feat: Add configurable password change toggle via system.allow_change_password (#1869)

* Initial plan

* Add password change toggle feature with config flag

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* Feature implementation complete and validated

Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>

* chore: remove lock

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: RockChinQ <45992437+RockChinQ@users.noreply.github.com>
Co-authored-by: Junyan Qin <rockchinq@gmail.com>

src/langbot/pkg/api/http/controller/groups/system.py

@@ -23,6 +23,9 @@ class SystemRouterGroup(group.RouterGroup):
                         if 'cloud_service_url' in self.ap.instance_config.data.get('plugin', {})
                         else 'https://space.langbot.app'
                     ),
+                    'allow_change_password': self.ap.instance_config.data.get('system', {}).get(
+                        'allow_change_password', True
+                    ),
                 }
             )
 

src/langbot/pkg/api/http/controller/groups/user.py

@@ -70,6 +70,13 @@ class UserRouterGroup(group.RouterGroup):
 
         @self.route('/change-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)
         async def _(user_email: str) -> str:
+            # Check if password change is allowed
+            allow_change_password = self.ap.instance_config.data.get('system', {}).get(
+                'allow_change_password', True
+            )
+            if not allow_change_password:
+                return self.http_status(403, -1, 'Password change is disabled')
+
             json_data = await quart.request.json
 
             current_password = json_data['current_password']

src/langbot/templates/config.yaml

@@ -16,6 +16,7 @@ proxy:
     https: ''
 system:
     recovery_key: ''
+    allow_change_password: true
     jwt:
         expire: 604800
         secret: ''

web/src/app/home/components/home-sidebar/HomeSidebar.tsx

@@ -299,6 +299,7 @@ export default function HomeSidebar({
                 </svg>
                 {t('common.helpDocs')}
               </Button>
+              {systemInfo?.allow_change_password && (
                 <Button
                   variant="ghost"
                   className="w-full justify-start font-normal"
@@ -317,6 +318,7 @@ export default function HomeSidebar({
                   </svg>
                   {t('common.changePassword')}
                 </Button>
+              )}
               <Button
                 variant="ghost"
                 className="w-full justify-start font-normal"

web/src/app/infra/entities/api/index.ts

@@ -235,6 +235,7 @@ export interface ApiRespSystemInfo {
   version: string;
   cloud_service_url: string;
   enable_marketplace: boolean;
+  allow_change_password: boolean;
 }
 
 export interface ApiRespPluginSystemStatus {

web/src/app/infra/http/index.ts

@@ -8,6 +8,7 @@ export let systemInfo: ApiRespSystemInfo = {
   version: '',
   enable_marketplace: true,
   cloud_service_url: '',
+  allow_change_password: true,
 };
 
 /**