[backend] fix migration for local strategy (#14737)

opencti-platform/opencti-graphql/src/modules/authenticationProvider/authenticationProvider-migration.ts

@@ -17,6 +17,11 @@ import nconf from 'nconf';
 import { getSettings, updateCertAuth, updateHeaderAuth, updateLocalAuth } from '../../domain/settings';
 import type { BasicStoreSettings } from '../../types/settings';
 
+export const isLocalAuthEnabledInEnv = (envProviders: Record<string, any>): boolean => {
+  const local = envProviders['local'];
+  return local?.config?.disabled !== true;
+};
+
 // ---------------------------------------------------------------------------
 // Provider type mapping
 // ---------------------------------------------------------------------------
@@ -64,11 +69,10 @@ const parseMappingStrings = (mapping: any) => {
  */
 const migrateLocalAuthIfNeeded = async (context: AuthContext, user: AuthUser) => {
   const settings = await getSettings(context) as unknown as BasicStoreSettings;
+  const envConfigurations = nconf.get('providers') ?? {};
   if (!settings.local_auth) {
-    const envConfigurations = nconf.get('providers') ?? {};
-    const local = envConfigurations['local'];
     logApp.info('[SINGLETON-MIGRATION] local_auth is absent, creating with defaults');
-    await updateLocalAuth(context, user, settings.id, { enabled: local?.enabled ?? true });
+    await updateLocalAuth(context, user, settings.id, { enabled: isLocalAuthEnabledInEnv(envConfigurations) });
     logApp.info('[SINGLETON-MIGRATION] local_auth successfully ensured');
   }
 };

opencti-platform/opencti-graphql/tests/01-unit/modules/authenticationProvider/authenticationProvider-migration-test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { isLocalAuthEnabledInEnv } from '../../../../src/modules/authenticationProvider/authenticationProvider-migration';
+
+// ==========================================================================
+// resolveLocalAuthEnabled
+// ==========================================================================
+
+describe('resolveLocalAuthEnabled', () => {
+  it('should return true when no local provider is configured', () => {
+    expect(isLocalAuthEnabledInEnv({})).toBe(true);
+  });
+
+  it('should return true when local provider exists but disabled is not set', () => {
+    const providers = { local: { strategy: 'LocalStrategy', config: {} } };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(true);
+  });
+
+  it('should return true when local provider disabled is explicitly false', () => {
+    const providers = { local: { strategy: 'LocalStrategy', config: { disabled: false } } };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(true);
+  });
+
+  it('should return false when local provider disabled is explicitly true', () => {
+    const providers = { local: { strategy: 'LocalStrategy', config: { disabled: true } } };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(false);
+  });
+
+  it('should return true when local provider has no config property', () => {
+    const providers = { local: { strategy: 'LocalStrategy' } };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(true);
+  });
+
+  it('should not be affected by other providers being present', () => {
+    const providers = {
+      oidc: { strategy: 'OpenIDConnectStrategy', config: { disabled: true } },
+      local: { strategy: 'LocalStrategy', config: { disabled: false } },
+    };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(true);
+  });
+
+  it('should return false when local is disabled even if other providers are enabled', () => {
+    const providers = {
+      oidc: { strategy: 'OpenIDConnectStrategy', config: { disabled: false } },
+      local: { strategy: 'LocalStrategy', config: { disabled: true } },
+    };
+    expect(isLocalAuthEnabledInEnv(providers)).toBe(false);
+  });
+});