[giang17]

Closes #778.

Change: With OIDC enabled and OIDC_DISABLE_LOCAL_AUTH set, the endpoints that take a password return 405:

• registration (POST /api/users/<user_name>/register/, "Registration is disabled"), checked before the tree argument;
• adding a user, create_owner, changing the password and the password reset (trigger, form and submit), "Local authentication is disabled"; the reset trigger sends no email.

The condition is is_local_auth_disabled() in auth/oidc_helpers.py, now shared by the token, OIDC config, OIDC accounts and user endpoints. It requires OIDC_ENABLED in addition to OIDC_DISABLE_LOCAL_AUTH, as the token endpoint did before: while OIDC is disabled, OIDC_DISABLE_LOCAL_AUTH has no effect on password login.

Tests: One test per endpoint in tests/test_endpoints/test_user.py: with both settings, 405 and no change to users or passwords; with only OIDC_DISABLE_LOCAL_AUTH, the request succeeds. Removing any single check makes its test fail. Full suite without addons installed, as in CI: 2784 passed, 15 skipped.

Drafted with Claude Code (AI assistant).

[DavidMStraub]

Thanks!

Review suggestion:

1. Shared helper. is_oidc_enabled() and current_app.config.get("OIDC_DISABLE_LOCAL_AUTH", False) now appears in four places (token.py, oidc_accounts.py, oidc.py, and now user.py). Could we move it into a helper such as is_local_auth_disabled() in auth/oidc_helpers.py? Registration and login need to agree, and copies of the check could drift apart.

2. Other password flows. Password reset (trigger and reset), change password, create_owner with a password, and admin user creation with a password still accept passwords that can never be used to log in. It would make sense to gate them on the same check, here or in a follow-up PR.

3. Test. The disabled-case test should also assert that no email is sent (e.g. mock_smtp.assert_not_called()).

4. Check order. In multi-tree setups, a request without a tree gets a 422 "tree is required" before the disabled check runs. Moving the disabled check first would return 405 consistently.

[giang17]

All four points are addressed in d177f2b and 7d2c613.

1. is_local_auth_disabled() in auth/oidc_helpers.py replaces the four copies in token.py, oidc.py, oidc_accounts.py and user.py. oidc.py read OIDC_DISABLE_LOCAL_AUTH without is_oidc_enabled(), but only after returning early when OIDC is disabled, so the /oidc/config/ response is unchanged. Six tests patched is_oidc_enabled in the resource modules; they now patch it in oidc_helpers, so they still cover the combination of both settings.
2. abort_if_local_auth_disabled() in user.py returns 405 ("Local authentication is disabled") for adding a user (POST /users/<user_name>/, which requires a password), create_owner, changing the password and the password reset (trigger, form and submit); the trigger sends no email. The status is 405 as for registration; the token endpoint keeps its 403. Bulk creation (POST /users/) takes no passwords and is unchanged. For create_owner, no working path is lost: OIDC logins are matched by sub only (create_or_update_oidc_user), so an owner created there could not log in without local authentication before either. A new setup without local authentication needs an OIDC_GROUP_* mapping for its first owner, as before.
3. While registration is disabled, the test asserts mock_smtp.assert_not_called(). After the successful registration it asserts that one message was sent, so the first assertion does not pass merely because no email is sent in tests at all.
4. _is_disabled now runs before the tree check. Without a tree, get_number_users(tree=None, …) counts the owners of all trees. The test posts once without a tree: 405, and 422 with the previous order.

Each new check has a test that fails when the check is removed. Full suite without addons installed, as in CI: 2784 passed, 15 skipped.

Drafted with Claude Code (AI assistant).