fix!: deprecate `login_type=none`, convert existing users to password login by jakehwll · Pull Request #26851 · coder/coder

jakehwll · 2026-06-30T04:09:34Z

🤖 This PR was modified by Coder Agents on behalf of Jake Howell.

Deprecates login_type=none (legacy passwordless machine users) in favour of premium service accounts, and migrates existing accounts off the deprecated path while preserving their identity. Resolves DEVEX-226.

What this does

Creation is gated — POST /users and coder users create reject login_type=none (and the deprecated --disable-login) unless a service account is requested.
Existing users are converted — migration 000554_legacy_none_login_to_password rewrites legacy non-system, non–service-account login_type='none' accounts to login_type='password'. Email addresses are preserved and existing API tokens remain valid. Admins can set a password if interactive login is desired.

Why convert to `password` and not `is_service_account`?

Migration 000433_add_is_service_account_to_users adds two CHECK constraints:

users_email_not_empty: (is_service_account = true) = (email = '')
users_service_account_login_type: is_service_account = false OR login_type = 'none'

Turning a real, email-bearing login_type=none user into a service account would require blanking their email. Converting to password instead preserves the account and its email.

⚠️ Breaking / one-way. The down migration cannot restore which users originally had login_type='none'.

Decision log

Goal: move existing login_type=none users off the deprecated path while preserving their identity/email.
Constraint discovered: the is_service_account CHECK constraints (migration 000433) make a literal none → service account conversion require blanking emails, so this PR converts to password instead to keep emails intact.
Implementation: creation-gating in cli/usercreate.go and coderd/users.go, matching test updates, plus the 000554_legacy_none_login_to_password.{up,down}.sql migration.
CI fix: the branch was behind main and its migration originally numbered 000534, which collided with main's 000534_drop_chat_model_configs_provider. Merged main and renumbered to 000554 (next free after main's 000553). make gen produces no drift (the migration is data-only).

The service-account conversion alternative (#27182, which blanked emails) was closed in favour of this password-preserving approach.

Docs follow-up: #27333.

linear-code · 2026-06-30T04:09:37Z

DEVEX-226

jakehwll · 2026-06-30T04:32:00Z

+	-- `prebuilds@system` user should not convert it to service account.
+	AND is_system = false;


This is defensive programming. Things would theoretically continue working if this was a service account, however, we don't want to allow it access to HTTP API key creation AI Bridge auth and Notifications.

…000548

…l-services-accounts-all-the-time

coderagents · 2026-07-20T03:16:55Z

Documentation Check

Updates Needed

docs/install/releases/esr-2.29-2.34-upgrade.md - The breaking-changes table entry and the "Migrate headless automation to service accounts" step describe --login-type none as deprecated and advise manual migration. This PR changes that behavior: POST /users and coder users create now reject login_type=none / --disable-login unless --service-account is set, and migration 000554_legacy_none_login_to_password automatically converts existing non-system, non-service-account login_type='none' accounts to login_type='password'. Update the wording from "deprecated" to "blocked at creation," and document the automatic, one-way conversion (preserves email addresses, existing API tokens remain valid). The irreversible-migrations note should also mention 000554.
docs/admin/users/headless-auth.md - Add a short note that the legacy passwordless path (--login-type none / --disable-login) is no longer accepted at creation, and point users to service accounts (Premium) or password/GitHub/OIDC accounts (OSS) so admins searching for the old flow land on the replacement.

Note

The migration has been renumbered across rebases onto main (currently 000554); behavior is unchanged. The PR references a docs follow-up (#27333). This checklist tracks the documentation surfaces affected by the behavior change in this PR; close items as they are covered there or here.

Automated review via Coder Agents

…ith a password

…y none users

…rvice-account

code-asher · 2026-07-20T18:54:25Z

@@ -0,0 +1,9 @@
+-- Convert legacy users created with login_type 'none' to password auth.
+-- OSS deployments cannot create service accounts without Premium. Existing


I see that we convert to password to avoid losing the email but why is that important? It seems to me like converting these to system accounts would be a seamless transition; do admins actually care if these types of users have emails?

At least, for premium users it would be seamless. For non-premium users I am not sure what happens if you have service accounts. Is the problem that we only prevent creating the accounts so a non-premium user would be grandfathered into keeping these service accounts? To me that seems reasonable though, and definitely less bad than a breaking change forcing premium users to recreate their accounts.

(I read through this description and the other PR; apologies if I missed some discussion.)

I see that we convert to password to avoid losing the email but why is that important? It seems to me like converting these to system accounts would be a seamless transition; do admins actually care if these types of users have emails?

These are not internal coder system accounts, I'm not sure we should blur the line between is_system here.

At least, for premium users it would be seamless. For non-premium users I am not sure what happens if you have service accounts. Is the problem that we only prevent creating the accounts so a non-premium user would be grandfathered into keeping these service accounts?

This was a product decision, we did discuss handing out Service Accounts being grandfathered in but if license enforcement changes in the future we could possibly breaking OSS instances.

There will be product discussion sent out to customers about the migration path here.

Ooops sorry I meant service accounts, not system accounts 🤦

Gotcha if this was the product decision then so be it 😄

fwiw though since we are already breaking both oss and premium instances with this change, seems less worse to break only oss instances later down the line instead 🤷

@code-asher yeah that was essentially the choice. Having service accounts in OSS is not great because we are introducing an account into OSS that they can't actually get more of (service accounts are premium).

…ks, add tests

…l-services-accounts-all-the-time

…000549

code-asher

Looks good to me!

code-asher · 2026-07-21T18:38:03Z

 		req.UserLoginType = codersdk.LoginTypePassword
 	}

+	if !req.ServiceAccount && req.UserLoginType == codersdk.LoginTypeNone {


nbd at all but this could be an else and skip the duplicate req.ServiceAccount check.

zenithwolf1000 · 2026-07-28T02:48:10Z

@@ -0,0 +1,9 @@
+-- Convert legacy users created with login_type 'none' to password auth.
+-- OSS deployments cannot create service accounts without Premium. Existing


@code-asher yeah that was essentially the choice. Having service accounts in OSS is not great because we are introducing an account into OSS that they can't actually get more of (service accounts are premium).

…-the-time

…tion to 000554

feat: database migration

51ca71c

github-actions Bot assigned jakehwll Jun 30, 2026

jakehwll added 2 commits June 30, 2026 04:22

feat: align cli and backend to disallow login_type = none

8285fcc

fix: rename migration to legacy_none_login_to_password.*

519607e

jakehwll commented Jun 30, 2026

View reviewed changes

jakehwll changed the title ~~fix: all service accounts all the time~~ fix!: migrate login_type=none to service accounts Jun 30, 2026

This was referenced Jul 13, 2026

fix!: convert legacy login_type=none users into service accounts #27182

Closed

docs(docs/admin/users): document login_type=none deprecation and password conversion #27292

Closed

jakehwll added 2 commits July 20, 2026 02:58

🤖 fix(coderd/database)!: renumber legacy none->password migration to …

0006c54

…000548

Merge remote-tracking branch 'origin/main' into jakehwll/DEVEX-226-al…

0957f63

…l-services-accounts-all-the-time

jakehwll changed the title ~~fix!: migrate login_type=none to service accounts~~ fix!: deprecate login_type=none, convert existing users to password login Jul 20, 2026

jakehwll mentioned this pull request Jul 20, 2026

docs(docs/admin/users): document login_type=none deprecation and password conversion #27333

Closed

jakehwll marked this pull request as ready for review July 20, 2026 03:13

github-actions Bot added the release/breaking This label is applied to PRs to detect breaking changes as part of the release process label Jul 20, 2026

jakehwll added 2 commits July 20, 2026 03:18

🤖 test(coderd): converted login_type=none users cannot authenticate w…

3ceb721

…ith a password

🤖 test(coderd/database/migrations): verify 000548 converts only legac…

5bc9794

…y none users

jakehwll requested review from code-asher and zenithwolf1000 July 20, 2026 03:54

🤖 docs(cli/usercreate): point deprecated --disable-login help at --se…

f66df67

…rvice-account

jakehwll requested a review from jdomeracki-coder July 20, 2026 04:01

code-asher reviewed Jul 20, 2026

View reviewed changes

jakehwll added 3 commits July 21, 2026 04:47

🤖 fix(cli/usercreate): address review, group non-service-account chec…

0e0b4f7

…ks, add tests

Merge remote-tracking branch 'origin/main' into jakehwll/DEVEX-226-al…

1170581

…l-services-accounts-all-the-time

🤖 fix(coderd/database)!: renumber legacy none->password migration to …

ef67964

…000549

jakehwll requested a review from code-asher July 21, 2026 05:52

code-asher approved these changes Jul 21, 2026

View reviewed changes

zenithwolf1000 approved these changes Jul 28, 2026

View reviewed changes

Merge branch 'main' into jakehwll/DEVEX-226-all-services-accounts-all…

f9fd828

…-the-time

🤖 chore(coderd/database/migrations): renumber legacy none login migra…

854ce1c

…tion to 000554

jakehwll merged commit 0e104f3 into main Jul 28, 2026
31 of 32 checks passed

jakehwll deleted the jakehwll/DEVEX-226-all-services-accounts-all-the-time branch July 28, 2026 11:05

github-actions Bot locked and limited conversation to collaborators Jul 28, 2026

jakehwll added cherry-pick/v2.36 Cherry-pick PR targeting release/2.36 cherry-pick labels Jul 28, 2026

		-- `prebuilds@system` user should not convert it to service account.
		AND is_system = false;

		@@ -0,0 +1,9 @@
		-- Convert legacy users created with login_type 'none' to password auth.
		-- OSS deployments cannot create service accounts without Premium. Existing

Uh oh!

Conversation

jakehwll commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this does

Why convert to password and not is_service_account?

Uh oh!

linear-code Bot commented Jun 30, 2026

Uh oh!

jakehwll Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

coderagents Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

code-asher Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jakehwll Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

code-asher Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

code-asher Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zenithwolf1000 Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

code-asher left a comment

Choose a reason for hiding this comment

Uh oh!

code-asher Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

zenithwolf1000 Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jakehwll commented Jun 30, 2026 •

edited

Loading

Why convert to `password` and not `is_service_account`?

coderagents Bot commented Jul 20, 2026 •

edited

Loading

code-asher Jul 20, 2026 •

edited

Loading

code-asher Jul 21, 2026 •

edited

Loading