fix(discourse): enable OpenID Connect only after its prerequisites are set

Discourse latest now validates openid_connect_enabled and refuses it
until the discovery document, client ID and client secret are set. The
bootstrap enabled OIDC first, so a fresh database aborted the launcher
rebuild at `rails r "SiteSetting.openid_connect_enabled = true"` with
Discourse::InvalidHTMLParameters (run 34615516009, WordPress#0, job
103327034654). Existing databases hid it because the values were already
stored.

The enable step now follows the three settings it depends on. A test
reads the real template and requires every prerequisite line to precede
the enable line; against the previous template it fails.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-discourse/templates/config.yml.j2

@@ -165,10 +165,10 @@ run:
   - exec: rails r "SiteSetting.username_change_period = 0" # Deactivate changing of username
 
   # OIDC Activation
-  - exec: rails r "SiteSetting.openid_connect_enabled = true"
   - exec: rails r "SiteSetting.openid_connect_discovery_document = '{{OIDC.CLIENT.DISCOVERY_DOCUMENT}}'"
   - exec: rails r "SiteSetting.openid_connect_client_id = '{{ OIDC.CLIENT.ID }}'"         
-  - exec: rails r "SiteSetting.openid_connect_client_secret = '{{ OIDC.CLIENT.SECRET }}'"     
+  - exec: rails r "SiteSetting.openid_connect_client_secret = '{{ OIDC.CLIENT.SECRET }}'"
+  - exec: rails r "SiteSetting.openid_connect_enabled = true"
   - exec: rails r "SiteSetting.openid_connect_rp_initiated_logout_redirect = '{{ DISCOURSE_OIDC_LOGOUT_REDIRECT_URL }}'"
   - exec: rails r "SiteSetting.openid_connect_allow_association_change = false"
   - exec: rails r "SiteSetting.openid_connect_rp_initiated_logout = true"

tests/unit/python/roles/web-app-discourse/__init__.py

@@ -0,0 +1 @@
+

tests/unit/python/roles/web-app-discourse/test_oidc_setting_order.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import unittest
+
+from utils.cache.files import PROJECT_ROOT, read_text
+
+CONFIG = PROJECT_ROOT / "roles/web-app-discourse/templates/config.yml.j2"
+PREREQUISITES = (
+    "openid_connect_discovery_document",
+    "openid_connect_client_id",
+    "openid_connect_client_secret",
+)
+
+
+def _line_of(lines: list[str], setting: str) -> int:
+    return next(
+        index
+        for index, line in enumerate(lines)
+        if f'rails r "SiteSetting.{setting} = ' in line
+    )
+
+
+class TestDiscourseOidcSettingOrder(unittest.TestCase):
+    def test_oidc_is_enabled_only_after_its_prerequisites_are_set(self) -> None:
+        lines = read_text(str(CONFIG)).splitlines()
+        enable = _line_of(lines, "openid_connect_enabled")
+        for setting in PREREQUISITES:
+            with self.subTest(setting=setting):
+                self.assertLess(
+                    _line_of(lines, setting),
+                    enable,
+                    "Discourse rejects openid_connect_enabled = true on a fresh "
+                    "database until the discovery document, client ID and client "
+                    "secret are set",
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()