From 5ae3249c36c2baf98cf7d637acd55121a8294cee Mon Sep 17 00:00:00 2001
From: Jo <joao.guerreiro@grafana.com>
Date: Thu, 4 Jan 2024 10:46:55 +0100
Subject: [PATCH] Auth: Hide forgot password if grafana auth is disabled
 (#79895)

* hide forgot password if grafana auth is disabled

* fix test
---
 packages/grafana-data/src/types/config.ts      |  2 ++
 pkg/api/dtos/frontend_settings.go              |  2 ++
 pkg/api/frontendsettings.go                    |  1 +
 pkg/setting/setting.go                         |  2 +-
 .../core/components/Login/LoginPage.test.tsx   |  3 +++
 public/app/core/components/Login/LoginPage.tsx | 18 ++++++++++--------
 6 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/packages/grafana-data/src/types/config.ts b/packages/grafana-data/src/types/config.ts
index 3c27a4218c6..d6dfa26ab1f 100644
--- a/packages/grafana-data/src/types/config.ts
+++ b/packages/grafana-data/src/types/config.ts
@@ -259,4 +259,6 @@ export interface AuthSettings {
   GoogleSkipOrgRoleSync?: boolean;
   // @deprecated -- this is no longer used and will be removed in Grafana 11
   GenericOAuthSkipOrgRoleSync?: boolean;
+
+  disableLogin?: boolean;
 }
diff --git a/pkg/api/dtos/frontend_settings.go b/pkg/api/dtos/frontend_settings.go
index 5d60f6e320a..52f0a453161 100644
--- a/pkg/api/dtos/frontend_settings.go
+++ b/pkg/api/dtos/frontend_settings.go
@@ -29,6 +29,8 @@ type FrontendSettingsAuthDTO struct {
 	GitLabSkipOrgRoleSync bool `json:"GitLabSkipOrgRoleSync"`
 	// Deprecated: this is no longer used and will be removed in Grafana 11
 	OktaSkipOrgRoleSync bool `json:"OktaSkipOrgRoleSync"`
+
+	DisableLogin bool `json:"disableLogin"`
 }
 
 type FrontendSettingsBuildInfoDTO struct {
diff --git a/pkg/api/frontendsettings.go b/pkg/api/frontendsettings.go
index e4dc720273b..d91f0b5e461 100644
--- a/pkg/api/frontendsettings.go
+++ b/pkg/api/frontendsettings.go
@@ -329,6 +329,7 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
 		GithubSkipOrgRoleSync:       parseSkipOrgRoleSyncEnabled(oauthProviders[social.GitHubProviderName]),
 		GitLabSkipOrgRoleSync:       parseSkipOrgRoleSyncEnabled(oauthProviders[social.GitlabProviderName]),
 		OktaSkipOrgRoleSync:         parseSkipOrgRoleSyncEnabled(oauthProviders[social.OktaProviderName]),
+		DisableLogin:                hs.Cfg.DisableLogin,
 	}
 
 	if hs.pluginsCDNService != nil && hs.pluginsCDNService.IsEnabled() {
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index ed27c66ebb5..5d64662721a 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -551,7 +551,7 @@ type Cfg struct {
 // AddChangePasswordLink returns if login form is disabled or not since
 // the same intention can be used to hide both features.
 func (cfg *Cfg) AddChangePasswordLink() bool {
-	return !cfg.DisableLoginForm
+	return !(cfg.DisableLoginForm || cfg.DisableLogin)
 }
 
 type CommandLineArgs struct {
diff --git a/public/app/core/components/Login/LoginPage.test.tsx b/public/app/core/components/Login/LoginPage.test.tsx
index 7a647e35f56..17d6a0fd86f 100644
--- a/public/app/core/components/Login/LoginPage.test.tsx
+++ b/public/app/core/components/Login/LoginPage.test.tsx
@@ -14,6 +14,9 @@ jest.mock('@grafana/runtime', () => ({
     post: postMock,
   }),
   config: {
+    auth: {
+      disableLogin: false,
+    },
     loginError: false,
     buildInfo: {
       version: 'v1.0',
diff --git a/public/app/core/components/Login/LoginPage.tsx b/public/app/core/components/Login/LoginPage.tsx
index cc408a17a43..07c1435a613 100644
--- a/public/app/core/components/Login/LoginPage.tsx
+++ b/public/app/core/components/Login/LoginPage.tsx
@@ -4,9 +4,9 @@ import React from 'react';
 
 // Components
 import { GrafanaTheme2 } from '@grafana/data';
+import { config } from '@grafana/runtime';
 import { Alert, HorizontalGroup, LinkButton, useStyles2 } from '@grafana/ui';
 import { Branding } from 'app/core/components/Branding/Branding';
-import config from 'app/core/config';
 import { t } from 'app/core/internationalization';
 
 import { ChangePassword } from '../ForgottenPassword/ChangePassword';
@@ -48,13 +48,15 @@ export const LoginPage = () => {
               {!disableLoginForm && (
                 <LoginForm onSubmit={login} loginHint={loginHint} passwordHint={passwordHint} isLoggingIn={isLoggingIn}>
                   <HorizontalGroup justify="flex-end">
-                    <LinkButton
-                      className={styles.forgottenPassword}
-                      fill="text"
-                      href={`${config.appSubUrl}/user/password/send-reset-email`}
-                    >
-                      Forgot your password?
-                    </LinkButton>
+                    {!config.auth.disableLogin && (
+                      <LinkButton
+                        className={styles.forgottenPassword}
+                        fill="text"
+                        href={`${config.appSubUrl}/user/password/send-reset-email`}
+                      >
+                        Forgot your password?
+                      </LinkButton>
+                    )}
                   </HorizontalGroup>
                 </LoginForm>
               )}