feat: add login type 'none' to prevent password login (#8009)

* feat: add login type 'none' to prevent login

Users with this login type must use tokens to authenticate.
Tokens must come from some other source, not a /login with password
authentication

codersdk/apikey.go

@@ -32,6 +32,11 @@ const (
 	LoginTypeGithub   LoginType = "github"
 	LoginTypeOIDC     LoginType = "oidc"
 	LoginTypeToken    LoginType = "token"
+	// LoginTypeNone is used if no login method is available for this user.
+	// If this is set, the user has no method of logging in.
+	// API keys can still be created by an owner and used by the user.
+	// These keys would use the `LoginTypeToken` type.
+	LoginTypeNone LoginType = "none"
 )
 
 type APIKeyScope string

codersdk/users.go

@@ -66,9 +66,12 @@ type CreateFirstUserResponse struct {
 }
 
 type CreateUserRequest struct {
-	Email          string    `json:"email" validate:"required,email" format:"email"`
-	Username       string    `json:"username" validate:"required,username"`
-	Password       string    `json:"password" validate:"required"`
+	Email    string `json:"email" validate:"required,email" format:"email"`
+	Username string `json:"username" validate:"required,username"`
+	Password string `json:"password" validate:"required_if=DisableLogin false"`
+	// DisableLogin sets the user's login type to 'none'. This prevents the user
+	// from being able to use a password or any other authentication method to login.
+	DisableLogin   bool      `json:"disable_login"`
 	OrganizationID uuid.UUID `json:"organization_id" validate:"" format:"uuid"`
 }