From 703f16ea86ad80425bba7252e1dd4da2017f7dd8 Mon Sep 17 00:00:00 2001
From: mposolda <mposolda@gmail.com>
Date: Mon, 21 Oct 2024 16:01:41 +0200
Subject: [PATCH] Hide the 'Delete' button in the account console when
 DeleteCredentialAction is disabled or unavailable closes #30204

Signed-off-by: mposolda <mposolda@gmail.com>
---
 .../src/account-security/SigningIn.tsx        |  8 +++---
 .../credential/CredentialTypeMetadata.java    |  3 +++
 .../account/AccountRestServiceTest.java       | 26 ++++++++++++++++++-
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/js/apps/account-ui/src/account-security/SigningIn.tsx b/js/apps/account-ui/src/account-security/SigningIn.tsx
index 4e9859c1332..6652ab3f812 100644
--- a/js/apps/account-ui/src/account-security/SigningIn.tsx
+++ b/js/apps/account-ui/src/account-security/SigningIn.tsx
@@ -207,7 +207,7 @@ export const SigningIn = () => {
                               aria-label={t("updateCredAriaLabel")}
                               aria-labelledby={`cred-${meta.credential.id}`}
                             >
-                              {container.removeable ? (
+                              {container.removeable && (
                                 <Button
                                   variant="danger"
                                   data-testrole="remove"
@@ -221,12 +221,12 @@ export const SigningIn = () => {
                                 >
                                   {t("delete")}
                                 </Button>
-                              ) : (
+                              )}
+                              {container.updateAction && (
                                 <Button
                                   variant="secondary"
                                   onClick={() => {
-                                    if (container.updateAction)
-                                      login({ action: container.updateAction });
+                                    login({ action: container.updateAction });
                                   }}
                                   data-testrole="update"
                                 >
diff --git a/server-spi/src/main/java/org/keycloak/credential/CredentialTypeMetadata.java b/server-spi/src/main/java/org/keycloak/credential/CredentialTypeMetadata.java
index 1709a6758d0..90bb3bb4da7 100644
--- a/server-spi/src/main/java/org/keycloak/credential/CredentialTypeMetadata.java
+++ b/server-spi/src/main/java/org/keycloak/credential/CredentialTypeMetadata.java
@@ -244,6 +244,9 @@ public class CredentialTypeMetadata implements Comparable<CredentialTypeMetadata
             if (instance.createAction != null && instance.updateAction != null) {
                 throw new IllegalStateException("Both createAction and updateAction are not null when building CredentialTypeMetadata for the credential type '" + instance.type);
             }
+            if (!verifyRequiredAction(session, "delete_credential")) {
+                instance.removeable = false;
+            }
 
             return instance;
         }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
index 31fd12e9cb2..3dd66bd797e 100755
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/account/AccountRestServiceTest.java
@@ -31,6 +31,7 @@ import org.keycloak.admin.client.resource.RealmResource;
 import org.keycloak.admin.client.resource.UserResource;
 import org.keycloak.authentication.authenticators.browser.WebAuthnAuthenticatorFactory;
 import org.keycloak.authentication.authenticators.browser.WebAuthnPasswordlessAuthenticatorFactory;
+import org.keycloak.authentication.requiredactions.DeleteCredentialAction;
 import org.keycloak.authentication.requiredactions.WebAuthnPasswordlessRegisterFactory;
 import org.keycloak.authentication.requiredactions.WebAuthnRegisterFactory;
 import org.keycloak.broker.provider.util.SimpleHttp;
@@ -987,10 +988,33 @@ public class AccountRestServiceTest extends AbstractRestServiceTest {
             assertEquals(204, response.getStatus());
         }
 
-        // Revert - re-enable requiredAction and remove OTP credential from the user
+        // Revert - re-enable requiredAction
         setRequiredActionEnabledStatus(UserModel.RequiredAction.CONFIGURE_TOTP.name(), true);
     }
 
+    // Issue 30204
+    @Test
+    public void testCredentialsGetWithDisabledDeleteCredentialAction() throws IOException {
+        // Assert OTP will be returned by default
+        List<AccountCredentialResource.CredentialContainer> credentials = getCredentials();
+        assertExpectedCredentialTypes(credentials, PasswordCredentialModel.TYPE, OTPCredentialModel.TYPE);
+
+        // Assert OTP removeable
+        AccountCredentialResource.CredentialContainer otpCredential = credentials.get(1);
+        assertTrue(otpCredential.isRemoveable());
+
+        // Disable "Delete credential" action
+        setRequiredActionEnabledStatus(DeleteCredentialAction.PROVIDER_ID, false);
+
+        // Assert OTP not removeable
+        credentials = getCredentials();
+        otpCredential = credentials.get(1);
+        assertFalse(otpCredential.isRemoveable());
+
+        // Revert - re-enable requiredAction
+        setRequiredActionEnabledStatus(DeleteCredentialAction.PROVIDER_ID, true);
+    }
+
     private void setRequiredActionEnabledStatus(String requiredActionProviderId, boolean enabled) {
         RequiredActionProviderRepresentation requiredActionRep = testRealm().flows().getRequiredAction(requiredActionProviderId);
         requiredActionRep.setEnabled(enabled);