Merge commit from fork

apps/login/src/lib/server/password.ts

@@ -60,6 +60,10 @@ export async function resetPassword(command: ResetPasswordCommand) {
     return { error: t("errors.couldNotSendResetLink") };
   }
 
+  if (loginSettings.hidePasswordReset) {
+    return { error: t("errors.passwordResetNotAllowed") };
+  }
+
   const searchResult = await searchUsers({
     serviceConfig,
     searchValue: command.loginName,
@@ -150,6 +154,20 @@ export async function sendPassword(
   let loginSettingsByContext: LoginSettings | undefined;
   let loginSettingsByUser: LoginSettings | undefined;
 
+  // Perform policy check on context settings first if available, or fetch them if needed
+  if (!sessionCookie) {
+    if (!loginSettingsByContext) {
+      loginSettingsByContext = await getLoginSettings({
+        serviceConfig,
+        organization: command.organization ?? command.defaultOrganization,
+      });
+    }
+
+    if (loginSettingsByContext && !loginSettingsByContext.allowLocalAuthentication) {
+      return { error: t("errors.localAuthenticationNotAllowed") };
+    }
+  }
+
   if (sessionCookie) {
     try {
       loginSettingsByUser = await getLoginSettings({ serviceConfig, organization: sessionCookie.organization });

apps/login/src/lib/server/register.ts

@@ -34,6 +34,20 @@ export async function registerUser(
   const _headers = await headers();
   const { serviceConfig } = getServiceConfig(_headers);
 
+  const loginSettings = await getLoginSettings({ serviceConfig, organization: command.organization });
+
+  if (!loginSettings) {
+    return { error: t("errors.couldNotGetLoginSettings") };
+  }
+
+  if (!loginSettings.allowRegister) {
+    return { error: t("errors.registerNotAllowed") };
+  }
+
+  if (command.password && !loginSettings.allowLocalAuthentication) {
+    return { error: t("errors.localAuthenticationNotAllowed") };
+  }
+
   const addResponse = await addHumanUser({
     serviceConfig,
     email: command.email,
@@ -47,8 +61,6 @@ export async function registerUser(
     return { error: t("errors.couldNotCreateUser") };
   }
 
-  const loginSettings = await getLoginSettings({ serviceConfig, organization: command.organization });
-
   let checkPayload: any = {
     user: { search: { case: "userId", value: addResponse.userId } },
   };
@@ -163,6 +175,16 @@ export async function registerUserAndLinkToIDP(
   const _headers = await headers();
   const { serviceConfig } = getServiceConfig(_headers);
 
+  const loginSettings = await getLoginSettings({ serviceConfig, organization: command.organization });
+
+  if (!loginSettings) {
+    return { error: t("errors.couldNotGetLoginSettings") };
+  }
+
+  if (!loginSettings.allowRegister) {
+    return { error: t("errors.registerNotAllowed") };
+  }
+
   const addUserResponse = await addHumanUser({
     serviceConfig,
     email: command.email,
@@ -171,12 +193,6 @@ export async function registerUserAndLinkToIDP(
     organization: command.organization,
   });
 
-  if (!addUserResponse) {
-    return { error: t("errors.couldNotCreateUser") };
-  }
-
-  const loginSettings = await getLoginSettings({ serviceConfig, organization: command.organization });
-
   const idpLink = await addIDPLink({
     serviceConfig,
     idp: {