From c88e9e2921098e85475d229b4447aa20b0e87ab0 Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Tue, 24 May 2022 15:44:23 +0200
Subject: [PATCH] authenticators: forbid disabling all authenticators (#65642)

---
 .../authenticators/authenticator_detail.html    |  2 ++
 tests/test_manager_authenticators.py            | 17 +++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
index 54d3d5527..bd4c52d8a 100644
--- a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
+++ b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
@@ -6,7 +6,9 @@
   <span class="actions">
     <a class="extra-actions-menu-opener"></a>
 
+    {% if not object.internal %}
     <a href="{% url 'a2-manager-authenticator-toggle' pk=object.pk %}">{{ object.enabled|yesno:_("Disable,Enable") }}</a>
+    {% endif %}
     <a href="{% url 'a2-manager-authenticator-edit' pk=object.pk %}">{% trans "Edit" %}</a>
     <ul class="extra-actions-menu">
       {% if not object.internal %}
diff --git a/tests/test_manager_authenticators.py b/tests/test_manager_authenticators.py
index 3cbbd0eb0..6b1e9feae 100644
--- a/tests/test_manager_authenticators.py
+++ b/tests/test_manager_authenticators.py
@@ -73,15 +73,9 @@ def test_authenticators_password(app, superuser):
             "Show condition: &#x27;backoffice&#x27; in login_hint or remotre_addr == &#x27;1.2.3.4&#x27;"
             in resp.text
         )
-    resp = resp.click('Disable').follow()
-    assert 'Authenticator has been disabled.' in resp.text
-
-    resp = app.get('/manage/authenticators/')
-    assert 'class="section disabled"' in resp.text
 
-    resp = resp.click('Configure')
-    resp = resp.click('Enable').follow()
-    assert 'Authenticator has been enabled.' in resp.text
+    # password authenticator cannot be disabled
+    assert 'Disable' not in resp.text
 
     # cannot add another password authenticator
     resp = app.get('/manage/authenticators/add/')
@@ -148,6 +142,13 @@ def test_authenticators_oidc(app, superuser, ou1, ou2):
     assert 'This field is required' in resp.text
 
     resp = app.get('/manage/authenticators/')
+    resp = resp.click('Configure', index=1)
+    resp = resp.click('Disable').follow()
+    assert 'Authenticator has been disabled.' in resp.text
+
+    resp = app.get('/manage/authenticators/')
+    assert 'class="section disabled"' in resp.text
+
     resp = resp.click('Configure', index=1)
     resp = resp.click('Delete')
     resp = resp.form.submit().follow()
-- 
2.30.2