feat: add login type 'none' to prevent password login (#8009)

* feat: add login type 'none' to prevent login

Users with this login type must use tokens to authenticate.
Tokens must come from some other source, not a /login with password
authentication

coderd/database/dump.sql

@@ -45,9 +45,12 @@ CREATE TYPE login_type AS ENUM (
     'password',
     'github',
     'oidc',
-    'token'
+    'token',
+    'none'
 );
 
+COMMENT ON TYPE login_type IS 'Specifies the method of authentication. "none" is a special case in which no authentication method is allowed.';
+
 CREATE TYPE parameter_destination_scheme AS ENUM (
     'none',
     'environment_variable',

coderd/database/migrations/000126_login_type_none.down.sql

@@ -0,0 +1,2 @@
+-- It's not possible to drop enum values from enum types, so the UP has "IF NOT
+-- EXISTS".

coderd/database/migrations/000126_login_type_none.up.sql

@@ -0,0 +1,3 @@
+ALTER TYPE login_type ADD VALUE IF NOT EXISTS 'none';
+
+COMMENT ON TYPE login_type IS 'Specifies the method of authentication. "none" is a special case in which no authentication method is allowed.';

coderd/database/models.go

@@ -397,6 +397,7 @@ func AllLogSourceValues() []LogSource {
 	}
 }
 
+// Specifies the method of authentication. "none" is a special case in which no authentication method is allowed.
 type LoginType string
 
 const (
@@ -404,6 +405,7 @@ const (
 	LoginTypeGithub   LoginType = "github"
 	LoginTypeOIDC     LoginType = "oidc"
 	LoginTypeToken    LoginType = "token"
+	LoginTypeNone     LoginType = "none"
 )
 
 func (e *LoginType) Scan(src interface{}) error {
@@ -446,7 +448,8 @@ func (e LoginType) Valid() bool {
 	case LoginTypePassword,
 		LoginTypeGithub,
 		LoginTypeOIDC,
-		LoginTypeToken:
+		LoginTypeToken,
+		LoginTypeNone:
 		return true
 	}
 	return false
@@ -458,6 +461,7 @@ func AllLoginTypeValues() []LoginType {
 		LoginTypeGithub,
 		LoginTypeOIDC,
 		LoginTypeToken,
+		LoginTypeNone,
 	}
 }