feat(auth): use password-only admin login

frontend/src/app/login/page.tsx

@@ -14,6 +14,7 @@ export default async function LoginPage() {
   const config = readIdentityConfig(process.env);
   let provider = config.provider;
   let passwordEnabled = false;
+  let passwordOnly = false;
   if (isSelfHostedIdentityEnabled(process.env)) {
     const selfHosted = readSelfHostedIdentityConfig(process.env);
     const surface = resolveIdentitySurface(
@@ -21,9 +22,14 @@ export default async function LoginPage() {
       selfHosted,
     );
     if (surface === "admin") provider = "self-hosted";
-    passwordEnabled = provider === "self-hosted" && surface === "user";
+    passwordEnabled = provider === "self-hosted";
+    passwordOnly = surface === "admin";
   }
   return (
-    <EmailOtpLogin provider={provider} passwordEnabled={passwordEnabled} />
+    <EmailOtpLogin
+      provider={provider}
+      passwordEnabled={passwordEnabled}
+      passwordOnly={passwordOnly}
+    />
   );
 }

frontend/src/components/email-otp-login.tsx

@@ -36,11 +36,13 @@ function passwordError(password: string, confirmation: string): string {
 export function EmailOtpLogin({
   provider,
   passwordEnabled = false,
+  passwordOnly = false,
 }: {
   provider: AuthProvider;
   passwordEnabled?: boolean;
+  passwordOnly?: boolean;
 }) {
-  const [mode, setMode] = useState<AuthMode>("otp");
+  const [mode, setMode] = useState<AuthMode>(passwordOnly ? "password" : "otp");
   const [step, setStep] = useState<AuthStep>("email");
   const [email, setEmail] = useState("");
   const [token, setToken] = useState("");
@@ -52,9 +54,9 @@ export function EmailOtpLogin({
 
   const canUsePassword = provider === "self-hosted" && passwordEnabled;
   const showLoginNavigation =
-    canUsePassword && (mode === "otp" || mode === "password");
+    canUsePassword && !passwordOnly && (mode === "otp" || mode === "password");
   const showBackToLogin =
-    canUsePassword && (mode === "register" || mode === "forgot");
+    canUsePassword && !passwordOnly && (mode === "register" || mode === "forgot");
 
   function chooseMode(nextMode: AuthMode, nextNotice = "") {
     setMode(nextMode);

frontend/src/modules/identity/auth-factory.ts

@@ -100,19 +100,17 @@ export function buildAuthOptions({
         path: "/",
       },
     },
-    ...(surface === "user"
-      ? {
-          emailAndPassword: {
-            enabled: true,
-            disableSignUp: true,
-            minPasswordLength: 8,
-            maxPasswordLength: 128,
-            revokeSessionsOnPasswordReset: true,
-          },
-        }
-      : {}),
+    emailAndPassword: {
+      enabled: true,
+      disableSignUp: true,
+      minPasswordLength: 8,
+      maxPasswordLength: 128,
+      revokeSessionsOnPasswordReset: true,
+    },
     plugins: [
-      emailOTP(createEmailOtpOptions(emailSender, secret, surface === "admin")),
+      ...(surface === "user"
+        ? [emailOTP(createEmailOtpOptions(emailSender, secret, false))]
+        : []),
       admin({
         defaultRole: "user",
         adminRoles: ["admin"],