@plone-collective/volto-identity 1.0.0-alpha.1

package/src/helpers/providerSchema.ts

@@ -0,0 +1,362 @@
+/**
+ * The provider form, composed from what the backend already sent.
+ *
+ * This file used to *build* the schema: 529 lines turning a hand-written
+ * descriptor dict — `{type, title, required, secret, order}` — into Volto
+ * properties, with its own notion of field types, its own ordering by a
+ * spaced-out `order` key, its own secret flag, and its own untranslated
+ * English strings. Érico's verdict (2026-08-29) was that it made a Classic UI
+ * form impossible and reinvented, worse, what Plone already had.
+ *
+ * So the backend now serves two ordinary JSON schemas, produced by
+ * `plone.restapi` from two interfaces:
+ *
+ * - `@identity-providers` sends the provider's own fields, from
+ *   `IProviderRecords` — the same interface its registry records are bound
+ *   to, so the form and the storage cannot describe different things.
+ * - `@identity-drivers` sends each driver's settings, from its
+ *   `settings_schema`.
+ *
+ * What is left here is composition, and only composition: merge the two,
+ * prefix the driver's half so a flat form can carry a nested object, and add
+ * the two fields that exist only while a provider is being created. Nothing
+ * below decides what a field looks like — that is the backend's answer, in
+ * the site's language, and this file must never start having an opinion about
+ * it again.
+ * @module helpers/providerSchema
+ */
+import { defineMessages } from 'react-intl';
+
+import { toGroupRows, fromGroupRows } from './groupmap';
+import { toRows, fromRows } from './propertymap';
+import type { Driver, JsonSchema, VoltoSchema } from '../types';
+
+import type { IntlShape } from 'react-intl';
+
+/**
+ * Prefix a driver setting carries in form data.
+ *
+ * The API nests them under `config`, and a Volto form is flat. The prefix is
+ * what lets one flat object round-trip both halves without the two colliding
+ * — a driver may perfectly well declare a `title`, and it is not the
+ * provider's.
+ */
+export const CONFIG_PREFIX = 'config.';
+
+/** Fieldset the driver's own settings are rendered in. */
+export const SETTINGS_FIELDSET = 'settings';
+
+/** Fieldset the two claim mappings are rendered in. */
+export const MAPPING_FIELDSET = 'mapping';
+
+/**
+ * Fields `IProviderRecords` declares that this file renders itself.
+ *
+ * The served schema describes a provider's *storage*, which is right, and
+ * three of its fields are not renderable as described. `driver` is a picker
+ * over the registered drivers and is asked only while adding -- a provider's
+ * driver is not an editable property, and the served `TextLine` would win,
+ * because the merge below arrives after the picker is put in. `propertymap`
+ * and `groupmap` are `Dict` fields, which Volto has no widget for at all;
+ * they are rebuilt as row editors in a fieldset of their own. So the served
+ * descriptions of the three are dropped rather than merged.
+ */
+const COMPOSED_HERE = ['driver', 'propertymap', 'groupmap'];
+
+const messages = defineMessages({
+  identity: { id: 'Identity', defaultMessage: 'Identity' },
+  driver: { id: 'Driver', defaultMessage: 'Driver' },
+  driverHelp: {
+    id: 'provider-driver-help',
+    defaultMessage:
+      'Which service this provider talks to. It decides the rest of the ' +
+      'form, and it cannot be changed afterwards.',
+  },
+  providerId: { id: 'Provider id', defaultMessage: 'Provider id' },
+  providerIdHelp: {
+    id: 'provider-id-help',
+    defaultMessage:
+      'Used in URLs and stored with every identity linked through this ' +
+      'provider, so it is permanent.',
+  },
+  settings: { id: 'Settings', defaultMessage: 'Settings' },
+  mapping: { id: 'Mapping', defaultMessage: 'Mapping' },
+  propertymap: { id: 'Property map', defaultMessage: 'Property map' },
+  groupmap: { id: 'Group map', defaultMessage: 'Group map' },
+});
+
+/**
+ * Suggest an id for a provider being added.
+ *
+ * Slugified from the driver's title, which reads better than its id for the
+ * one thing that becomes permanent the moment it is saved. Unchanged by the
+ * schema rewrite: it is about naming a provider, not about describing a
+ * field.
+ *
+ * @param drivers Every registered driver.
+ * @param driverId The driver just chosen.
+ * @returns A suggested id, or an empty string.
+ */
+export function suggestedProviderId(
+  drivers: Driver[],
+  driverId: string | undefined,
+): string {
+  const driver = drivers.find((d) => d.id === driverId);
+  if (!driver) {
+    return '';
+  }
+  return (
+    driver.title
+      .toLowerCase()
+      // The id accepts letters, digits, - and _ only, so everything else
+      // becomes a separator rather than being dropped -- "Sign in (beta)"
+      // should read as sign-in-beta, not signinbeta.
+      .replace(/[^a-z0-9_]+/g, '-')
+      .replace(/^-+|-+$/g, '') || driver.id
+  );
+}
+
+/**
+ * Build the provider form from the two schemas the backend sent.
+ *
+ * @param served The provider's own schema, from `@identity-providers`.
+ * @param drivers Every registered driver, each carrying its settings schema.
+ * @param driverId The driver whose settings to render.
+ * @param adding Whether this is the add form, which asks two more questions.
+ * @param intl For the labels of the fields that exist only in this form.
+ * @returns A Volto schema.
+ */
+export function providerSchema(
+  served: JsonSchema | undefined,
+  drivers: Driver[],
+  driverId: string | undefined,
+  adding: boolean,
+  intl: IntlShape,
+): VoltoSchema {
+  const properties: Record<string, Record<string, unknown>> = {};
+  const fieldsets: { id: string; title: string; fields: string[] }[] = [];
+  const required: string[] = (served?.required ?? []).filter(
+    (name) => !COMPOSED_HERE.includes(name),
+  );
+
+  if (adding) {
+    // The only two fields this file still invents, and they are not stored
+    // anywhere: the driver decides which schema the rest of the form uses,
+    // and the id becomes the record prefix. Both are answered once, at
+    // creation, and neither exists on a provider that already exists.
+    properties.driver = {
+      title: intl.formatMessage(messages.driver),
+      description: intl.formatMessage(messages.driverHelp),
+      choices: drivers.map((d) => [d.id, d.title]),
+    };
+    properties.id = {
+      title: intl.formatMessage(messages.providerId),
+      description: intl.formatMessage(messages.providerIdHelp),
+      type: 'string',
+    };
+    required.push('driver', 'id');
+  }
+
+  Object.assign(
+    properties,
+    Object.fromEntries(
+      Object.entries(served?.properties ?? {}).filter(
+        ([name]) => !COMPOSED_HERE.includes(name),
+      ),
+    ),
+  );
+
+  // The backend's own fieldsets, in its order, with the creation questions
+  // folded into the first one so they are the first thing asked.
+  (served?.fieldsets ?? []).forEach((fieldset, index) => {
+    const extra = adding && index === 0 ? ['driver', 'id'] : [];
+    const fields = [
+      ...extra,
+      ...fieldset.fields.filter((name) => !COMPOSED_HERE.includes(name)),
+    ];
+    // A fieldset the filter empties is not rendered as an empty tab.
+    if (!fields.length) return;
+    fieldsets.push({
+      id: fieldset.id,
+      title:
+        index === 0 ? intl.formatMessage(messages.identity) : fieldset.title,
+      fields,
+    });
+  });
+
+  const driver = drivers.find((d) => d.id === driverId);
+  const settings: JsonSchema = driver?.schema ?? {};
+  const settingFields: string[] = [];
+  for (const [name, property] of Object.entries(settings.properties ?? {})) {
+    const key = `${CONFIG_PREFIX}${name}`;
+    properties[key] = property;
+    settingFields.push(key);
+    if ((settings.required ?? []).includes(name)) {
+      required.push(key);
+    }
+  }
+  // The driver's own fieldsets, kept rather than flattened. A driver groups
+  // its settings for a reason -- how to reach the provider, what to do with
+  // the person it returns, how its groups map -- and collapsing that into one
+  // Settings tab put a dozen unrelated fields in a single column.
+  //
+  // The driver's `default` fieldset is the one it did not name, so it takes
+  // this form's own Settings label; the rest keep the titles the backend
+  // translated. A driver that declares no fieldsets at all still gets exactly
+  // one tab, which is what every driver did before this.
+  const driverFieldsets = settings.fieldsets ?? [];
+  if (settingFields.length && driverFieldsets.length) {
+    driverFieldsets.forEach((driverFieldset) => {
+      const fields = driverFieldset.fields.map(
+        (name) => `${CONFIG_PREFIX}${name}`,
+      );
+      if (!fields.length) return;
+      fieldsets.push({
+        id:
+          driverFieldset.id === 'default'
+            ? SETTINGS_FIELDSET
+            : `${SETTINGS_FIELDSET}-${driverFieldset.id}`,
+        title:
+          driverFieldset.id === 'default'
+            ? intl.formatMessage(messages.settings)
+            : driverFieldset.title,
+        fields,
+      });
+    });
+  } else if (settingFields.length) {
+    fieldsets.push({
+      id: SETTINGS_FIELDSET,
+      title: intl.formatMessage(messages.settings),
+      fields: settingFields,
+    });
+  }
+
+  // The two mappings. Their *shape* is `Dict` on the backend; Volto has no
+  // Dict widget, so they are edited as rows and converted below. That is a
+  // widget gap rather than a schema this file invented.
+  properties.propertymap = {
+    title: intl.formatMessage(messages.propertymap),
+    widget: 'object_list',
+    schema: rowSchema(intl, 'claim', 'field'),
+  };
+  // The group map, only for a driver whose providers have groups. The
+  // backend declares that by putting a `group_claim` field in the settings
+  // schema, and it is the same switch on both ends: a driver with no groups
+  // offers no claim to read them from, and a map stored against one grants
+  // nothing. Asking an operator to map the groups of a magic link would be
+  // asking a question with no answer.
+  const hasGroups = Boolean(settings.properties?.group_claim);
+  if (hasGroups) {
+    properties.groupmap = {
+      title: intl.formatMessage(messages.groupmap),
+      widget: 'object_list',
+      schema: rowSchema(intl, 'group', 'local'),
+    };
+  }
+  fieldsets.push({
+    id: MAPPING_FIELDSET,
+    title: intl.formatMessage(messages.mapping),
+    fields: hasGroups ? ['propertymap', 'groupmap'] : ['propertymap'],
+  });
+
+  return { fieldsets, properties, required };
+}
+
+/**
+ * The two-column schema a mapping row is edited with.
+ *
+ * @param intl For the column labels.
+ * @param left Name of the left-hand field.
+ * @param right Name of the right-hand field.
+ * @returns A Volto schema for one row.
+ */
+function rowSchema(intl: IntlShape, left: string, right: string): VoltoSchema {
+  return {
+    fieldsets: [{ id: 'default', title: 'default', fields: [left, right] }],
+    properties: {
+      [left]: { title: left, type: 'string' },
+      [right]: { title: right, type: 'string' },
+    },
+    required: [],
+  };
+}
+
+/**
+ * Turn a provider from the API into form data.
+ *
+ * @param provider The provider, or undefined when adding.
+ * @param defaults Seeds for a provider being added.
+ * @returns Flat form data.
+ */
+export function toFormData(
+  provider: Record<string, any> | undefined,
+  defaults?: {
+    propertymap?: Record<string, string>;
+    groupmap?: Record<string, string>;
+  },
+): Record<string, unknown> {
+  if (!provider) {
+    return {
+      enabled: true,
+      show_in_login: true,
+      propertymap: toRows(defaults?.propertymap),
+      groupmap: toGroupRows(defaults?.groupmap),
+    };
+  }
+  const data: Record<string, unknown> = {
+    title: provider.title ?? '',
+    enabled: provider.enabled ?? true,
+    // Absent means shown. A provider stored before the setting existed was
+    // on the login page, and reading the key back as false would take a
+    // site's login buttons away on upgrade.
+    show_in_login: provider.show_in_login ?? true,
+    // The upload envelope the backend sends, handed to the widget unchanged.
+    icon: provider.icon ?? '',
+    background_color: provider.background_color ?? '',
+    foreground_color: provider.foreground_color ?? '',
+    propertymap: toRows(provider.propertymap),
+    groupmap: toGroupRows(provider.groupmap),
+  };
+  for (const [name, value] of Object.entries(provider.config ?? {})) {
+    data[`${CONFIG_PREFIX}${name}`] = value;
+  }
+  return data;
+}
+
+/**
+ * Turn submitted form data back into the API payload.
+ *
+ * Only shape, never validation. Every rule about what a value may be lives on
+ * the backend schema now — a colour it cannot parse, an icon that is not SVG,
+ * a redirect URI a browser could execute — so trimming here would only hide
+ * which value the refusal is about.
+ *
+ * @param formData What the form submitted.
+ * @returns The body for POST or PATCH.
+ */
+export function fromFormData(
+  formData: Record<string, any>,
+): Record<string, unknown> {
+  const config: Record<string, unknown> = {};
+  const payload: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(formData ?? {})) {
+    if (key.startsWith(CONFIG_PREFIX)) {
+      config[key.slice(CONFIG_PREFIX.length)] = value;
+    } else if (key === 'propertymap') {
+      payload.propertymap = fromRows(value);
+    } else if (key === 'groupmap') {
+      payload.groupmap = fromGroupRows(value);
+    } else if (!key.startsWith('@')) {
+      payload[key] = value;
+    }
+  }
+
+  payload.config = config;
+  payload.enabled = Boolean(payload.enabled);
+  payload.show_in_login = Boolean(payload.show_in_login);
+  if (typeof payload.id === 'string') {
+    payload.id = payload.id.trim();
+  }
+  return payload;
+}

package/src/helpers/returnUrl.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+
+import { returnUrl } from './returnUrl';
+
+describe('returnUrl', () => {
+  it('uses an explicit return_url', () => {
+    expect(returnUrl('?return_url=/some/page', '/login')).toBe('/some/page');
+  });
+
+  it('accepts came_from too', () => {
+    expect(returnUrl('?came_from=/some/page', '/login')).toBe('/some/page');
+  });
+
+  it('falls back to the site root from /login', () => {
+    expect(returnUrl('', '/login')).toBe('/');
+  });
+
+  it('strips a trailing /login from a nested path', () => {
+    expect(returnUrl('', '/a/folder/login')).toBe('/a/folder');
+  });
+
+  it.each([
+    'https://evil.example/phish',
+    '//evil.example/phish',
+    'http://evil.example',
+  ])('refuses the off-site target %s', (target) => {
+    // On the frontend too: the backend drops these as well, but a target
+    // that never leaves the browser would never reach the backend to be
+    // checked.
+    expect(
+      returnUrl(`?return_url=${encodeURIComponent(target)}`, '/login'),
+    ).toBe('/');
+  });
+
+  it('refuses a relative target that is not rooted', () => {
+    expect(returnUrl('?return_url=some/page', '/login')).toBe('/');
+  });
+
+  it('ignores a repeated parameter rather than guessing', () => {
+    expect(returnUrl('?return_url=/a&return_url=/b', '/login')).toBe('/');
+  });
+});

package/src/helpers/returnUrl.ts

@@ -0,0 +1,41 @@
+/**
+ * Deciding where a signed-in user lands.
+ *
+ * Pure, and separate from the container, because this is an open-redirect
+ * check and those are worth testing on their own.
+ * @module helpers/returnUrl
+ */
+
+/**
+ * Work out where to send the user once they are signed in.
+ *
+ * Only site-relative targets survive. An absolute or protocol-relative URL
+ * here would be an open redirect; the backend refuses those too, but a target
+ * that never leaves the browser would never reach the backend to be checked.
+ *
+ * @param search The location's query string.
+ * @param pathname The location's path.
+ * @returns A path inside this site.
+ */
+export function returnUrl(search: string, pathname: string): string {
+  const params = new URLSearchParams(search);
+  const values = [
+    ...params.getAll('return_url'),
+    ...params.getAll('came_from'),
+  ];
+  const requested = values.length === 1 ? values[0] : undefined;
+
+  if (
+    requested &&
+    requested.startsWith('/') &&
+    // "//evil.example" is protocol-relative, not site-relative.
+    !requested.startsWith('//')
+  ) {
+    return requested;
+  }
+
+  if (pathname === '/login') {
+    return '/';
+  }
+  return pathname.replace(/\/login$/, '') || '/';
+}

package/src/helpers/rowmap.ts

@@ -0,0 +1,110 @@
+/**
+ * Conversion between a stored `{key: value}` map and the rows an editor shows.
+ *
+ * The backend stores mappings as objects, which is the shape that reads well
+ * as a registry record. An editor cannot work in that shape: a row the
+ * operator has just added has no key yet, so every unfinished row would
+ * collapse onto the same one.
+ *
+ * Rows therefore carry an `@id`. That is Volto's `ObjectListWidget`
+ * contract -- it keys its drag list on `o['@id']` and renders nothing for a
+ * row without one -- and it is what lets two unfinished rows coexist.
+ *
+ * Two mappings use this: the property map, whose halves are a claim and a
+ * user field, and the group map, whose halves are a provider group and a
+ * local one. Only the field names differ, so the field names are the
+ * parameter and everything else is shared.
+ * @module helpers/rowmap
+ */
+
+/**
+ * The least a row must be for the list widget to render it.
+ *
+ * The two halves are named by the caller, so they are not part of this type;
+ * each mapping declares a row type of its own and passes it as `R` below.
+ */
+export interface MapRow {
+  '@id': string;
+}
+
+/**
+ * Mint an id for a row.
+ *
+ * @returns A value unique among the rows on the page.
+ */
+export function rowId(): string {
+  const maybe = globalThis.crypto as { randomUUID?: () => string } | undefined;
+  if (maybe?.randomUUID) {
+    return maybe.randomUUID();
+  }
+  // Only reached on a runtime without webcrypto; uniqueness within one
+  // editing session is all this needs.
+  return `row-${Math.random().toString(36).slice(2)}`;
+}
+
+/** Converters between one stored map and its editor rows. */
+export interface RowConverters<R extends MapRow> {
+  toRows: (map: Record<string, string> | undefined) => R[];
+  fromRows: (rows: R[] | undefined) => Record<string, string>;
+}
+
+/**
+ * Build the converters for a mapping whose halves are named this way.
+ *
+ * The row type is the caller's, and the two casts below are where the
+ * dynamic field names are reconciled with it. They are contained here on
+ * purpose: each mapping's own module then has a fully typed pair of
+ * functions and no cast of its own.
+ *
+ * @param keyField Name of the row field holding the map's key.
+ * @param valueField Name of the row field holding the map's value.
+ * @returns The pair of converters.
+ */
+export function rowConverters<R extends MapRow>(
+  keyField: string,
+  valueField: string,
+): RowConverters<R> {
+  return {
+    /**
+     * Turn a stored map into editor rows.
+     *
+     * @param map The stored mapping.
+     * @returns One row per entry, in the map's own order.
+     */
+    toRows(map) {
+      return Object.entries(map ?? {}).map(
+        ([key, value]) =>
+          ({
+            '@id': rowId(),
+            [keyField]: key,
+            [valueField]: value,
+          }) as unknown as R,
+      );
+    },
+
+    /**
+     * Turn editor rows back into a stored map.
+     *
+     * Rows missing either half are dropped: they are a row the operator
+     * started and has not finished, not a mapping. This is why rows are held
+     * as state rather than derived from the map -- a blank row must survive
+     * on screen while being absent from what gets saved. A repeated key keeps
+     * the last row, which is what the object it becomes would do anyway.
+     *
+     * @param rows Rows from the editor.
+     * @returns The stored mapping.
+     */
+    fromRows(rows) {
+      const map: Record<string, string> = {};
+      for (const row of rows ?? []) {
+        const halves = row as unknown as Record<string, string | undefined>;
+        const key = (halves?.[keyField] ?? '').trim();
+        const value = (halves?.[valueField] ?? '').trim();
+        if (key && value) {
+          map[key] = value;
+        }
+      }
+      return map;
+    },
+  };
+}

package/src/helpers/showPloneLogin.test.ts

@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+/**
+ * Stand in for Volto's `runtimeConfig`.
+ *
+ * A stable object whose keys the tests mutate, because the helper reads it at
+ * call time rather than binding a value at import.
+ */
+const { runtime } = vi.hoisted(() => ({
+  runtime: {} as Record<string, string | undefined>,
+}));
+
+vi.mock('@plone/volto/runtime_config', () => ({ runtimeConfig: runtime }));
+
+const { default: config } = await import('@plone/volto/registry');
+const { showPloneLogin, SHOW_PLONE_LOGIN_ENV } = await import(
+  './showPloneLogin'
+);
+
+describe('showPloneLogin', () => {
+  beforeEach(() => {
+    delete runtime[SHOW_PLONE_LOGIN_ENV];
+    config.settings.identityShowPloneLogin = false;
+  });
+
+  it('is off when nothing says otherwise', () => {
+    expect(showPloneLogin()).toBe(false);
+  });
+
+  it('is on when the environment says so', () => {
+    // The whole point of the change: this value arrives at run time, so one
+    // image serves a site that wants the password form and one that does not.
+    runtime[SHOW_PLONE_LOGIN_ENV] = 'true';
+
+    expect(showPloneLogin()).toBe(true);
+  });
+
+  it('reads the word "false" as off', () => {
+    // Not `Boolean(value)`, which reads the string "false" as true and turns
+    // an operator switching the form *off* into a site that still shows it.
+    config.settings.identityShowPloneLogin = true;
+    runtime[SHOW_PLONE_LOGIN_ENV] = 'false';
+
+    expect(showPloneLogin()).toBe(false);
+  });
+
+  it('falls back to the setting when the environment is silent', () => {
+    // So a project shipping its own default keeps it.
+    config.settings.identityShowPloneLogin = true;
+
+    expect(showPloneLogin()).toBe(true);
+  });
+
+  it('treats an empty variable as silence rather than as off', () => {
+    // An unset variable and one set to nothing reach the container the same
+    // way, and neither is an operator asking for the form to go away.
+    config.settings.identityShowPloneLogin = true;
+    runtime[SHOW_PLONE_LOGIN_ENV] = '';
+
+    expect(showPloneLogin()).toBe(true);
+  });
+
+  it('lets the environment override the setting in both directions', () => {
+    config.settings.identityShowPloneLogin = true;
+    runtime[SHOW_PLONE_LOGIN_ENV] = 'off';
+    expect(showPloneLogin()).toBe(false);
+
+    config.settings.identityShowPloneLogin = false;
+    runtime[SHOW_PLONE_LOGIN_ENV] = 'on';
+    expect(showPloneLogin()).toBe(true);
+  });
+
+  it('survives a runtimeConfig that carries nothing', () => {
+    // Volto builds it by filtering `process.env` for `RAZZLE_*`, so a
+    // container with none is an empty object rather than an error.
+    expect(() => showPloneLogin()).not.toThrow();
+  });
+});

package/src/helpers/showPloneLogin.ts

@@ -0,0 +1,55 @@
+/**
+ * Whether Plone's own username/password form is offered on the login page.
+ * @module helpers/showPloneLogin
+ */
+import { runtimeConfig } from '@plone/volto/runtime_config';
+import config from '@plone/volto/registry';
+
+import { asBoolean } from '../config/settings';
+
+/**
+ * The environment variable a deployment answers this with.
+ *
+ * `RAZZLE_`-prefixed because that is the only prefix Volto carries into
+ * `runtimeConfig`.
+ */
+export const SHOW_PLONE_LOGIN_ENV = 'RAZZLE_IDENTITY_SHOW_PLONE_LOGIN';
+
+/**
+ * Decide whether to offer the password form.
+ *
+ * Read through Volto's `runtimeConfig` rather than `process.env`, which is
+ * what makes this a *runtime* answer instead of a property of the image.
+ * `process.env.RAZZLE_...`, written out literally, is substituted into the
+ * browser bundle by webpack's DefinePlugin while `pnpm build` runs -- so a
+ * value supplied to a running container reaches the node process and never
+ * the browser. It looks like it works and does nothing, and two sites wanting
+ * two answers need two images.
+ *
+ * `runtimeConfig` avoids that on both sides, which is why it is used instead
+ * of reading `window.env` directly:
+ *
+ * - on the server it enumerates `process.env` and filters to `RAZZLE_*`, with
+ *   computed keys DefinePlugin cannot rewrite, so the node process is read as
+ *   it actually is;
+ * - on the client it reads `window.env`, which the server serialized into the
+ *   page while rendering it.
+ *
+ * Both therefore see the same value, and the server-rendered markup matches
+ * what React hydrates. Reading only `window.env` would render the default on
+ * the server and the real answer in the browser -- a mismatch, and a flash of
+ * the wrong form.
+ *
+ * The setting is the fallback rather than the source, so a project that ships
+ * its own default keeps it and a deployment can still override it.
+ *
+ * @returns Whether to offer the password form.
+ */
+export function showPloneLogin(): boolean {
+  return asBoolean(
+    (runtimeConfig as Record<string, string | undefined>)?.[
+      SHOW_PLONE_LOGIN_ENV
+    ],
+    Boolean(config.settings.identityShowPloneLogin),
+  );
+}