feat: do not allow user_id_only login for admins (#2904)

2025-01-23 15:01:54 +02:00
parent b6bdf50ed7
commit f845bfe651
6 changed files with 115 additions and 29 deletions
@@ -110,6 +110,10 @@ async def login_usr(data: LoginUsr) -> JSONResponse:
    account = await get_account(data.usr)
    if not account:
        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User ID does not exist.")
+    if account.is_admin:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED, "Admin users cannot login with user id only."
+        )
    return _auth_success_response(account.username, account.id, account.email)