From 10d2a7d52fd6c59a1d3628ef5b0025728c053788 Mon Sep 17 00:00:00 2001
From: pat-s <patrick.schratz@gmail.com>
Date: Fri, 14 Aug 2026 13:10:38 +0000
Subject: [PATCH 1/4] feat(auth): add SSO-only login mode

---
 cmd/config.go                                 | 20 +++++++++
 cmd/config_test.go                            | 41 +++++++++++++++++++
 cmd/login.go                                  |  8 ++++
 config.sample.toml                            |  6 +++
 .../main/src/views/auth/UserLoginView.vue     |  8 +++-
 5 files changed, 81 insertions(+), 2 deletions(-)
 create mode 100644 cmd/config_test.go

diff --git a/cmd/config.go b/cmd/config.go
index 8a04a219..e354ab9d 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -4,9 +4,28 @@ import (
 	"encoding/json"
 
 	"github.com/abhinavxd/libredesk/internal/envelope"
+	oidcmodels "github.com/abhinavxd/libredesk/internal/oidc/models"
 	"github.com/zerodha/fastglue"
 )
 
+const localLoginEnabledKey = "auth.local_login_enabled"
+
+// isLocalLoginEnabled keeps local login available by default and whenever no
+// OIDC provider is enabled, preventing an administrator from locking everyone out.
+func isLocalLoginEnabled(providers []oidcmodels.OIDC) bool {
+	if !ko.Exists(localLoginEnabledKey) || ko.Bool(localLoginEnabledKey) {
+		return true
+	}
+
+	for _, provider := range providers {
+		if provider.Enabled {
+			return false
+		}
+	}
+
+	return true
+}
+
 // handleGetConfig returns the public configuration needed for app initialization, this includes minimal app settings and enabled SSO providers (without secrets).
 func handleGetConfig(r *fastglue.Request) error {
 	var app = r.Context.(*App)
@@ -58,6 +77,7 @@ func handleGetConfig(r *fastglue.Request) error {
 
 	// Add SSO providers to the response
 	publicSettings["app.sso_providers"] = enabledProviders
+	publicSettings["app.local_login_enabled"] = isLocalLoginEnabled(oidcProviders)
 
 	return r.SendEnvelope(publicSettings)
 }
diff --git a/cmd/config_test.go b/cmd/config_test.go
new file mode 100644
index 00000000..fcca43fa
--- /dev/null
+++ b/cmd/config_test.go
@@ -0,0 +1,41 @@
+package main
+
+import (
+	"testing"
+
+	oidcmodels "github.com/abhinavxd/libredesk/internal/oidc/models"
+)
+
+func TestIsLocalLoginEnabled(t *testing.T) {
+	tests := []struct {
+		name       string
+		configured *bool
+		providers  []oidcmodels.OIDC
+		want       bool
+	}{
+		{name: "defaults to enabled", want: true},
+		{name: "remains enabled when configured", configured: boolPointer(true), want: true},
+		{name: "remains enabled without an enabled OIDC provider", configured: boolPointer(false), providers: []oidcmodels.OIDC{{Enabled: false}}, want: true},
+		{name: "is disabled with an enabled OIDC provider", configured: boolPointer(false), providers: []oidcmodels.OIDC{{Enabled: true}}, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ko.Delete(localLoginEnabledKey)
+			if tt.configured != nil {
+				if err := ko.Set(localLoginEnabledKey, *tt.configured); err != nil {
+					t.Fatalf("set config: %v", err)
+				}
+			}
+			t.Cleanup(func() { ko.Delete(localLoginEnabledKey) })
+
+			if got := isLocalLoginEnabled(tt.providers); got != tt.want {
+				t.Fatalf("isLocalLoginEnabled() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func boolPointer(value bool) *bool {
+	return &value
+}
diff --git a/cmd/login.go b/cmd/login.go
index 2cf3968e..c20ab830 100644
--- a/cmd/login.go
+++ b/cmd/login.go
@@ -21,6 +21,14 @@ func handleLogin(r *fastglue.Request) error {
 		loginReq loginRequest
 	)
 
+	oidcProviders, err := app.oidc.GetAll()
+	if err != nil {
+		return sendErrorEnvelope(r, err)
+	}
+	if !isLocalLoginEnabled(oidcProviders) {
+		return r.SendErrorEnvelope(fasthttp.StatusForbidden, "Local login is disabled. Sign in with an SSO provider.", nil, envelope.PermissionError)
+	}
+
 	// Decode JSON request.
 	if err := r.Decode(&loginReq, "json"); err != nil {
 		return r.SendErrorEnvelope(fasthttp.StatusBadRequest, app.i18n.T("errors.parsingRequest"), nil, envelope.InputError)
diff --git a/config.sample.toml b/config.sample.toml
index 713c01a8..b39aa2ff 100644
--- a/config.sample.toml
+++ b/config.sample.toml
@@ -34,6 +34,12 @@ read_buffer_size = 65536
 # Keepalive settings.
 keepalive_timeout = "10s"
 
+[auth]
+# Allow users to sign in with their LibreDesk email and password.
+# Disable this only after configuring and enabling at least one OIDC provider.
+# LibreDesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
+local_login_enabled = true
+
 # File upload provider to use, either `fs` or `s3`.
 [upload]
 provider = "fs"
diff --git a/frontend/apps/main/src/views/auth/UserLoginView.vue b/frontend/apps/main/src/views/auth/UserLoginView.vue
index 3cf65fd1..5ca74ff1 100644
--- a/frontend/apps/main/src/views/auth/UserLoginView.vue
+++ b/frontend/apps/main/src/views/auth/UserLoginView.vue
@@ -32,7 +32,7 @@
             {{ oidcProvider.name }}
           </Button>
 
-          <div class="relative">
+          <div v-if="localLoginEnabled" class="relative">
             <div class="absolute inset-0 flex items-center">
               <span class="w-full border-t border-border"></span>
             </div>
@@ -42,7 +42,7 @@
           </div>
         </div>
 
-        <form @submit.prevent="loginAction" class="space-y-3">
+        <form v-if="localLoginEnabled" @submit.prevent="loginAction" class="space-y-3">
           <div class="space-y-2">
             <Label for="email" class="text-muted-foreground">{{
               t('globals.terms.email')
@@ -246,6 +246,10 @@ const enabledOIDCProviders = computed(() => {
   return oidcProviders.value.filter((provider) => !provider.disabled)
 })
 
+const localLoginEnabled = computed(
+  () => appSettingsStore.public_config?.['app.local_login_enabled'] !== false
+)
+
 const emailHasError = computed(() => {
   if (!submitted.value) return false
   const email = loginForm.value.email

From 8a3efb0f787a1ae01346b2de933f22b6733545a4 Mon Sep 17 00:00:00 2001
From: pat-s <patrick.schratz@gmail.com>
Date: Fri, 14 Aug 2026 13:21:00 +0000
Subject: [PATCH 2/4] docs(auth): clarify SSO recovery path

---
 config.sample.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config.sample.toml b/config.sample.toml
index b39aa2ff..4f0bbe19 100644
--- a/config.sample.toml
+++ b/config.sample.toml
@@ -38,6 +38,7 @@ keepalive_timeout = "10s"
 # Allow users to sign in with their LibreDesk email and password.
 # Disable this only after configuring and enabling at least one OIDC provider.
 # LibreDesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
+# If an enabled provider is unavailable or misconfigured, set auth.local_login_enabled = true to restore password login.
 local_login_enabled = true
 
 # File upload provider to use, either `fs` or `s3`.

From bde1f06ec618cb117f973d64ab48e12095454e30 Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Wed, 9 Sep 2026 01:14:42 +0530
Subject: [PATCH 3/4] skip the OIDC lookup on login unless local login is
 disabled and translate the error

---
 cmd/config.go                                 | 35 ++++++++++---------
 cmd/login.go                                  | 15 ++++----
 config.sample.toml                            |  4 +--
 .../main/src/views/auth/UserLoginView.vue     |  2 +-
 i18n/en-US.json                               |  1 +
 5 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/cmd/config.go b/cmd/config.go
index e354ab9d..d0c1268a 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -10,22 +10,6 @@ import (
 
 const localLoginEnabledKey = "auth.local_login_enabled"
 
-// isLocalLoginEnabled keeps local login available by default and whenever no
-// OIDC provider is enabled, preventing an administrator from locking everyone out.
-func isLocalLoginEnabled(providers []oidcmodels.OIDC) bool {
-	if !ko.Exists(localLoginEnabledKey) || ko.Bool(localLoginEnabledKey) {
-		return true
-	}
-
-	for _, provider := range providers {
-		if provider.Enabled {
-			return false
-		}
-	}
-
-	return true
-}
-
 // handleGetConfig returns the public configuration needed for app initialization, this includes minimal app settings and enabled SSO providers (without secrets).
 func handleGetConfig(r *fastglue.Request) error {
 	var app = r.Context.(*App)
@@ -77,7 +61,24 @@ func handleGetConfig(r *fastglue.Request) error {
 
 	// Add SSO providers to the response
 	publicSettings["app.sso_providers"] = enabledProviders
-	publicSettings["app.local_login_enabled"] = isLocalLoginEnabled(oidcProviders)
+	publicSettings["auth.local_login_enabled"] = isLocalLoginEnabled(oidcProviders)
 
 	return r.SendEnvelope(publicSettings)
 }
+
+func localLoginDisabledInConfig() bool {
+	return ko.Exists(localLoginEnabledKey) && !ko.Bool(localLoginEnabledKey)
+}
+
+// isLocalLoginEnabled stays true while no OIDC provider is enabled so a misconfigured deployment cannot lock admins out.
+func isLocalLoginEnabled(providers []oidcmodels.OIDC) bool {
+	if !localLoginDisabledInConfig() {
+		return true
+	}
+	for _, provider := range providers {
+		if provider.Enabled {
+			return false
+		}
+	}
+	return true
+}
diff --git a/cmd/login.go b/cmd/login.go
index c20ab830..250cb943 100644
--- a/cmd/login.go
+++ b/cmd/login.go
@@ -21,12 +21,15 @@ func handleLogin(r *fastglue.Request) error {
 		loginReq loginRequest
 	)
 
-	oidcProviders, err := app.oidc.GetAll()
-	if err != nil {
-		return sendErrorEnvelope(r, err)
-	}
-	if !isLocalLoginEnabled(oidcProviders) {
-		return r.SendErrorEnvelope(fasthttp.StatusForbidden, "Local login is disabled. Sign in with an SSO provider.", nil, envelope.PermissionError)
+	if localLoginDisabledInConfig() {
+		oidcProviders, err := app.oidc.GetAll()
+		if err != nil {
+			return sendErrorEnvelope(r, err)
+		}
+		if !isLocalLoginEnabled(oidcProviders) {
+			return r.SendErrorEnvelope(fasthttp.StatusForbidden, app.i18n.T("auth.localLoginDisabled"), nil, envelope.PermissionError)
+		}
+		app.lo.Warn("local login is disabled in config but no OIDC provider is enabled, allowing password login")
 	}
 
 	// Decode JSON request.
diff --git a/config.sample.toml b/config.sample.toml
index 4f0bbe19..1f436192 100644
--- a/config.sample.toml
+++ b/config.sample.toml
@@ -35,9 +35,9 @@ read_buffer_size = 65536
 keepalive_timeout = "10s"
 
 [auth]
-# Allow users to sign in with their LibreDesk email and password.
+# Allow users to sign in with their libredesk email and password.
 # Disable this only after configuring and enabling at least one OIDC provider.
-# LibreDesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
+# libredesk automatically keeps local login available when no OIDC provider is enabled to prevent lockout.
 # If an enabled provider is unavailable or misconfigured, set auth.local_login_enabled = true to restore password login.
 local_login_enabled = true
 
diff --git a/frontend/apps/main/src/views/auth/UserLoginView.vue b/frontend/apps/main/src/views/auth/UserLoginView.vue
index 5ca74ff1..eb2d0c34 100644
--- a/frontend/apps/main/src/views/auth/UserLoginView.vue
+++ b/frontend/apps/main/src/views/auth/UserLoginView.vue
@@ -247,7 +247,7 @@ const enabledOIDCProviders = computed(() => {
 })
 
 const localLoginEnabled = computed(
-  () => appSettingsStore.public_config?.['app.local_login_enabled'] !== false
+  () => appSettingsStore.public_config?.['auth.local_login_enabled'] !== false
 )
 
 const emailHasError = computed(() => {
diff --git a/i18n/en-US.json b/i18n/en-US.json
index eba74bd3..15d78cd3 100644
--- a/i18n/en-US.json
+++ b/i18n/en-US.json
@@ -591,6 +591,7 @@
   "auth.invalidOrExpiredSessionClearCookie": "Invalid or expired session. Please clear your cookies and try again.",
   "auth.invalidResetLink": "Invalid reset link. Please request a new password reset link.",
   "auth.loggingIn": "Logging in...",
+  "auth.localLoginDisabled": "Password login is disabled. Sign in with your SSO provider.",
   "auth.newPassword": "New password",
   "auth.orContinueWith": "Or continue with",
   "auth.passwordRequired": "Password is required.",

From 32f814757f47a7615c81479f26d2448278769320 Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Wed, 9 Sep 2026 01:16:53 +0530
Subject: [PATCH 4/4] drop the rationale comment on isLocalLoginEnabled

---
 cmd/config.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cmd/config.go b/cmd/config.go
index d0c1268a..788bd6ba 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -70,7 +70,6 @@ func localLoginDisabledInConfig() bool {
 	return ko.Exists(localLoginEnabledKey) && !ko.Bool(localLoginEnabledKey)
 }
 
-// isLocalLoginEnabled stays true while no OIDC provider is enabled so a misconfigured deployment cannot lock admins out.
 func isLocalLoginEnabled(providers []oidcmodels.OIDC) bool {
 	if !localLoginDisabledInConfig() {
 		return true