Refactor demo login as an authentication method

Use the authentication method system for the demo login and the
generated accounts.  This makes it possible to toggle it off on
production systems as these shouldn't have it enabled at all.

server/api/auth/account.post.ts

@@ -15,8 +15,8 @@ export default defineEventHandler(async (event): Promise<ApiSession> => {
 		});
 	}
 
-	const formData = await readBody(event);
-	const name = formData.name;
+	const body = await readBody(event);
+	const name = body?.name;
 
 	const users = await readUsers();
 	let user: ServerUser;
@@ -42,7 +42,7 @@ export default defineEventHandler(async (event): Promise<ApiSession> => {
 			name,
 		};
 
-	} else if (name === null) {
+	} else if (name === undefined) {
 		user = {
 			id: await nextUserId(),
 			updatedAt: new Date().toISOString(),
@@ -55,7 +55,14 @@ export default defineEventHandler(async (event): Promise<ApiSession> => {
 		});
 	}
 
-	if (session?.authenticationProvider) {
+	if (user.type !== "anonymous") {
+		if (!session?.authenticationProvider) {
+			throw createError({
+				statusCode: 409,
+				statusMessage: "Conflict",
+				message: "User account need an authentication method associated with it.",
+			});
+		}
 		const authMethods = await readAuthenticationMethods();
 		const method = authMethods.find(method => (
 			method.provider === session.authenticationProvider

server/api/auth/ap/demo-login.post.ts

@@ -0,0 +1,38 @@
+/*
+	SPDX-FileCopyrightText: © 2025 Hornwitser <code@hornwitser.no>
+	SPDX-License-Identifier: AGPL-3.0-or-later
+*/
+import { readAuthenticationMethods, readUsers } from "~/server/database";
+
+export default defineEventHandler(async (event) => {
+	const runtimeConfig = useRuntimeConfig(event);
+	if (!runtimeConfig.public.authDemoEnabled) {
+		throw createError({
+			statusCode: 403,
+			statusMessage: "Forbidden",
+			message: "Demo authentication is disabled",
+		});
+	}
+
+	const { name: slug } = await readBody(event);
+
+	if (typeof slug !== "string" || !slug) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Bad Request",
+			message: "Missing name",
+		});
+	}
+
+	const authMethods = await readAuthenticationMethods();
+	const method = authMethods.find(method => method.provider === "demo" && method.slug === slug);
+	let session;
+	if (method) {
+		const users = await readUsers();
+		const account = users.find(user => !user.deleted && user.id === method.userId);
+		session = await setServerSession(event, account);
+	} else {
+		session = await setServerSession(event, undefined, "demo", slug, slug);
+	}
+	return await serverSessionToApi(event, session);
+})

server/api/auth/login.post.ts

@@ -1,22 +0,0 @@
-/*
-	SPDX-FileCopyrightText: © 2025 Hornwitser <code@hornwitser.no>
-	SPDX-License-Identifier: AGPL-3.0-or-later
-*/
-import { readUsers } from "~/server/database";
-
-export default defineEventHandler(async (event) => {
-	const { name } = await readBody(event);
-
-	if (!name) {
-		return new Response(undefined, { status: 400 })
-	}
-
-	const accounts = await readUsers();
-	const account = accounts.find(a => a.name === name);
-
-	if (!account) {
-		return new Response(undefined, { status: 403 })
-	}
-
-	await setServerSession(event, account);
-})