Split login_via_existing_session conf item to login_via_token.

Signed-off-by: Jason Volk <jason@zemos.net>

src/api/client/session/token.rs

@@ -22,7 +22,7 @@ pub(super) async fn handle_login(
 ) -> Result<OwnedUserId> {
 	let Token { token } = info;
 
-	if !services.config.login_via_existing_session {
+	if !services.config.login_via_token {
 		return Err!(Request(Unknown("Token login is not enabled.")));
 	}
 
@@ -41,7 +41,7 @@ pub(crate) async fn login_token_route(
 	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
-	if !services.config.login_via_existing_session {
+	if !services.config.login_via_existing_session || !services.config.login_via_token {
 		return Err!(Request(Forbidden("Login via an existing session is not enabled")));
 	}
 

src/core/config/mod.rs

@@ -954,11 +954,25 @@ pub struct Config {
 	/// Allow an existing session to mint a login token for another client.
 	/// This requires interactive authentication, but has security ramifications
 	/// as a malicious client could use the mechanism to spawn more than one
-	/// session.
-	/// Enabled by default.
+	/// session. Enabled by default.
+	///
+	/// default: true
 	#[serde(default = "true_fn")]
 	pub login_via_existing_session: bool,
 
+	/// Whether to enable the login token route to accept login tokens at all.
+	/// Login tokens may be generated by the server for authorization flows such
+	/// as SSO; disabling tokens may break such features.
+	///
+	/// This option is distinct from `login_via_existing_session` and does not
+	/// carry the same security implications; the intent is to leave this
+	/// enabled while disabling the former to prevent clients from commanding
+	/// login token creation but without preventing the server from doing so.
+	///
+	/// default: true
+	#[serde(default = "true_fn")]
+	pub login_via_token: bool,
+
 	/// Login token expiration/TTL in milliseconds.
 	///
 	/// These are short-lived tokens for the m.login.token endpoint.

tuwunel-example.toml

@@ -785,11 +785,21 @@
 # Allow an existing session to mint a login token for another client.
 # This requires interactive authentication, but has security ramifications
 # as a malicious client could use the mechanism to spawn more than one
-# session.
-# Enabled by default.
+# session. Enabled by default.
 #
 #login_via_existing_session = true
 
+# Whether to enable the login token route to accept login tokens at all.
+# Login tokens may be generated by the server for authorization flows such
+# as SSO; disabling tokens may break such features.
+#
+# This option is distinct from `login_via_existing_session` and does not
+# carry the same security implications; the intent is to leave this
+# enabled while disabling the former to prevent clients from commanding
+# login token creation but without preventing the server from doing so.
+#
+#login_via_token = true
+
 # Login token expiration/TTL in milliseconds.
 #
 # These are short-lived tokens for the m.login.token endpoint.