test_mirrored_unit_tests expects tests/unit/python/roles/<role>/files/test_<name>.py for a script under files/python/, the way sys-svc-container already sits. This one was a level deeper, so the lint reported api_administrators.py as having no test at all.
The destination package carried no PROJECT_ROOT, which the test imports; the sibling defines it with parents[6] and this now does the same. The reflowed lines are autoformat's work from an earlier gate pass, not a change of substance: the file is otherwise byte-identical.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
With single sign-on disabled, the platform administrator had no indexer
account, so the dashboard login answered "Invalid username or password".
internal_users.yml now carries that account with backend role "admin"
while sso is off. The bcrypt salt is fixed per role, so a repeat deploy
renders the same hash.
The dashboard queries the Wazuh API with run_as. The default security
rules only match the users "elastic" and "admin", so every other signed-in
user got "You have no permissions" on the Wazuh pages. A new task runs
api_administrators.py inside wazuh.manager with the manager's own API
account. It creates the rule "infinito_administrators", corrects it when
its content drifts, and links it to the "administrator" role. The rule
matches the same three backend roles that roles_mapping.yml maps to
all_access, so it grants nothing to a principal that did not already hold
indexer all_access. The task prints CHANGED or OK and is idempotent.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5