From 9d6c530b5cb4b465c00ba26c0433d1fe83db7ae1 Mon Sep 17 00:00:00 2001
From: mrhid6 <mrhid6@gmail.com>
Date: Mon, 3 Aug 2026 10:36:48 +0100
Subject: [PATCH] feat: add local_login_enabled setting with absent-means-on
 default

---
 models/settings.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/models/settings.go b/models/settings.go
index 449ac91..6b9b384 100644
--- a/models/settings.go
+++ b/models/settings.go
@@ -37,4 +37,19 @@ type Settings struct {
 	Secrets    SecretsSettings `bson:"secrets" json:"secrets"`
 
 	WorkflowLogRetentionDays *int `bson:"workflow_log_retention_days,omitempty" json:"workflow_log_retention_days,omitempty"`
+
+	// LocalLoginEnabled is a pointer because it is absent on every settings
+	// document written before this feature existed, and a plain bool would read
+	// absent as disabled — turning off password login for the entire fleet at
+	// upgrade. Nil means enabled.
+	LocalLoginEnabled *bool `bson:"local_login_enabled,omitempty" json:"local_login_enabled,omitempty"`
+}
+
+// LocalLoginEnabled reads the setting with its absent-means-on default. Every
+// caller must go through this rather than dereferencing the field.
+func LocalLoginEnabled(s *Settings) bool {
+	if s == nil || s.LocalLoginEnabled == nil {
+		return true
+	}
+	return *s.LocalLoginEnabled
 }