = requestContext;
_bitweenOptions = bitweenOptions;
}

public async Task<object> Handle(CreateAccountModel request)
{
_requestContext.EnsureAccess(AccountRole.Admin);

if (string.IsNullOrEmpty(request.Name) || string.IsNullOrEmpty(request.Email) ||
string.IsNullOrEmpty(request.Password))
(!_bitweenOptions.DisableEmailPasswordLogin && string.IsNullOrEmpty(request.Password)))
throw new SWValidationException("INVALID_PAYLOAD", "The payload is invalid");

if (await dbContext.Set<Account>().AnyAsync(a => a.Email == request.Email))
throw new SWValidationException("ACCOUNT_EXISTS", $"Account with email {request.Email} exists");

var password = _bitweenOptions.DisableEmailPasswordLogin
? null
: SecurePasswordHasher.Hash(request.Password);

var newAccount = new Account(
request.Name,
request.Email,
SecurePasswordHasher.Hash(request.Password),
password,
Comment on lines +35 to +42

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n -C3 '<Nullable>|Password|IsRequired' \
  --glob '*.csproj' --glob '*.cs' --glob '*.sql' SW.Bitween.Api

Repository: simplify9/Bitween-api

Length of output: 29759

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Project files:\n'
git ls-files '*.*proj' | sed -n '1,80p'

printf '\nSW.Bitween.Api.csproj:\n'
cat -n SW.Bitween.Api/SW.Bitween.Api.csproj

printf '\nAccount.cs:\n'
cat -n SW.Bitween.Api/Domain/Accounts/Account.cs | sed -n '1,80p'

printf '\nDbContext Account mapping relevant lines:\n'
cat -n SW.Bitween.Api/Data/BitweenDbContext.cs | sed -n '330,375p'

printf '\nMigrations mentioning Password field/column/constraint:\n'
git ls-files | grep -E '(^|/Migrations/.*\.cs$|\.sql$|\.md$)' | xargs rg -n -i 'password|account' --glob '*.cs' --glob '*.sql' --glob '*.md' | sed -n '1,220p'

Repository: simplify9/Bitween-api

Length of output: 47971

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Project files:\n'
git ls-files '*.*proj' | sed -n '1,80p'

printf '\nSW.Bitween.Api.csproj:\n'
cat -n SW.Bitween.Api/SW.Bitween.Api.csproj

printf '\nAccount.cs:\n'
cat -n SW.Bitween.Api/Domain/Accounts/Account.cs | sed -n '1,80p'

printf '\nDbContext Account mapping relevant lines:\n'
cat -n SW.Bitween.Api/Data/BitweenDbContext.cs | sed -n '330,375p'

printf '\nMigrations mentioning Password field/column/constraint:'
git ls-files | grep -E '(^|/Migrations/.*\.cs$|\.sql$|\.md$)' | xargs rg -n -i 'password|account' --glob '*.cs' --glob '*.sql' --glob '*.md' | sed -n '1,220p'

Repository: simplify9/Bitween-api

Length of output: 47903

Make Password nullable before passing null into Account.

Account’s constructor and Password are non-nullable string. EF mapping leaves Accounts.Password nullable, but the model still allows null while other paths like SetPassword/Login still expect a hash. Change the domain property/constructor contract to string? and add an out-of-band migration if deployed schemas don’t allow null yet.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SW.Bitween.Api/Resources/Accounts/Create.cs` around lines 35 - 42, Update the
Account domain property and constructor contract to use nullable string types
for Password, allowing Create to pass null when DisableEmailPasswordLogin is
enabled. Preserve existing SetPassword and Login behavior for accounts with
hashes, and add the required migration separately if deployed schemas still
enforce a non-null Accounts.Password column.

(AccountRole)request.Role);
dbContext.Add(newAccount);

Expand All @@ -44,11 +50,11 @@ public async Task<object> Handle(CreateAccountModel request)

private class Validate : AbstractValidator<CreateAccountModel>
{
public Validate()
public Validate(BitweenOptions bitweenOptions)
{
RuleFor(i => i.Name).NotEmpty();
RuleFor(i => i.Email).NotEmpty();
RuleFor(i => i.Password).NotEmpty();
RuleFor(i => i.Password).NotEmpty().When(_ => !bitweenOptions.DisableEmailPasswordLogin);
RuleFor(i => i.Role).NotNull();
}
}
Expand Down
7 changes: 7 additions & 0 deletions SW.Bitween.Api/Resources/Accounts/Login.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,13 @@ public async Task<object> Handle(UserLogin request)
}
}

if (string.IsNullOrEmpty(refreshTokenValue) && string.IsNullOrEmpty(request.MsToken) &&
_BitweenSettings.DisableEmailPasswordLogin)
{
_logger.LogWarning("Email/password login attempt rejected: DisableEmailPasswordLogin is enabled.");
throw new SWException("Email and password login is disabled. Please sign in with Microsoft.");
}

if (!string.IsNullOrEmpty(refreshTokenValue))
{
// account query already filtered above
Expand Down
1 change: 1 addition & 0 deletions SW.Bitween.Api/Resources/Settings/Config.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ public async Task<object> Handle()
_BitweenOptions.MsalClientId,
_BitweenOptions.MsalRedirectUri,
_BitweenOptions.MsalTenantId,
_BitweenOptions.DisableEmailPasswordLogin,
IsRabbitMqManagementConfigured = !string.IsNullOrWhiteSpace(_BitweenOptions.RabbitMqManagementUrl)
&& !string.IsNullOrWhiteSpace(_BitweenOptions.RabbitMqManagementUsername)
&& !string.IsNullOrWhiteSpace(_BitweenOptions.RabbitMqManagementPassword),
Expand Down
8 changes: 8 additions & 0 deletions SW.Bitween.Api/Services/BitweenOptions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@ public BitweenOptions()
public string MsalRedirectUri { get; set; }

public string MsalTenantId { get; set; }

/// <summary>
/// When true, disables email/password login and account creation with a password.
/// Only Microsoft (MSAL) login is allowed: the login page hides the email/password
/// form, new accounts are created without a password, and the Login handler rejects
/// any email/password login attempt outright.
/// </summary>
public bool DisableEmailPasswordLogin { get; set; }
public int JwtExpiryMinutes { get; set; }
public bool ConsumeLegacyEventMessages { get; set; }
public string QueuePrefix { get; set; }
Expand Down
Loading