Allow logging in using an email address (#4337)

Author: sandhose

crates/cli/src/util.rs

@@ -214,6 +214,7 @@ pub fn site_config_from_config(
         captcha,
         minimum_password_complexity: password_config.minimum_complexity(),
         session_expiration,
+        login_with_email_allowed: account_config.login_with_email_allowed,
     })
 }
 

crates/config/src/sections/account.rs

@@ -66,6 +66,12 @@ pub struct AccountConfig {
     /// `true`.
     #[serde(default = "default_true", skip_serializing_if = "is_default_true")]
     pub account_deactivation_allowed: bool,
+
+    /// Whether users can log in with their email address. Defaults to `false`.
+    ///
+    /// This has no effect if password login is disabled.
+    #[serde(default = "default_false", skip_serializing_if = "is_default_false")]
+    pub login_with_email_allowed: bool,
 }
 
 impl Default for AccountConfig {
@@ -77,6 +83,7 @@ impl Default for AccountConfig {
             password_change_allowed: default_true(),
             password_recovery_enabled: default_false(),
             account_deactivation_allowed: default_true(),
+            login_with_email_allowed: default_false(),
         }
     }
 }
@@ -90,6 +97,7 @@ impl AccountConfig {
             && is_default_true(&self.password_change_allowed)
             && is_default_false(&self.password_recovery_enabled)
             && is_default_true(&self.account_deactivation_allowed)
+            && is_default_false(&self.login_with_email_allowed)
     }
 }
 

crates/data-model/src/site_config.rs

@@ -87,4 +87,7 @@ pub struct SiteConfig {
     pub minimum_password_complexity: u8,
 
     pub session_expiration: Option<SessionExpirationConfig>,
+
+    /// Whether users can log in with their email address.
+    pub login_with_email_allowed: bool,
 }

crates/handlers/src/graphql/model/site_config.rs

@@ -53,6 +53,9 @@ pub struct SiteConfig {
     /// The exact scorer (including dictionaries and other data tables)
     /// in use is <https://crates.io/crates/zxcvbn>.
     minimum_password_complexity: u8,
+
+    /// Whether users can log in with their email address.
+    login_with_email_allowed: bool,
 }
 
 #[derive(SimpleObject)]
@@ -98,6 +101,7 @@ impl SiteConfig {
             password_registration_enabled: data_model.password_registration_enabled,
             account_deactivation_allowed: data_model.account_deactivation_allowed,
             minimum_password_complexity: data_model.minimum_password_complexity,
+            login_with_email_allowed: data_model.login_with_email_allowed,
         }
     }
 }

crates/handlers/src/test_utils.rs

@@ -141,6 +141,7 @@ pub fn test_site_config() -> SiteConfig {
         captcha: None,
         minimum_password_complexity: 1,
         session_expiration: None,
+        login_with_email_allowed: true,
     }
 }
 

crates/handlers/src/views/login.rs

@@ -187,7 +187,8 @@ pub(crate) async fn post(
         .unwrap_or(&form.username);
 
     // First, lookup the user
-    let Some(user) = repo.user().find_by_username(username).await? else {
+    let Some(user) = get_user_by_email_or_by_username(site_config, &mut repo, username).await?
+    else {
         let form_state = form_state.with_error_on_form(FormError::InvalidCredentials);
         PASSWORD_LOGIN_COUNTER.add(1, &[KeyValue::new(RESULT, "error")]);
         return render(
@@ -337,6 +338,28 @@ pub(crate) async fn post(
     Ok((cookie_jar, reply).into_response())
 }
 
+async fn get_user_by_email_or_by_username(
+    site_config: SiteConfig,
+    repo: &mut impl RepositoryAccess,
+    username_or_email: &str,
+) -> Result<Option<mas_data_model::User>, Box<dyn std::error::Error>> {
+    if site_config.login_with_email_allowed && username_or_email.contains('@') {
+        let maybe_user_email = repo.user_email().find_by_email(username_or_email).await?;
+
+        if let Some(user_email) = maybe_user_email {
+            let user = repo.user().lookup(user_email.user_id).await?;
+
+            if user.is_some() {
+                return Ok(user);
+            }
+        }
+    }
+
+    let user = repo.user().find_by_username(username_or_email).await?;
+
+    Ok(user)
+}
+
 fn handle_login_hint(
     mut ctx: LoginContext,
     next: &PostAuthContext,

crates/storage-pg/.sqlx/query-f3b043b69e0554b5b4d8f5cf05960632fb2ebd38916dd2e9beac232c7e14c1ec.json

@@ -191,6 +191,43 @@ impl UserEmailRepository for PgUserEmailRepository<'_> {
         Ok(Some(user_email.into()))
     }
 
+    #[tracing::instrument(
+        name = "db.user_email.find_by_email",
+        skip_all,
+        fields(
+            db.query.text,
+            user_email.email = email,
+        ),
+        err,
+    )]
+    async fn find_by_email(&mut self, email: &str) -> Result<Option<UserEmail>, Self::Error> {
+        let res = sqlx::query_as!(
+            UserEmailLookup,
+            r#"
+                SELECT user_email_id
+                     , user_id
+                     , email
+                     , created_at
+                FROM user_emails
+                WHERE email = $1
+            "#,
+            email,
+        )
+        .traced()
+        .fetch_all(&mut *self.conn)
+        .await?;
+
+        if res.len() != 1 {
+            return Ok(None);
+        }
+
+        let Some(user_email) = res.into_iter().next() else {
+            return Ok(None);
+        };
+
+        Ok(Some(user_email.into()))
+    }
+
     #[tracing::instrument(
         name = "db.user_email.all",
         skip_all,

crates/storage-pg/src/user/email.rs

@@ -93,6 +93,19 @@ pub trait UserEmailRepository: Send + Sync {
     /// Returns [`Self::Error`] if the underlying repository fails
     async fn find(&mut self, user: &User, email: &str) -> Result<Option<UserEmail>, Self::Error>;
 
+    /// Lookup an [`UserEmail`] by its email address
+    ///
+    /// Returns `None` if no matching [`UserEmail`] was found or if multiple
+    /// [`UserEmail`] are found
+    ///
+    /// # Parameters
+    /// * `email`: The email address to lookup
+    ///
+    /// # Errors
+    ///
+    /// Returns [`Self::Error`] if the underlying repository fails
+    async fn find_by_email(&mut self, email: &str) -> Result<Option<UserEmail>, Self::Error>;
+
     /// Get all [`UserEmail`] of a [`User`]
     ///
     /// # Parameters
@@ -298,6 +311,7 @@ pub trait UserEmailRepository: Send + Sync {
 repository_impl!(UserEmailRepository:
     async fn lookup(&mut self, id: Ulid) -> Result<Option<UserEmail>, Self::Error>;
     async fn find(&mut self, user: &User, email: &str) -> Result<Option<UserEmail>, Self::Error>;
+    async fn find_by_email(&mut self, email: &str) -> Result<Option<UserEmail>, Self::Error>;
 
     async fn all(&mut self, user: &User) -> Result<Vec<UserEmail>, Self::Error>;
     async fn list(

crates/storage/src/user/email.rs

@@ -47,6 +47,7 @@ impl SiteConfigExt for SiteConfig {
             password_registration: self.password_registration_enabled,
             password_login: self.password_login_enabled,
             account_recovery: self.account_recovery_allowed,
+            login_with_email_allowed: self.login_with_email_allowed,
         }
     }
 }