Stop discord users from logging in using a password

app/Http/Controllers/Auth/PasswordResetLinkController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
+use App\Models\User;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
@@ -33,11 +34,19 @@ public function store(Request $request): RedirectResponse
             'email' => 'required|email',
         ]);
 
+        $user = User::where('email', $request->get('email'))->first();
+
+        if ($user->discordUser !== null) {
+            throw ValidationException::withMessages([
+                'email' => [trans(Password::INVALID_USER)],
+            ]);
+        }
+
         // We will send the password reset link to this user. Once we have attempted
         // to send the link, we will examine the response then see the message we
         // need to show to the user. Finally, we'll send out a proper response.
         $status = Password::sendResetLink(
-            $request->only('email')
+            $request->only('email'),
         );
 
         if ($status == Password::RESET_LINK_SENT) {

app/Http/Requests/Auth/LoginRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Requests\Auth;
 
+use App\Models\User;
 use Illuminate\Auth\Events\Lockout;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Facades\Auth;
@@ -41,7 +42,13 @@ public function authenticate(): void
     {
         $this->ensureIsNotRateLimited();
 
-        if (! Auth::attempt($this->only('email', 'password'), $this->boolean('remember'))) {
+        if (! Auth::attemptWhen(
+            $this->only('email', 'password'),
+            function (User $user) {
+                return $user->discordUser === null;
+            },
+            $this->boolean('remember')
+        )) {
             RateLimiter::hit($this->throttleKey());
 
             throw ValidationException::withMessages([

resources/js/Pages/Auth/ForgotPassword.vue

@@ -4,7 +4,7 @@ import InputError from '@/Components/InputError.vue';
 import InputLabel from '@/Components/InputLabel.vue';
 import PrimaryButton from '@/Components/PrimaryButton.vue';
 import TextInput from '@/Components/TextInput.vue';
-import { Head, useForm } from '@inertiajs/vue3';
+import {Head, useForm} from '@inertiajs/vue3';
 
 defineProps<{
     status?: string;
@@ -63,6 +63,7 @@ const submit = () => {
                 <PrimaryButton
                     :class="{ 'opacity-25': form.processing }"
                     :disabled="form.processing"
+                    type="submit"
                 >
                     Email Password Reset Link
                 </PrimaryButton>

resources/js/Pages/Auth/Login.vue

@@ -153,6 +153,7 @@ const showEmailForm = ref(false);
                                 class="ms-4 bg-brand"
                                 :class="{ 'opacity-25': form.processing }"
                                 :disabled="form.processing"
+                                type="submit"
                             >
                                 Log in
                             </PrimaryButton>

resources/js/Pages/Auth/ResetPassword.vue

@@ -4,7 +4,7 @@ import InputError from '@/Components/InputError.vue';
 import InputLabel from '@/Components/InputLabel.vue';
 import PrimaryButton from '@/Components/PrimaryButton.vue';
 import TextInput from '@/Components/TextInput.vue';
-import { Head, useForm } from '@inertiajs/vue3';
+import {Head, useForm} from '@inertiajs/vue3';
 
 
 const props = defineProps<{
@@ -101,6 +101,7 @@ const submit = () => {
                 <PrimaryButton
                     :class="{ 'opacity-25': form.processing }"
                     :disabled="form.processing"
+                    type="submit"
                 >
                     Reset Password
                 </PrimaryButton>

routes/auth.php

@@ -1,7 +1,6 @@
 <?php
 
 use App\Http\Controllers\Auth\AuthenticatedSessionController;
-use App\Http\Controllers\Auth\ConfirmablePasswordController;
 use App\Http\Controllers\Auth\DiscordController;
 use App\Http\Controllers\Auth\EmailVerificationNotificationController;
 use App\Http\Controllers\Auth\EmailVerificationPromptController;
@@ -49,11 +48,6 @@
         ->middleware('throttle:6,1')
         ->name('verification.send');
 
-    Route::get('confirm-password', [ConfirmablePasswordController::class, 'show'])
-        ->name('password.confirm');
-
-    Route::post('confirm-password', [ConfirmablePasswordController::class, 'store']);
-
     Route::put('password', [PasswordController::class, 'update'])->name('password.update');
 
     Route::post('logout', [AuthenticatedSessionController::class, 'destroy'])

routes/web.php

@@ -8,7 +8,7 @@
 
 Route::get('/', function () {
     return redirect()->route('login');
-});
+})->name('home');
 
 Route::get('/dashboard', function () {
     return Inertia::render('Dashboard');

tests/Feature/Auth/AuthenticationTest.php

@@ -3,6 +3,7 @@
 namespace Tests\Feature\Auth;
 
 use App\Http\Controllers\Auth\AuthenticatedSessionController;
+use App\Models\DiscordUser;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use PHPUnit\Framework\Attributes\CoversClass;
@@ -54,4 +55,22 @@ public function test_users_can_logout(): void
         $this->assertGuest();
         $response->assertRedirect('/');
     }
+
+    public function test_user_with_discord_login_cannot_login_with_password(): void
+    {
+        $user = User::factory([
+            'password' => null,
+            'remember_token' => null,
+        ])
+            ->has(DiscordUser::factory())
+            ->create();
+
+        $response = $this->post('/login', [
+            'email' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertGuest();
+        $response->assertRedirect(route('home'));
+    }
 }

tests/Feature/Auth/PasswordResetTest.php

@@ -3,6 +3,7 @@
 namespace Tests\Feature\Auth;
 
 use App\Http\Controllers\Auth\NewPasswordController;
+use App\Models\DiscordUser;
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -33,6 +34,22 @@ public function test_reset_password_link_can_be_requested(): void
         Notification::assertSentTo($user, ResetPassword::class);
     }
 
+    public function test_reset_password_link_cannot_be_requested_for_user_with_discord_login(): void
+    {
+        Notification::fake();
+
+        $user = User::factory([
+            'password' => null,
+            'remember_token' => null,
+        ])
+            ->has(DiscordUser::factory())
+            ->create();
+
+        $this->post('/forgot-password', ['email' => $user->email]);
+
+        Notification::assertNotSentTo($user, ResetPassword::class);
+    }
+
     public function test_reset_password_screen_can_be_rendered(): void
     {
         Notification::fake();