snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/password/strategy_disabled_test.go

@@ -0,0 +1,82 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package password_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/pkg/testhelpers"
+	"github.com/ory/x/configx"
+)
+
+func TestDisabledEndpoint(t *testing.T) {
+	t.Parallel()
+
+	conf, reg := pkg.NewFastRegistryWithMocks(t,
+		configx.WithValues(testhelpers.MethodEnableConfig(identity.CredentialsTypePassword, false)),
+		configx.WithValues(testhelpers.DefaultIdentitySchemaConfig("file://stub/sort.schema.json")),
+	)
+
+	publicTS, _ := testhelpers.NewKratosServer(t, reg)
+
+	c := testhelpers.NewClientWithCookies(t)
+	t.Run("case=should not login when password method is disabled", func(t *testing.T) {
+		f := testhelpers.InitializeLoginFlowViaAPICtx(context.Background(), t, c, publicTS, false)
+
+		res, err := c.PostForm(f.Ui.Action, url.Values{"method": {"password"}, "password_identifier": []string{"identifier"}, "password": []string{"password"}})
+		require.NoError(t, err)
+		defer func() { _ = res.Body.Close() }()
+		assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+		b, err := io.ReadAll(res.Body)
+		require.NoError(t, err)
+		assert.Contains(t, string(b), "This endpoint was disabled by system administrator", "%s", b)
+	})
+
+	t.Run("case=should not registration when password method is disabled", func(t *testing.T) {
+		f := testhelpers.InitializeRegistrationFlowViaAPICtx(t.Context(), t, c, publicTS)
+
+		res, err := c.PostForm(f.Ui.Action, url.Values{"method": {"password"}, "password_identifier": []string{"identifier"}, "password": []string{"password"}})
+		require.NoError(t, err)
+		defer func() { _ = res.Body.Close() }()
+		assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+		b, err := io.ReadAll(res.Body)
+		require.NoError(t, err)
+		assert.Contains(t, string(b), "This endpoint was disabled by system administrator", "%s", b)
+	})
+
+	t.Run("case=should not settings when password method is disabled", func(t *testing.T) {
+		testhelpers.SetDefaultIdentitySchema(conf, "file://stub/login.schema.json")
+		c := testhelpers.NewHTTPClientWithArbitrarySessionCookie(context.Background(), t, reg)
+
+		t.Run("method=GET", func(t *testing.T) {
+			t.Skip("GET is currently not supported for this endpoint.")
+		})
+
+		t.Run("method=POST", func(t *testing.T) {
+			f := testhelpers.InitializeSettingsFlowViaAPI(t, c, publicTS)
+			res, err := c.PostForm(f.Ui.Action, url.Values{
+				"method":   {"password"},
+				"password": {"bar"},
+			})
+			require.NoError(t, err)
+			defer func() { _ = res.Body.Close() }()
+			assert.Equal(t, http.StatusNotFound, res.StatusCode)
+
+			b, err := io.ReadAll(res.Body)
+			require.NoError(t, err)
+			assert.Contains(t, string(b), "This endpoint was disabled by system administrator", "%s", b)
+		})
+	})
+}