From 7ee2705a3b0d8daf4f588be8bf41e1f7a30a859f Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Tue, 24 May 2022 15:44:23 +0200
Subject: [PATCH] authenticators: forbid disabling all authenticators (#65642)

---
 .../authenticators/authenticator_detail.html   |  2 ++
 src/authentic2/apps/authenticators/views.py    |  7 ++++++-
 tests/test_manager_authenticators.py           | 18 ++++++++++--------
 3 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
index 54d3d5527..bd4c52d8a 100644
--- a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
+++ b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
@@ -6,7 +6,9 @@
   <span class="actions">
     <a class="extra-actions-menu-opener"></a>
 
+    {% if not object.internal %}
     <a href="{% url 'a2-manager-authenticator-toggle' pk=object.pk %}">{{ object.enabled|yesno:_("Disable,Enable") }}</a>
+    {% endif %}
     <a href="{% url 'a2-manager-authenticator-edit' pk=object.pk %}">{% trans "Edit" %}</a>
     <ul class="extra-actions-menu">
       {% if not object.internal %}
diff --git a/src/authentic2/apps/authenticators/views.py b/src/authentic2/apps/authenticators/views.py
index 4f812d541..822b6bce5 100644
--- a/src/authentic2/apps/authenticators/views.py
+++ b/src/authentic2/apps/authenticators/views.py
@@ -89,9 +89,14 @@ class AuthenticatorDeleteView(AuthenticatorsMixin, DeleteView):
 delete = AuthenticatorDeleteView.as_view()
 
 
-class AuthenticatorToggleView(DetailView):
+class AuthenticatorToggleView(AuthenticatorsMixin, DetailView):
     model = BaseAuthenticator
 
+    def dispatch(self, *args, **kwargs):
+        if self.get_object().internal:
+            raise PermissionDenied
+        return super().dispatch(*args, **kwargs)
+
     def get(self, request, *args, **kwargs):
         authenticator = self.get_object()
 
diff --git a/tests/test_manager_authenticators.py b/tests/test_manager_authenticators.py
index 3cbbd0eb0..5b20fb28e 100644
--- a/tests/test_manager_authenticators.py
+++ b/tests/test_manager_authenticators.py
@@ -73,15 +73,10 @@ def test_authenticators_password(app, superuser):
             "Show condition: &#x27;backoffice&#x27; in login_hint or remotre_addr == &#x27;1.2.3.4&#x27;"
             in resp.text
         )
-    resp = resp.click('Disable').follow()
-    assert 'Authenticator has been disabled.' in resp.text
-
-    resp = app.get('/manage/authenticators/')
-    assert 'class="section disabled"' in resp.text
 
-    resp = resp.click('Configure')
-    resp = resp.click('Enable').follow()
-    assert 'Authenticator has been enabled.' in resp.text
+    # password authenticator cannot be disabled
+    assert 'Disable' not in resp.text
+    app.get('/manage/authenticators/1/toggle/', status=403)
 
     # cannot add another password authenticator
     resp = app.get('/manage/authenticators/add/')
@@ -148,6 +143,13 @@ def test_authenticators_oidc(app, superuser, ou1, ou2):
     assert 'This field is required' in resp.text
 
     resp = app.get('/manage/authenticators/')
+    resp = resp.click('Configure', index=1)
+    resp = resp.click('Disable').follow()
+    assert 'Authenticator has been disabled.' in resp.text
+
+    resp = app.get('/manage/authenticators/')
+    assert 'class="section disabled"' in resp.text
+
     resp = resp.click('Configure', index=1)
     resp = resp.click('Delete')
     resp = resp.form.submit().follow()
-- 
2.30.2