From a71a1e5c69bbca2f75ba06e0ac7bb0143a568d80 Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Tue, 24 May 2022 15:44:23 +0200
Subject: [PATCH] authenticators: forbid disabling all authenticators (#65642)

---
 .../authenticators/authenticator_detail.html         |  2 ++
 src/authentic2/apps/authenticators/views.py          |  7 +++++++
 tests/test_manager_authenticators.py                 | 12 +++++++++++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
index 54d3d5527..e8058403c 100644
--- a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
+++ b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
@@ -6,7 +6,9 @@
   <span class="actions">
     <a class="extra-actions-menu-opener"></a>
 
+    {% if can_be_toggled %}
     <a href="{% url 'a2-manager-authenticator-toggle' pk=object.pk %}">{{ object.enabled|yesno:_("Disable,Enable") }}</a>
+    {% endif %}
     <a href="{% url 'a2-manager-authenticator-edit' pk=object.pk %}">{% trans "Edit" %}</a>
     <ul class="extra-actions-menu">
       {% if not object.internal %}
diff --git a/src/authentic2/apps/authenticators/views.py b/src/authentic2/apps/authenticators/views.py
index 4f812d541..51107f5c4 100644
--- a/src/authentic2/apps/authenticators/views.py
+++ b/src/authentic2/apps/authenticators/views.py
@@ -58,6 +58,13 @@ class AuthenticatorDetailView(AuthenticatorsMixin, DetailView):
     def title(self):
         return str(self.object)
 
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['can_be_toggled'] = (
+            not self.object.enabled or BaseAuthenticator.objects.filter(enabled=True).count() > 1
+        )
+        return ctx
+
 
 detail = AuthenticatorDetailView.as_view()
 
diff --git a/tests/test_manager_authenticators.py b/tests/test_manager_authenticators.py
index 3cbbd0eb0..5ea33c173 100644
--- a/tests/test_manager_authenticators.py
+++ b/tests/test_manager_authenticators.py
@@ -73,13 +73,23 @@ def test_authenticators_password(app, superuser):
             "Show condition: &#x27;backoffice&#x27; in login_hint or remotre_addr == &#x27;1.2.3.4&#x27;"
             in resp.text
         )
+
+    # only one authenticator, it cannot be disabled
+    assert 'Disable' not in resp.text
+
+    # add one more
+    OIDCProvider.objects.create(slug='test', enabled=True)
+
+    resp = app.get('/manage/authenticators/')
+    resp = resp.click('Configure', index=0)
+
     resp = resp.click('Disable').follow()
     assert 'Authenticator has been disabled.' in resp.text
 
     resp = app.get('/manage/authenticators/')
     assert 'class="section disabled"' in resp.text
 
-    resp = resp.click('Configure')
+    resp = resp.click('Configure', index=1)
     resp = resp.click('Enable').follow()
     assert 'Authenticator has been enabled.' in resp.text
 
-- 
2.30.2