Headless: creating and logging in with local accounts still works with SOCIALACCOUNT_ONLY = True in settings.py

[robin24]

In my Django projects I'd like to limit account creation and signups to social accounts. Thus, I have
SOCIALACCOUNT_ONLY = True
set in my settings.py file, which according to the docs disables all functionality related to local accounts.
However, even with this set I am still able to create local accounts via the headless /auth/signup endpoint, and can log in with that local account using the respective endpoint as well.

I hope I'm not overlooking something major here, but my understanding is that, if SOCIALACCOUNT_ONLY = True disables all functionality regarding local accounts, this should apply to headless API functionality as well.

As an alternative to disabling local accounts this way, I suppose I would have to only enable a subset of the allauth.headless.urls, but to me at least it would seem more straightforward if the config setting applied here as well.

Any clarification on this would be much appreciated, thanks!

[pennersr]

This is actually a bug that needs to be fixed.