fix basic auth (#2505)

backend/danswer/auth/users.py

@@ -300,17 +300,27 @@ class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
     async def authenticate(
         self, credentials: OAuth2PasswordRequestForm
     ) -> Optional[User]:
-        user = await super().authenticate(credentials)
+        try:
-        if user is None:
+            user = await self.get_by_email(credentials.username)
-            try:
+        except exceptions.UserNotExists:
-                user = await self.get_by_email(credentials.username)
+            self.password_helper.hash(credentials.password)
-                if not user.has_web_login:
+            return None
-                    raise HTTPException(
+
-                        status_code=status.HTTP_403_FORBIDDEN,
+        if not user.has_web_login:
-                        detail="NO_WEB_LOGIN_AND_HAS_NO_PASSWORD",
+            raise HTTPException(
-                    )
+                status_code=status.HTTP_403_FORBIDDEN,
-            except exceptions.UserNotExists:
+                detail="NO_WEB_LOGIN_AND_HAS_NO_PASSWORD",
-                pass
+            )
+
+        verified, updated_password_hash = self.password_helper.verify_and_update(
+            credentials.password, user.hashed_password
+        )
+        if not verified:
+            return None
+
+        if updated_password_hash is not None:
+            await self.user_db.update(user, {"hashed_password": updated_password_hash})
+
         return user
 
 

web/src/lib/user.ts

@@ -31,6 +31,7 @@ export const basicLogin = async (
     ["username", email],
     ["password", password],
   ]);
+
   const response = await fetch("/api/auth/login", {
     method: "POST",
     credentials: "include",