feat: setting to force oauth2/oidc login & refactor

[kpodp0ra]

This change does not affect normal installations by default. However, by setting PASSWORD_LOGIN_DISABLED=true, all endpoints related to password-based login can be disabled.

This feature is intended for scenarios where you want users to authenticate exclusively through OIDC or other OAuth2 providers, ensuring centralized password management and enabling features like obligatory two-factor authentication. Disabling endpoints also prevents users from bypassing OAuth by setting their own passwords.

If there is only one OAuth provider configured, the program will automatically redirect users to it during login. If multiple OAuth providers are configured, the normal table page will appear, but the login form will be hidden.

[kpodp0ra]

To avoid circular dependencies, I've created SessionService with .signout() function as it was used by global auth controller and also the password one.

teable/apps/nestjs-backend/src/features/auth/auth.controller.ts

Lines 36 to 41 in e6c7fd9

	@Post('signout')
	@HttpCode(200)
	async signout(@Req() req: Express.Request, @Res({ passthrough: true }) res: Response) {
	await this.authService.signout(req);
	res.clearCookie(AUTH_SESSION_COOKIE_NAME);
	}

teable/apps/nestjs-backend/src/features/auth/auth.controller.ts

Lines 71 to 80 in e6c7fd9

	@Patch('/change-password')
	async changePassword(
	@Body(new ZodValidationPipe(changePasswordRoSchema)) changePasswordRo: IChangePasswordRo,
	@Req() req: Request,
	@Res({ passthrough: true }) res: Response
	) {
	await this.authService.changePassword(changePasswordRo);
	await this.authService.signout(req);
	res.clearCookie(AUTH_SESSION_COOKIE_NAME);
	}

Tested:

• login
• register
• change password
• forget password

Everything seems to work.