From 579bcaba06577c0299b7370e6a246a600c7d0560 Mon Sep 17 00:00:00 2001
From: Thomas Citharel <tcit@tcit.fr>
Date: Fri, 28 Oct 2022 16:05:55 +0200
Subject: [PATCH] Allow to disable non-SSO login

With a new disable_database_login parameter under :mobilizon, :instance

Closes #1154

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
---
 config/config.exs                   |  1 +
 js/src/components/NavBar.vue        | 18 +++++++++++-------
 js/src/composition/apollo/config.ts |  7 ++++++-
 js/src/graphql/config.ts            |  5 +++++
 js/src/types/config.model.ts        |  1 +
 js/src/views/User/LoginView.vue     | 24 ++++++++++++++----------
 lib/graphql/resolvers/config.ex     |  2 ++
 lib/graphql/schema/config.ex        |  1 +
 8 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index b28988f3..fef8c6dd 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -19,6 +19,7 @@ config :mobilizon, :instance,
   registrations_open: false,
   registration_email_allowlist: [],
   registration_email_denylist: [],
+  disable_database_login: false,
   languages: [],
   default_language: "en",
   demo: false,
diff --git a/js/src/components/NavBar.vue b/js/src/components/NavBar.vue
index fe6dfccd..0db9c3b6 100644
--- a/js/src/components/NavBar.vue
+++ b/js/src/components/NavBar.vue
@@ -185,11 +185,7 @@
               >{{ t("Login") }}</router-link
             >
           </li>
-          <li
-            v-if="
-              !currentActor?.id && (registrationsOpen || registrationsAllowlist)
-            "
-          >
+          <li v-if="!currentActor?.id && canRegister">
             <router-link
               :to="{ name: RouteName.REGISTER }"
               class="block py-2 pr-4 pl-3 text-zinc-700 border-b border-gray-100 hover:bg-zinc-50 md:hover:bg-transparent md:border-0 md:hover:text-mbz-purple-700 md:p-0 dark:text-zinc-400 md:dark:hover:text-white dark:hover:bg-zinc-700 dark:hover:text-white md:dark:hover:bg-transparent dark:border-gray-700"
@@ -378,7 +374,7 @@ import { ICurrentUserRole } from "@/types/enums";
 import { logout } from "../utils/auth";
 import { displayName } from "../types/actor";
 import RouteName from "../router/name";
-import { ref, watch } from "vue";
+import { computed, ref, watch } from "vue";
 import { useRouter } from "vue-router";
 import { useI18n } from "vue-i18n";
 import AccountCircle from "vue-material-design-icons/AccountCircle.vue";
@@ -404,7 +400,15 @@ const router = useRouter();
 // const route = useRoute();
 
 const { identities } = useCurrentUserIdentities();
-const { registrationsOpen, registrationsAllowlist } = useRegistrationConfig();
+const { registrationsOpen, registrationsAllowlist, databaseLogin } =
+  useRegistrationConfig();
+
+const canRegister = computed(() => {
+  return (
+    (registrationsOpen.value || registrationsAllowlist.value) &&
+    databaseLogin.value
+  );
+});
 
 // const mobileNavbarActive = ref(false);
 
diff --git a/js/src/composition/apollo/config.ts b/js/src/composition/apollo/config.ts
index b040535d..06c28a29 100644
--- a/js/src/composition/apollo/config.ts
+++ b/js/src/composition/apollo/config.ts
@@ -208,7 +208,10 @@ export function useSearchConfig() {
 
 export function useRegistrationConfig() {
   const { result, error, loading, onResult } = useQuery<{
-    config: Pick<IConfig, "registrationsOpen" | "registrationsAllowlist">;
+    config: Pick<
+      IConfig,
+      "registrationsOpen" | "registrationsAllowlist" | "auth"
+    >;
   }>(REGISTRATIONS, undefined, { fetchPolicy: "cache-only" });
 
   const registrationsOpen = computed(
@@ -217,9 +220,11 @@ export function useRegistrationConfig() {
   const registrationsAllowlist = computed(
     () => result.value?.config.registrationsAllowlist
   );
+  const databaseLogin = computed(() => result.value?.config.auth.databaseLogin);
   return {
     registrationsOpen,
     registrationsAllowlist,
+    databaseLogin,
     error,
     loading,
     onResult,
diff --git a/js/src/graphql/config.ts b/js/src/graphql/config.ts
index 65dc681b..b55fb06d 100644
--- a/js/src/graphql/config.ts
+++ b/js/src/graphql/config.ts
@@ -79,6 +79,7 @@ export const CONFIG = gql`
       }
       auth {
         ldap
+        databaseLogin
         oauthProviders {
           id
           label
@@ -386,6 +387,7 @@ export const LOGIN_CONFIG = gql`
   query LoginConfig {
     config {
       auth {
+        databaseLogin
         oauthProviders {
           id
           label
@@ -450,6 +452,9 @@ export const REGISTRATIONS = gql`
     config {
       registrationsOpen
       registrationsAllowlist
+      auth {
+        databaseLogin
+      }
     }
   }
 `;
diff --git a/js/src/types/config.model.ts b/js/src/types/config.model.ts
index e2ed7599..60ae7fc1 100644
--- a/js/src/types/config.model.ts
+++ b/js/src/types/config.model.ts
@@ -106,6 +106,7 @@ export interface IConfig {
   version: string;
   auth: {
     ldap: boolean;
+    databaseLogin: boolean;
     oauthProviders: IOAuthProvider[];
   };
   uploadLimits: {
diff --git a/js/src/views/User/LoginView.vue b/js/src/views/User/LoginView.vue
index ad7964ef..78a89be3 100644
--- a/js/src/views/User/LoginView.vue
+++ b/js/src/views/User/LoginView.vue
@@ -42,7 +42,7 @@
     >
       {{ error }}
     </o-notification>
-    <form @submit="loginAction">
+    <form @submit="loginAction" v-if="config?.auth.databaseLogin">
       <o-field
         :label="t('Email')"
         label-for="email"
@@ -81,13 +81,6 @@
       </p>
       <!-- <o-loading :is-full-page="false" v-model="submitted" /> -->
 
-      <div
-        class="control"
-        v-if="config && config?.auth.oauthProviders.length > 0"
-      >
-        <auth-providers :oauthProviders="config.auth.oauthProviders" />
-      </div>
-
       <div class="flex flex-wrap gap-2 mt-3">
         <o-button
           tag="router-link"
@@ -107,7 +100,12 @@
           }"
           >{{ t("Didn't receive the instructions?") }}</o-button
         >
-        <p class="control" v-if="config && config.registrationsOpen">
+        <p
+          class="control"
+          v-if="
+            config && config.registrationsOpen && config.registrationsAllowlist
+          "
+        >
           <o-button
             tag="router-link"
             variant="text"
@@ -123,6 +121,9 @@
         </p>
       </div>
     </form>
+    <div v-if="config && config?.auth.oauthProviders.length > 0">
+      <auth-providers :oauthProviders="config.auth.oauthProviders" />
+    </div>
   </section>
 </template>
 
@@ -162,7 +163,10 @@ const route = useRoute();
 const { currentUser } = useCurrentUserClient();
 
 const { result: configResult } = useQuery<{
-  config: Pick<IConfig, "auth" | "registrationsOpen">;
+  config: Pick<
+    IConfig,
+    "auth" | "registrationsOpen" | "registrationsAllowlist"
+  >;
 }>(LOGIN_CONFIG);
 
 const config = computed(() => configResult.value?.config);
diff --git a/lib/graphql/resolvers/config.ex b/lib/graphql/resolvers/config.ex
index e35b26fe..9fe01d8f 100644
--- a/lib/graphql/resolvers/config.ex
+++ b/lib/graphql/resolvers/config.ex
@@ -156,6 +156,8 @@ defmodule Mobilizon.GraphQL.Resolvers.Config do
       federating: Config.instance_federating(),
       auth: %{
         ldap: Config.ldap_enabled?(),
+        database_login:
+          Application.get_env(:mobilizon, :instance) |> get_in([:disable_database_login]) == false,
         oauth_providers: Config.oauth_consumer_strategies()
       },
       upload_limits: %{
diff --git a/lib/graphql/schema/config.ex b/lib/graphql/schema/config.ex
index 27561783..ca8880d0 100644
--- a/lib/graphql/schema/config.ex
+++ b/lib/graphql/schema/config.ex
@@ -305,6 +305,7 @@ defmodule Mobilizon.GraphQL.Schema.ConfigType do
   """
   object :auth do
     field(:ldap, :boolean, description: "Whether or not LDAP auth is enabled")
+    field(:database_login, :boolean, description: "Whether or not database login is enabled")
     field(:oauth_providers, list_of(:oauth_provider), description: "List of oauth providers")
   end