feat(signup): hide email signup when email delivery is disabled (IdP-only)

Author: yahyafakhroji

app/resources/signup/signup-view.ts

@@ -25,7 +25,9 @@ export function resolveSignupView(
   idps: IdProvider[],
   emailDeliveryEnabled: boolean
 ): SignupView {
-  const allowEmailEntry = settings.disableLoginWithEmail !== true;
+  // Email-based signup (entry + link) needs email delivery to complete verification.
+  // When delivery is off, hide the whole email path so signup is IdP-only.
+  const allowEmailEntry = settings.disableLoginWithEmail !== true && emailDeliveryEnabled;
   return {
     showIdpButtons: settings.allowExternalIdp && idps.length > 0,
     allowEmailEntry,

cypress/component/resources/signup/signup-view.cy.ts

@@ -40,11 +40,48 @@ describe('resolveSignupView', () => {
       )
     ).to.deep.equal({
       showIdpButtons: false,
-      allowEmailEntry: true,
+      allowEmailEntry: false,
       showEmailLink: false,
       showPasskey: false,
       showPassword: true,
       registrationDisabled: true,
     });
   });
+
+  it('hides email entry and link when emailDeliveryEnabled=false, regardless of Zitadel policy', () => {
+    // RED→GREEN: before the fix allowEmailEntry was true when delivery was off.
+    // With delivery off the whole email path must hide so signup is IdP-only.
+    expect(resolveSignupView(base, idps, false)).to.deep.equal({
+      showIdpButtons: true,
+      allowEmailEntry: false,
+      showEmailLink: false,
+      showPasskey: true,
+      showPassword: false,
+      registrationDisabled: false,
+    });
+  });
+
+  it('keeps allowEmailEntry when Zitadel policy allows email AND delivery is on', () => {
+    expect(resolveSignupView(base, idps, true)).to.deep.equal({
+      showIdpButtons: true,
+      allowEmailEntry: true,
+      showEmailLink: true,
+      showPasskey: true,
+      showPassword: false,
+      registrationDisabled: false,
+    });
+  });
+
+  it('hides email entry when Zitadel disableLoginWithEmail=true even if delivery is on', () => {
+    expect(
+      resolveSignupView({ ...base, disableLoginWithEmail: true } as LoginSettings, idps, true)
+    ).to.deep.equal({
+      showIdpButtons: true,
+      allowEmailEntry: false,
+      showEmailLink: false,
+      showPasskey: true,
+      showPassword: false,
+      registrationDisabled: false,
+    });
+  });
 });

cypress/component/routes/signup/signup-render.cy.tsx

@@ -70,4 +70,19 @@ describe('signup/index — render adoption', () => {
         cy.get('input[type="hidden"][name="organization"]').should('have.value', 'acme');
       });
   });
+
+  it('shows IdP button and hides Email entry button when emailDeliveryEnabled=false (IdP-only signup)', () => {
+    // view.allowEmailEntry=false when delivery is off — the Email button must not appear.
+    mountSignup(
+      loaderData({
+        view: {
+          ...BASE_VIEW,
+          allowEmailEntry: false,
+          showEmailLink: false,
+        },
+      })
+    );
+    cy.contains('Google', { timeout: 6000 }).should('exist');
+    cy.contains('Email').should('not.exist');
+  });
 });