fix(auth): 添加密码登录注册功能开关控制

[lanfunoe]

fix #2719

• 在 misc controller 中添加 password_login 和 password_register 配置项
• 为 LoginForm 组件添加密码登录按钮的条件渲染
• 为 RegisterForm 组件添加密码注册按钮的条件渲染
• 根据系统配置动态显示或隐藏相应的登录注册选项

Summary by CodeRabbit

• New Features

  • Email/password login and registration UI now show or hide based on system configuration (password login/register flags).

• Bug Fixes

  • Minor UI alignment adjustment for improved visual consistency.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Backend adds two boolean status flags: password_login and password_register. Frontend LoginForm and RegisterForm now conditionally render email/password login and registration UI based on those flags.

Changes

Cohort / File(s)	Summary
Backend Status Endpoint controller/misc.go	Added password_login and password_register fields to the GetStatus output, mapped from backend config flags.
Frontend Login UI web/src/components/auth/LoginForm.jsx	Guarded rendering of the Divider and email/username login Button behind status.password_login.
Frontend Register UI web/src/components/auth/RegisterForm.jsx	Guarded rendering of the Divider and email/username registration Button behind status.password_register.

Sequence Diagram(s)

sequenceDiagram
    participant Browser
    participant Frontend as WebApp
    participant Backend
    Browser->>Frontend: Load login/register page
    Frontend->>Backend: GET /status
    Backend-->>Frontend: { ..., password_login: bool, password_register: bool }
    Frontend->>Browser: Render UI
    alt password_login true
        Frontend->>Browser: Show email/password login controls
    else
        Frontend->>Browser: Hide email/password login controls
    end
    alt password_register true
        Frontend->>Browser: Show email/password registration controls
    else
        Frontend->>Browser: Hide email/password registration controls
    end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix: the login method cannot be displayed under the aff link. #2676 — Changes how LoginForm/RegisterForm source/check status, closely related to the new status fields and gating logic.

Suggested labels

Ready to merge

Poem

🐇
Server whispers which doors can swing,
Flags that tell the login thing,
Buttons hide and buttons show,
I hop where toggles let me go,
Tiny paws applaud the spring.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding feature toggles for password login and registration functionality across the auth system.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

web/src/components/auth/RegisterForm.jsx (1)

751-761: ⚠️ Potential issue | 🟡 Minor

Edge case: email form renders even when password_register is disabled and no OAuth providers exist.

When all OAuth providers are disabled, the fallback condition displays renderEmailRegisterForm() regardless of the password_register flag. The form will render but users cannot submit it (no backend check needed—the UX is broken). The same issue exists in LoginForm.jsx.

Add status.password_register to the fallback condition to prevent the form from displaying when the feature is disabled:

Suggested fix

         {showEmailRegister ||
-        !(
+        (!(
           status.github_oauth ||
           status.discord_oauth ||
           status.oidc_enabled ||
           status.wechat_login ||
           status.linuxdo_oauth ||
           status.telegram_oauth
-        )
+        ) && status.password_register)
           ? renderEmailRegisterForm()
           : renderOAuthOptions()}

Apply the same fix to LoginForm.jsx (add status.password_login to the condition).

🧹 Nitpick comments (1)

web/src/components/auth/RegisterForm.jsx (1)

481-498: Consider combining the two adjacent conditionals.

The logic correctly gates the Divider and registration button on status.password_register. Since both blocks share the same condition, they could be combined into a single fragment to reduce duplication.

♻️ Optional: Combine conditionals into a single fragment

-                {status.password_register && (
-                  <Divider margin='12px' align='center'>
-                    {t('或')}
-                  </Divider>
-                )}
-
-                {status.password_register && (
+                {status.password_register && (
+                  <>
+                    <Divider margin='12px' align='center'>
+                      {t('或')}
+                    </Divider>
                   <Button
                     theme='solid'
                     type='primary'
                     className='w-full h-12 flex items-center justify-center bg-black text-white !rounded-full hover:bg-gray-800 transition-colors'
                     icon={<IconMail size='large' />}
                     onClick={handleEmailRegisterClick}
                     loading={emailRegisterLoading}
                   >
                     <span className='ml-3'>{t('使用 用户名 注册')}</span>
                   </Button>
+                  </>
                 )}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@web/src/components/auth/LoginForm.jsx`:
- Around line 581-597: The email/password form is still rendered even when
status.password_login is false; update the LoginForm component to only
call/render renderEmailLoginForm() when status.password_login is true (same
check used for the Button block). Locate the renderEmailLoginForm invocation
inside LoginForm.jsx and wrap or gate it with a condition that checks
status.password_login (e.g., if (status.password_login) return
renderEmailLoginForm()), ensuring both the button and the full email/password
form follow the same flag.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Password login can still be accessed when password_login is disabled.

This button is hidden, but the main render still shows the email/password form when no OAuth options exist, bypassing the flag. Gate renderEmailLoginForm() on status.password_login to enforce the config.

🔧 Suggested fix

-        {showEmailLogin ||
-        !(
-          status.github_oauth ||
-          status.discord_oauth ||
-          status.oidc_enabled ||
-          status.wechat_login ||
-          status.linuxdo_oauth ||
-          status.telegram_oauth
-        )
-          ? renderEmailLoginForm()
-          : renderOAuthOptions()}
+        {status.password_login &&
+        (showEmailLogin ||
+          !(
+            status.github_oauth ||
+            status.discord_oauth ||
+            status.oidc_enabled ||
+            status.wechat_login ||
+            status.linuxdo_oauth ||
+            status.telegram_oauth
+          ))
+          ? renderEmailLoginForm()
+          : renderOAuthOptions()}

🤖 Prompt for AI Agents

In `@web/src/components/auth/LoginForm.jsx` around lines 581 - 597, The
email/password form is still rendered even when status.password_login is false;
update the LoginForm component to only call/render renderEmailLoginForm() when
status.password_login is true (same check used for the Button block). Locate the
renderEmailLoginForm invocation inside LoginForm.jsx and wrap or gate it with a
condition that checks status.password_login (e.g., if (status.password_login)
return renderEmailLoginForm()), ensuring both the button and the full
email/password form follow the same flag.