Require a pick in the site auth "Use the following"

An empty explicit connection list is semantically "Disabled" behind a
misleading label, so require at least one entry.

CMK-37102

Change-Id: Ib715c8155e382c14868aa2f7ad61340ad6823a00

Author: cellador

cmk/gui/watolib/sites.py

@@ -547,6 +547,11 @@ def _editable_connections_form_spec(
             title=Title("Authentication"),
             add_element_label=Label("Add connection"),
             editable_order=False,
+            custom_validate=[
+                not_empty(
+                    Message("Please add at least one connection or choose a different option.")
+                )
+            ],
         )
 
     @classmethod

cmk/update_config/plugins/actions/migrate_user_sync_to_auth_connections.py

@@ -134,7 +134,10 @@ def _derive_new_values(
         # "all", a remote like "disabled".
         return (all_value, "all") if is_central_site else ("disabled", "disabled")
     if isinstance(user_sync, tuple) and user_sync[0] == "list":
-        conn_ids: list[str] = list(user_sync[1])
+        if not (conn_ids := list(user_sync[1])):
+            # An empty explicit list is semantically "disabled", and the site editor
+            # now rejects an empty list.
+            return "disabled", "disabled"
         auth_entries: list[AuthenticationConnectionEntry] = [
             ("ldap", conn_id) for conn_id in conn_ids
         ]

tests/unit/cmk/gui/watolib/test_sites.py

@@ -23,6 +23,7 @@
 import pytest
 
 from cmk.ccc.site import omd_site, SiteId
+from cmk.gui.form_specs import get_visitor, RawDiskData, VisitorOptions
 from cmk.gui.form_specs.unstable.legacy_converter import (
     TransformDataForLegacyFormatOrRecomposeFunction,
 )
@@ -368,3 +369,21 @@ def test_editable_connections_form_spec_omits_saml_when_not_supported() -> None:
     """Without distributed SAML support the nested "list" widget offers only the LDAP pick."""
     elements = _editable_connection_elements(saml_supported=False)
     assert [element.name for element in elements] == ["ldap"]
+
+
+def test_editable_connections_form_spec_rejects_empty_list(request_context: None) -> None:
+    """Choosing "Use the following" requires at least one connection entry —
+    an empty list would be semantically "disabled" behind a misleading label."""
+    visitor = get_visitor(
+        SiteManagement._editable_connections_form_spec(
+            ldap_choices=[("ldap_a", "LDAP A")], saml_choices=None
+        ),
+        VisitorOptions(migrate_values=False, mask_values=False),
+    )
+
+    validation_messages = visitor.validate(RawDiskData([]))
+    assert [message.message for message in validation_messages] == [
+        "Please add at least one connection or choose a different option."
+    ]
+
+    assert visitor.validate(RawDiskData([("ldap", "ldap_a")])) == []

tests/unit/cmk/update_config/plugins/actions/test_migrate_user_sync_to_auth_connections.py

@@ -69,6 +69,12 @@ def test_legacy_list_migrates_to_plain_lists() -> None:
     assert attr == ["ldap_a", "ldap_b"]
 
 
+def test_legacy_empty_list_disables_both_fields() -> None:
+    auth, attr = _derive_new_values(("list", []), is_central_site=True, saml_supported=True)
+    assert auth == "disabled"
+    assert attr == "disabled"
+
+
 def test_legacy_none_on_central_disables_both_fields() -> None:
     """Explicit ``user_sync = None`` was the legacy "Disable automatic user
     synchronization" choice; both new fields mirror it as explicitly