feat(auth): make password encryption opt-in #6743

web/src/features/auth/api.ts

@@ -48,22 +48,34 @@ import type {
 export async function login(payload: LoginPayload): Promise<LoginResponse> {
   const turnstile = payload.turnstile ?? ''
   try {
-    const encryptedPassword = await encryptPassword(payload.password)
+    let passwordFields:
+      | { password: string }
+      | { password_encrypted: string; encryption_key_id: string }
+    if (payload.passwordEncryptionEnabled) {
+      const encryptedPassword = await encryptPassword(payload.password)
+      passwordFields = {
+        password_encrypted: encryptedPassword.password_encrypted,
+        encryption_key_id: encryptedPassword.encryption_key_id,
+      }
+    } else {
+      passwordFields = { password: payload.password }
+    }
     const res = await api.post<LoginResponse>(
       `/api/user/login?turnstile=${turnstile}`,
       {
         username: payload.username,
-        password_encrypted: encryptedPassword.password_encrypted,
-        encryption_key_id: encryptedPassword.encryption_key_id,
+        ...passwordFields,
       },
       { skipAuthRefresh: true }
     )
-    if (!res.data?.success) {
+    if (payload.passwordEncryptionEnabled && !res.data?.success) {
       clearPasswordEncryptionCache()
     }
     return res.data
   } catch (error: unknown) {
-    clearPasswordEncryptionCache()
+    if (payload.passwordEncryptionEnabled) {
+      clearPasswordEncryptionCache()
+    }
     throw error
   }
 }

web/src/features/auth/sign-in/components/user-auth-form.tsx

@@ -84,6 +84,10 @@ export function UserAuthForm({
     (status?.password_login_enabled ??
       status?.data?.password_login_enabled ??
       true) !== false
+  const passwordLoginEncryptionEnabled =
+    (status?.password_login_encryption_enabled ??
+      status?.data?.password_login_encryption_enabled ??
+      false) === true
   const {
     isTurnstileEnabled,
     turnstileSiteKey,
@@ -171,6 +175,7 @@ export function UserAuthForm({
         username: data.username,
         password: data.password,
         turnstile: submittedTurnstileToken,
+        passwordEncryptionEnabled: passwordLoginEncryptionEnabled,
       })
 
       if (res.success) {

web/src/features/auth/types.ts

@@ -26,6 +26,7 @@ export interface LoginPayload {
   username: string
   password: string
   turnstile?: string
+  passwordEncryptionEnabled?: boolean
 }
 
 export interface TwoFAPayload {
@@ -133,6 +134,7 @@ export interface SystemStatus {
     oauth_register_enabled?: boolean
     register_enabled?: boolean
     password_login_enabled?: boolean
+    password_login_encryption_enabled?: boolean
     password_register_enabled?: boolean
     custom_oauth_providers?: CustomOAuthProviderInfo[]
     [key: string]: unknown
@@ -178,6 +180,7 @@ export interface SystemStatus {
   oauth_register_enabled?: boolean
   register_enabled?: boolean
   password_login_enabled?: boolean
+  password_login_encryption_enabled?: boolean
   password_register_enabled?: boolean
   custom_oauth_providers?: CustomOAuthProviderInfo[]
   [key: string]: unknown