From 0ef9231fae21e750eeaad7c1bb6d763197838e6a Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:13:20 +0200
Subject: [PATCH] Improve error message when the account does not define a
 password

---
 crates/common/src/auth/oauth/mod.rs   |  2 +-
 crates/common/src/auth/oauth/token.rs | 29 +++++++++++++++++----------
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/crates/common/src/auth/oauth/mod.rs b/crates/common/src/auth/oauth/mod.rs
index a2fca70d..55e5bfa4 100644
--- a/crates/common/src/auth/oauth/mod.rs
+++ b/crates/common/src/auth/oauth/mod.rs
@@ -14,7 +14,7 @@ pub mod token;
 pub const DEVICE_CODE_LEN: usize = 40;
 pub const USER_CODE_LEN: usize = 8;
 pub const RANDOM_CODE_LEN: usize = 32;
-pub const CLIENT_ID_MAX_LEN: usize = 60;
+pub const CLIENT_ID_MAX_LEN: usize = 100;
 
 pub const USER_CODE_ALPHABET: &[u8] = b"ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; // No 0, O, I, 1
 
diff --git a/crates/common/src/auth/oauth/token.rs b/crates/common/src/auth/oauth/token.rs
index 5d55e5a0..6c41388d 100644
--- a/crates/common/src/auth/oauth/token.rs
+++ b/crates/common/src/auth/oauth/token.rs
@@ -224,20 +224,27 @@ impl Server {
 
     pub async fn password_hash(&self, account_id: u32) -> trc::Result<String> {
         if account_id != u32::MAX {
-            self.registry()
+            let Some(account) = self
+                .registry()
                 .object::<Account>(account_id.into())
                 .await
                 .caused_by(trc::location!())?
-                .and_then(|account| {
-                    account
-                        .into_user()
-                        .and_then(|account| account.into_password())
-                })
-                .ok_or_else(|| {
-                    trc::AuthEvent::Error
-                        .into_err()
-                        .details("Account no longer exists")
-                })
+            else {
+                return Err(trc::AuthEvent::Error
+                    .into_err()
+                    .details("Account no longer exists"));
+            };
+            let Some(account) = account.into_user() else {
+                return Err(trc::AuthEvent::Error
+                    .into_err()
+                    .details("Account is not a user"));
+            };
+            account.into_password().ok_or_else(|| {
+                trc::AuthEvent::Error.into_err().details(concat!(
+                    "Account does not have a password. ",
+                    "If you are using an external directory, make sure to set the password attribute."
+                ))
+            })
         } else if let Some((_, secret)) = self.registry().recovery_admin() {
             Ok(secret.into())
         } else {