code: keep pam enabled and gate oidc

backend/auth.py

@@ -1,7 +1,7 @@
 import datetime as dt
 import grp
 import pwd
-from typing import List, Set
+from typing import List, Set, Optional
 
 import jwt
 import pam
@@ -23,8 +23,8 @@ def _is_member_of(username: str, groups: Set[str]) -> bool:
     return bool(user_groups & groups)
 
 
-def is_authorized_admin(username: str, settings: Settings) -> bool:
-    if settings.auth_mode == "oidc":
+def is_authorized_admin(username: str, settings: Settings, mode: Optional[str] = None) -> bool:
+    if mode == "oidc":
         allowed_users = set(settings.auth_allowed_users)
         if allowed_users and username not in allowed_users:
             return False
@@ -46,12 +46,7 @@ def is_authorized_admin(username: str, settings: Settings) -> bool:
 
 
 def authenticate_admin_user(username: str, password: str, settings: Settings) -> None:
-    if settings.auth_mode != "pam":
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="Password login disabled; OIDC is configured",
-        )
-    if not is_authorized_admin(username, settings):
+    if not is_authorized_admin(username, settings, mode="pam"):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="User not authorized to log in",
@@ -82,7 +77,12 @@ def decode_token(token: str, settings: Settings) -> str:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token") from exc
 
     username = payload.get("sub")
-    if not username or not is_authorized_admin(username, settings):
+    if not username:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
+    if not (
+        is_authorized_admin(username, settings, mode="pam")
+        or is_authorized_admin(username, settings, mode="oidc")
+    ):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Unauthorized user")
     return username