improve: do not allow to bulk remove identity providers (#7772)

packages/server-core/src/user/identity-provider/identity-provider.hooks.ts

@@ -47,8 +47,8 @@ const checkIdentityProvider = (): any => {
 const checkOnlyIdentityProvider = () => {
   return async (context: HookContext): Promise<HookContext> => {
     if (!context.id) {
-      // If trying to delete multiple providers, do not check if only 1 identity provider exists
-      return context
+      // do not allow to remove identity providers in bulk
+      throw new MethodNotAllowed('Cannot remove multiple providers together')
     }
 
     const thisIdentityProvider = await (context.app.service('identity-provider') as any).Model.findByPk(context.id)

packages/server-core/src/user/identity-provider/identity-provider.test.ts

@@ -113,20 +113,18 @@ describe('identity-provider service', () => {
     assert.equal((item as any).total, 0)
   })
 
-  it('should remove identity providers by user id', async () => {
-    await app.service('identity-provider').remove(null, {
-      query: {
-        userId
-      }
-    })
-
-    const item = await app.service('identity-provider').find({
-      query: {
-        userId
+  it('should not be able to remove identity providers by user id', async () => {
+    assert.rejects(
+      () =>
+        app.service('identity-provider').remove(null, {
+          query: {
+            userId
+          }
+        }),
+      {
+        name: 'MethodNotAllowed'
       }
-    })
-
-    assert.equal((item as any).total, 0)
+    )
   })
 
   it('should not be able to remove the only identity provider', async () => {
@@ -144,7 +142,5 @@ describe('identity-provider service', () => {
     assert.rejects(() => app.service('identity-provider').remove(item.id), {
       name: 'MethodNotAllowed'
     })
-
-    assert.ok(true)
   })
 })