prevent login and password reset for system accounts

packages/backend/src/server/api/SigninApiService.ts

@@ -26,6 +26,7 @@ import { RateLimiterService } from './RateLimiterService.js';
 import { SigninService } from './SigninService.js';
 import type { AuthenticationResponseJSON } from '@simplewebauthn/types';
 import type { FastifyReply, FastifyRequest } from 'fastify';
+import { isSystemAccount } from '@/misc/is-system-account.js';
 
 @Injectable()
 export class SigninApiService {
@@ -125,6 +126,12 @@ export class SigninApiService {
 			});
 		}
 
+		if (isSystemAccount(user)) {
+			return error(403, {
+				id: 's8dhsj9s-a93j-493j-ja9k-kas9sj20aml2',
+			});
+		}
+
 		const profile = await this.userProfilesRepository.findOneByOrFail({ userId: user.id });
 
 		if (!user.approved && instance.approvalRequiredForSignup) {

packages/backend/src/server/api/endpoints/admin/reset-password.ts

@@ -11,6 +11,7 @@ import type { UsersRepository, UserProfilesRepository } from '@/models/_.js';
 import { DI } from '@/di-symbols.js';
 import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
+import { isSystemAccount } from '@/misc/is-system-account.js';
 
 export const meta = {
 	tags: ['admin'],
@@ -63,6 +64,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				throw new Error('cannot reset password of root');
 			}
 
+			if (isSystemAccount(user)) {
+				throw new Error('cannot reset password of system account');
+			}
+
 			const passwd = secureRndstr(8);
 
 			// Generate hash of password