feat: the password is turned off by hand in the account, with a passkey in place; password change; tabs sized by their titles

internal/server/db.go

@@ -117,6 +117,7 @@ CREATE TABLE IF NOT EXISTS forward_rules (
 		`ALTER TABLE agents ADD COLUMN login_user TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE forward_rules ADD COLUMN no_ufw INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE forward_rules ADD COLUMN label TEXT NOT NULL DEFAULT ''`,
+		`ALTER TABLE admins ADD COLUMN password_off INTEGER NOT NULL DEFAULT 0`,
 	} {
 		if _, err := db.sql.Exec(alter); err != nil && !strings.Contains(err.Error(), "duplicate column") {
 			return err
@@ -246,8 +247,29 @@ func (db *DB) ListAdminKeys(adminID int64) ([]AdminKey, error) {
 	return out, rows.Err()
 }
 
-// CountAdminKeys is how many passkeys an admin has: with any, the password
-// no longer signs them in.
+// PasswordOff tells an admin who turned the password off: then only a
+// passkey signs them in. It holds only while they have one.
+func (db *DB) PasswordOff(adminID int64) bool {
+	var off int
+	_ = db.sql.QueryRow(`SELECT password_off FROM admins WHERE id = ?`, adminID).Scan(&off)
+	return off == 1 && db.CountAdminKeys(adminID) > 0
+}
+
+func (db *DB) SetAdminPassword(adminID int64, passHash string) error {
+	_, err := db.sql.Exec(`UPDATE admins SET pass_hash = ? WHERE id = ?`, passHash, adminID)
+	return err
+}
+
+func (db *DB) SetPasswordOff(adminID int64, off bool) error {
+	v := 0
+	if off {
+		v = 1
+	}
+	_, err := db.sql.Exec(`UPDATE admins SET password_off = ? WHERE id = ?`, v, adminID)
+	return err
+}
+
+// CountAdminKeys is how many passkeys an admin has.
 func (db *DB) CountAdminKeys(adminID int64) int {
 	var n int
 	_ = db.sql.QueryRow(`SELECT COUNT(*) FROM admin_keys WHERE admin_id = ?`, adminID).Scan(&n)
@@ -271,14 +293,23 @@ func (db *DB) UseAdminKey(id int64, signCount uint32) error {
 	return err
 }
 
+// DeleteAdminKey removes a passkey; with the last one gone, the password
+// signs the admin in again.
 func (db *DB) DeleteAdminKey(adminID, id int64) error {
-	_, err := db.sql.Exec(`DELETE FROM admin_keys WHERE admin_id = ? AND id = ?`, adminID, id)
-	return err
+	if _, err := db.sql.Exec(`DELETE FROM admin_keys WHERE admin_id = ? AND id = ?`, adminID, id); err != nil {
+		return err
+	}
+	if db.CountAdminKeys(adminID) == 0 {
+		return db.SetPasswordOff(adminID, false)
+	}
+	return nil
 }
 
 func (db *DB) DeleteAdminKeys(adminID int64) error {
-	_, err := db.sql.Exec(`DELETE FROM admin_keys WHERE admin_id = ?`, adminID)
-	return err
+	if _, err := db.sql.Exec(`DELETE FROM admin_keys WHERE admin_id = ?`, adminID); err != nil {
+		return err
+	}
+	return db.SetPasswordOff(adminID, false)
 }
 
 // --- admin sessions ---