The image bump 9ed531a77e (#1254) put Stalwart v1.0.1 on main. v1.0.1
shows the password form right after the username, without the "Allow"
consent step that v1.0.0 asked for. test-login-native.js waited for that
button unconditionally, so "administrator: stalwart recovery admin
native login and logout" timed out after 60 s in every attempt
(locator.waitFor on getByRole('button', { name: /^allow$/i })).
The spec now waits for either the Allow button or the password field and
clicks Allow only when it is shown; the same check runs before the
dashboard assertion after sign-in. Both waits still fail when neither
element appears.
The change is identical to the one on feature/updater-lockdown-probe,
so the two lines do not conflict when they meet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up to the v1.0.0 port, closing holes a review and a local run found:
- WebUI sign-in: WebUI v2 sends an http:// client-metadata-document id
on the onion origin, which Stalwart v1.0.0 rejects (unknown http ids
get no CIMD fallback, trusted hosts require TLS). The recovery admin
under SSO hit the same wall with the bare id 'stalwart-webui'. Register
a public first-party x:OAuthClient 'stalwart-webui' with the WebUI's
callback and login URIs on the served origin, and always inject it as
the Application's oauthClientId. Native sign-in now shows Stalwart's
consent step; test-login-native.js clicks it and also runs under SSO.
- Store guard: the previous guard only checked a running 0.16 server; a
local run showed v1 writing into a 0.16 store whose server was stopped.
The guard now reads the store whenever one exists (shared: pg_database,
dedicated: volume) and fails on the 0.16 bigint layout. A host marker
written at the end of a successful v1 deploy lets restores and
redeploys with a stopped dedicated database pass; without the marker,
a stopped dedicated database fails with an explicit message instead of
a masked psql error. Queries retry while the database recovers.
- README: WebUI sign-in, guard semantics, restore and redeploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5
Alejandro Roman