From f8d2746088b5340130de3b0776058b3b17e23283 Mon Sep 17 00:00:00 2001
From: Sergei Maertens <sergei@maykinmedia.nl>
Date: Tue, 31 Dec 2024 11:28:53 +0100
Subject: [PATCH 1/3] :bug: [#4650] Fix styling of registrator screen

Some class names and stylesheets were missing for the inline radio
choices, causing the page to look janky.
---
 .../of_authentication/registrator_subject_info.html        | 7 -------
 src/openforms/templates/includes/forms/radio.html          | 2 +-
 src/openforms/ui/static/ui/scss/components/_index.scss     | 2 ++
 .../utils/templates/of_utils/widgets/radio_option.html     | 2 +-
 4 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/src/openforms/authentication/templates/of_authentication/registrator_subject_info.html b/src/openforms/authentication/templates/of_authentication/registrator_subject_info.html
index 3af0336a57..38a7865c0b 100644
--- a/src/openforms/authentication/templates/of_authentication/registrator_subject_info.html
+++ b/src/openforms/authentication/templates/of_authentication/registrator_subject_info.html
@@ -1,13 +1,6 @@
 {% extends 'ui/views/abstract/detail.html' %}
 {% load i18n static %}
 
-{% block extra_css %}
-    {{ block.super }}
-
-    {# Needed for the styling of the auth-mode class #}
-    <link href="{% static 'bundles/public-styles.css' %}" media="all" rel="stylesheet"/>
-{% endblock %}
-
 {% block card %}
 <div class="openforms-card">
     <header class="openforms-card__header">
diff --git a/src/openforms/templates/includes/forms/radio.html b/src/openforms/templates/includes/forms/radio.html
index d965bb996c..1f79e59288 100644
--- a/src/openforms/templates/includes/forms/radio.html
+++ b/src/openforms/templates/includes/forms/radio.html
@@ -8,7 +8,7 @@
             utrecht-form-fieldset__legend
             utrecht-form-fieldset__legend--html-legend
             utrecht-form-field__label">
-            <label class="utrecht-form-label utrecht-form-label--openforms-required">
+            <label class="utrecht-form-label utrecht-form-label--openforms utrecht-form-label--openforms-required">
                 {{ field.label }}
             </label>
         </legend>
diff --git a/src/openforms/ui/static/ui/scss/components/_index.scss b/src/openforms/ui/static/ui/scss/components/_index.scss
index d08d55dbe4..d803321ceb 100644
--- a/src/openforms/ui/static/ui/scss/components/_index.scss
+++ b/src/openforms/ui/static/ui/scss/components/_index.scss
@@ -5,6 +5,8 @@
 @import 'page-header';
 
 // Custom
+@import '../../../../../scss/components/form-choices';
+
 @import 'a11y-toolbar';
 @import 'auth-mode';
 @import 'fa-icon';
diff --git a/src/openforms/utils/templates/of_utils/widgets/radio_option.html b/src/openforms/utils/templates/of_utils/widgets/radio_option.html
index 032e0fd595..035b6c1ac8 100644
--- a/src/openforms/utils/templates/of_utils/widgets/radio_option.html
+++ b/src/openforms/utils/templates/of_utils/widgets/radio_option.html
@@ -1,7 +1,7 @@
 <div class="utrecht-form-field utrecht-form-field--radio utrecht-form-field--openforms">
     {% include "django/forms/widgets/input.html" %}
     <p class="utrecht-paragraph utrecht-form-field__label utrecht-form-field__label--radio">
-        <label for="{{ widget.attrs.id }}" class="utrecht-form-label utrecht-form-label--radio">
+        <label for="{{ widget.attrs.id }}" class="utrecht-form-label utrecht-form-label--radio utrecht-form-label--openforms">
             {{ widget.label }}
         </label>
     </p>

From cce064242ae063350f3856c4abd8d0dc3bb4e31b Mon Sep 17 00:00:00 2001
From: Sergei Maertens <sergei@maykinmedia.nl>
Date: Tue, 31 Dec 2024 11:40:18 +0100
Subject: [PATCH 2/3] :test_tube: [#4650] Add regression test for failing
 pre-registration

When an initial data reference is present, a registration plugin must
implement the ownership check.
---
 .../contrib/email/tests/test_backend.py       | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/openforms/registrations/contrib/email/tests/test_backend.py b/src/openforms/registrations/contrib/email/tests/test_backend.py
index 47460b0de4..950becf12a 100644
--- a/src/openforms/registrations/contrib/email/tests/test_backend.py
+++ b/src/openforms/registrations/contrib/email/tests/test_backend.py
@@ -22,6 +22,7 @@
 from openforms.payments.constants import PaymentStatus
 from openforms.payments.tests.factories import SubmissionPaymentFactory
 from openforms.submissions.attachments import attach_uploads_to_submission_step
+from openforms.submissions.constants import PostSubmissionEvents
 from openforms.submissions.exports import create_submission_export
 from openforms.submissions.models import Submission
 from openforms.submissions.tests.factories import (
@@ -34,7 +35,8 @@
 from openforms.utils.tests.html_assert import HTMLAssertMixin
 from openforms.variables.constants import FormVariableSources
 
-from ..constants import AttachmentFormat
+from ....tasks import pre_registration
+from ..constants import PLUGIN_ID, AttachmentFormat
 from ..models import EmailConfig
 from ..plugin import EmailRegistration, Options
 
@@ -1281,3 +1283,31 @@ def test_with_deferred_registration(self):
         # Verify that email was sent
         emails = mail.outbox
         self.assertEqual(len(emails), 2)
+
+    @tag("gh-4650")
+    def test_register_submission_with_initial_data_reference(self):
+        """
+        Test that submissions with initial data references can be registered.
+
+        For email, no access control checks can be performed and there is no 'update
+        existing object' mechanic, so any submission with some initial data reference
+        (for prefill, for example) needs to be accepted.
+        """
+        email_form_options: Options = {
+            "to_emails": ["recipient@example.com"],
+            "attach_files_to_email": None,
+        }
+        submission = SubmissionFactory.from_data(
+            {"whatever": "156/Silence"},
+            completed_not_preregistered=True,
+            initial_data_reference="some-reference",
+            form__registration_backend=PLUGIN_ID,
+            form__registration_backend_options=email_form_options,
+        )
+
+        pre_registration(submission.pk, event=PostSubmissionEvents.on_completion)
+
+        submission.refresh_from_db()
+        self.assertFalse(submission.needs_on_completion_retry)
+        self.assertTrue(submission.pre_registration_completed)
+        self.assertNotEqual(submission.public_registration_reference, "")

From 991e4663c6f57baac4bfdf5cd2d84dcef23201e2 Mon Sep 17 00:00:00 2001
From: Sergei Maertens <sergei@maykinmedia.nl>
Date: Tue, 31 Dec 2024 11:45:10 +0100
Subject: [PATCH 3/3] :bug: [#4650] Ensure that email registration works with
 initial_data_reference

Prefilling some information/variables from the Objects API in
combination with email registration is a valid use case, as requested
in issue #4650 to keep email addresses private.

The ownership check method must be implemented if a submission with
non-empty initial_data_reference is being processed - there isn't
actually anything to check since registration always sends a new
email and there is no inherent update mechanism, so there's also no
inherent object ownership.
---
 src/openforms/registrations/contrib/email/plugin.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/openforms/registrations/contrib/email/plugin.py b/src/openforms/registrations/contrib/email/plugin.py
index eee1d091b4..d749b76ee6 100644
--- a/src/openforms/registrations/contrib/email/plugin.py
+++ b/src/openforms/registrations/contrib/email/plugin.py
@@ -45,6 +45,14 @@ class EmailRegistration(BasePlugin[Options]):
     verbose_name = _("Email registration")
     configuration_options = EmailOptionsSerializer
 
+    def verify_initial_data_ownership(
+        self, submission: Submission, options: Options
+    ) -> None:
+        """
+        Ownership checks for email registration are not meaningful, allow anything.
+        """
+        pass
+
     @staticmethod
     def get_recipients(submission: Submission, options: Options) -> list[str]:
         state = submission.load_submission_value_variables_state()