mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
b23653adf8
Moodle 4.5 ships aiprovider_openai in core, where every action carries its own endpoint rather than one shared base URL, so the provider is configured per action. aiprovider_openaicompatible would be the natural fit but requires Moodle 5.0, which the role does not pin, so the per-action endpoints are the only surface available on this branch. MOODLE_LITELLM_SETTINGS carries that as a list of component/name/value triples and also enables the courseassist and editor placements: a configured provider with no enabled placement exposes no AI surface to any user, so both halves are required for the feature to exist. An earlier revision set a global `enableai`, which does not exist in 4.5. tasks/utils/ai_gateway.yml verifies the shared gateway contract, writes each setting through admin/cli/cfg.php, then purges caches. Without the purge Moodle keeps answering from its config cache and the new endpoint appears to have been ignored. The egress rule is the half that is easy to miss. Moodle's cURL security helper blocks private address ranges outright, so a correctly configured in-cluster endpoint is still refused, and it surfaces as a generic provider error rather than as a blocked request. 01_manager_ops.yml therefore writes curlsecurityblockedhosts and curlsecurityallowedport, appending the gateway's port only while litellm is enabled. This deliberately narrows a security control: 172.16/12 and 192.168/16 become reachable so the container network resolves, while 10.0.0.0/8, link-local and loopback stay blocked. The README records the trade-off. MOODLE_EGRESS_NEWLINE is double-quoted on purpose. Moodle stores both settings one entry per line; a single-quoted YAML scalar hands Jinja a literal backslash-n, the whole list collapses into one unparseable token, and the net effect is that every port is blocked rather than the intended two. Verified in the container with negative controls: keycloak and litellm reachable, 10.208.0.5 and 127.0.0.1 still refused. The spec opens a site-administrator session -- through Keycloak when sso is on, because 04_oidc.yml rewrites every account to auth: oidc and no password reaches it then, and through the native form otherwise -- asserts the endpoint is http on an undotted host that is not Moodle's own domain, then calls aiplacement_editor_generate_text and requires a non-empty completion. That last step is a prompt actually answered through the gateway, not a config read-back. Verified: the deploy-time read-back assertion ran ok in a variant-2 round and the spec executed rather than skipping. The egress newline defect and its fix were both measured in-container. Not verified: I confirmed the spec ran but not that its final assertion passed, and the cfg.php loop is changed_when: false, so the deploy log cannot show whether a setting actually moved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
18 lines
619 B
JavaScript
18 lines
619 B
JavaScript
const { test } = require("@playwright/test");
|
|
|
|
const shared = require("./_shared");
|
|
|
|
test.use({ ignoreHTTPSErrors: true });
|
|
|
|
test.beforeEach(shared.beforeEach);
|
|
|
|
require("./test-baseline").register(shared);
|
|
require("./test-ldap-variant").register(shared);
|
|
require("./test-profile-readonly").register(shared);
|
|
require("./test-keycloak-scope").register(shared);
|
|
require("./test-lam-writethrough").register(shared);
|
|
require("./test-administrator-persona").register(shared);
|
|
require("./test-guest-persona").register(shared);
|
|
require("./test-mcp-guest").register(shared);
|
|
require("./test-litellm-gateway").register(shared);
|