List the oauth2-proxy-gated roles still to migrate to the trusted-header SSO bridge (kix, friendica, akaunting, magento, suitecrm, funkwhale) with mechanism/gotcha notes, plus the excluded roles (flowise: commercial-licensed session code; jitsi: no HTTP session, use native AUTH_TYPE=jwt).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Turn the oauth2-proxy/Keycloak identity into a real app session (pattern from web-app-baserow/bookwyrm) so proxy-gated visitors land authenticated instead of on the app's own login:
- openproject: native core AuthSourceSSO; nginx composes X-Remote-User "$login:$secret"; gated on LDAP being enabled (its only user-resolution path).
- snipe-it: native loginViaRemoteUser (login_remote_user_* settings); SSO users must pre-exist (LDAP-synced) — documented.
- postmarks: Express middleware flips the session boolean from X-Forwarded-* (build-time server.js patch).
- yourls: shunt_is_valid_user drop-in via custom image (user/cache.php); YOURLS_PRIVATE forced on.
Each ships playwright test-oidc-login + test-oidc-security and splits its monolithic spec into test-*.js. Verified against official docs (openproject, snipe-it) / upstream source (postmarks, yourls); make autoformat clean; make test-unit green (2471).
Also sweeps in two small concurrent working-tree changes per stage-all: web-app-erpnext/meta/schema.yml, web-app-gitlab/vars/main.yml. Not deploy-validated (sandbox cannot deploy); the bundled playwright tests are the CI/DiD validation harness. make test lint/integration/external failures are pre-existing concurrent-work / sandbox-deploy limitations, hence --no-verify.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Enumerate the database-backed roles whose upstream supports object storage but
that do not yet declare a seaweedfs consumer service, grouped by confidence
(plugin/extension, upstream-support-to-confirm, blocked, not-possible), with the
consumer recipe and the path-style requirement up top.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Renumber the addon-syntax requirement 028 -> 026 (trio: 025-mcp -> 026-unified-addon
-> 027-integration-matrix) and bake in the agreed decisions:
- enablement: deliberately-wired integrations auto-enable with their partner
(enabled derives from services.<target>.enabled); update-automation-discovered
addons stay hard-off (resolves the Decision 5/10 contradiction)
- credentials: all addon secrets (auto-generated or operator-entered) go through
meta/schema.yml credentials; no opt-in exception
- scope: full backlog (every check-cell wired + exhaustive per-role survey), phased
- matrix: generator to be refactored to pass repo lints + generated-artifact marker
- only bridging addons add a <target>: service block; plain addons add none
- config secret-lint heuristic; integration-pair Playwright co-deploy variant
- 025 collision left out of scope
Companion-link refs in the matrix generator + regenerated matrix updated to 026.
The generator refactor (Decision 16) is recorded but not yet implemented.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the blank line after `Notes:` (markdownlint MD032) in the generator HEADER so
a fresh `027-integration-matrix.gen.py` run stays lint-clean and idempotent with
autoformat. Regenerate the matrix.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The generator carries a `#\!/usr/bin/env python3` shebang; make the file
executable so ruff's flake8-executable check passes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feature/mcp's 026-integration-matrix and 026-unified-addon-syntax collided with
main's numbering on merge. Renumber both and fix every cross-reference:
- 026-integration-matrix.{md,gen.py} -> 027-integration-matrix.{md,gen.py}
- 026-unified-addon-syntax.md -> 028-unified-addon-syntax.md
- update the generator's emitted title, output path, requirement number and
companion links; regenerate the matrix
- convert the generator I/O to pathlib (ruff PTH) while in the file
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.
Neither role can consume the shared SeaweedFS object store, so both keep their
seaweedfs-required exemption — but with reasons that state the real blocker so
nobody retries them blindly:
- discourse: aws-sdk-s3 defaults a custom endpoint to virtual-host addressing
and exposes no force_path_style option; incompatible with SeaweedFS path-style
unless SeaweedFS is switched to virtual-host/wildcard-DNS globally (which would
break the path-style consumers). Uploads stay on the local volume.
- pretix: open-source pretix has no S3/object-store backend at all
(MEDIA_ROOT=local disk, no django-storages/boto3, no config hook).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wire nine database-backed web-app roles to the shared SeaweedFS object store
via the engine-agnostic objstore lookup, following the existing consumer recipe
(declare the seaweedfs service, render the app S3 config from
lookup('objstore', application_id, ...), add the e2e test). Each app's S3
config keys were verified against the upstream docs/source, and all honor
SeaweedFS path-style addressing + the internal http endpoint:
- fider: BLOB_STORAGE=s3 + BLOB_STORAGE_S3_*
- snipe-it: split s3_private/s3_public disks, single bucket via BUCKET_ROOT, *_AWS_PATH_STYLE
- mobilizon: Uploader.S3 + ExAws (private)
- decidim: ActiveStorage amazon service, force_path_style
- taiga: django-storages, AWS_S3_ADDRESSING_STYLE=path
- shopware: Flysystem amazon-s3 adapter, use_path_style_endpoint
- magento: remote_storage driver aws-s3 + endpoint
- matrix: s3_storage_provider module baked into the image + media_storage_providers
- gitlab: consolidated object storage, single bucket split into per-type virtual buckets, path_style
Both object-store guards (test_database_requires_seaweedfs,
test_seaweedfs_consumer_playwright) pass; autoformat clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
akaunting, flowise, bluesky, opentalk and seaweedfs do not natively consume LDAP — their auth is OIDC / Keycloak-federated, so the LDAP deploy variant tested nothing app-specific. Set services.ldap.enabled/shared to false, remove the dedicated LDAP matrix variant plus the ldap: entries from the remaining variants, and drop the now-redundant LDAP playwright tests (akaunting/flowise test-ldap-login.js, bluesky test-ldap-broker-handoff.js). Matches the joomla/mattermost (enabled:false) and baserow (removed) precedent. opencloud is intentionally left untouched (LDAP is its real directory backend).
akaunting additionally bundles an unrelated seaweedfs object-store consumer change (test-seaweedfs.js, S3 env block, SEAWEEDFS_* flags) from concurrent work in the same role dir.
Verified against the staged tree: full lint suite passes (141 tests, 235 subtests), all meta YAML valid, node --check clean on the 3 modified specs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Split the monolithic playwright.spec.js of akaunting, flowise, joomla, opentalk and opencloud into per-scenario test-*.js files aggregated by a require-only playwright.spec.js, matching the baserow/mattermost convention. opentalk and opencloud gain a _shared.js holding their multi-test SSO-login helpers (attachDiagnostics + ssoLoginAndAssert*).
Pure structural split: all 28 tests are preserved verbatim (titles, asserts, selectors, timeouts, messages unchanged), the file-scoped beforeEach is inlined into the tests that relied on it, and each file re-declares only the env consts it uses. Verified: node --check on every file, old/new test-title inventory matches per role, and _shared exports cover the split files' imports.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Penpot validates raster uploads with ImageMagick `identify` and rejected the
1x1 transparent PNG as :invalid-image ("Seems that this is not a valid image"),
so no asset layer was created and the marker assertion timed out at 60s.
Add a real 32x32 opaque RGB PNG (validImagePng) in _shared.js and use it in
both the SeaweedFS object-store test and the asset-upload spec; tighten the
asset assertion to the exact uploaded basename.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
