mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c35f2409a4
Nobody could sign in to Odoo through Keycloak. Odoo sent an http redirect URI, and Keycloak refused it as "Invalid parameter: redirect_uri". The addon auth_oauth_https builds that URI from web.base.url. Two things kept it from doing so after the image moved to Odoo 20. Its manifest declared version 19.0.1.8.0, and Odoo marks a module whose version names another series as not installable. It only warns about that, so the install task stayed green and the addon was missing. The manifest now declares 1.8.0, which Odoo prefixes with its own series. Once installed, the addon read the parameter with get_param, which Odoo 20 replaced by typed getters. The call raised AttributeError, a broad except logged it and fell back to the URL of the request, which is http behind the proxy. The addon reads the parameter with get_str now and no longer catches the error. A deploy now fails when the addon is not installed afterwards. The check reads ir_module_module, because the output of "odoo -i" does not tell an installed module from a skipped one. The spec logged out by navigating to /web/session/logout. Odoo 20 accepts POST only on that route and answered 405, so both SSO tests failed after a successful login. The spec logs out through the user menu now. A host that runs the suite with several workers still failed it. Odoo computes the session token of an account from its OAuth access token, so every new sign-in ends the other sessions of that account, and the spec files share the administrator. The role caps its suite at one worker with PLAYWRIGHT_MAX_WORKERS, which the central config now honours, and the spec asserts the cap. Closes #822 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
43 lines
2.2 KiB
Bash
43 lines
2.2 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — persona drives the OIDC path; LDAP federation is exercised in the LDAP-only matrix variant
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
NODE_TLS_REJECT_UNAUTHORIZED=0
|
|
|
|
ODOO_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
# nocheck: persona-block-rationale — Odoo's SSO entry is an auth_oauth provider link that only renders inside .o_login_auth on /web/login (files/playwright/playwright.spec.js:26-45), not on the APP_BASE_URL root the persona helper starts from, and its logout sits behind the user menu (files/playwright/playwright.spec.js:77-80); the admin chain is covered by "odoo: admin sso login, verify ui, logout" (see README "Persona contract opt-outs").
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; biber's chain is covered by "odoo: biber sso login, verify ui, logout" (files/playwright/playwright.spec.js:162).
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
PLAYWRIGHT_MAX_WORKERS=1
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|
|
{{ lookup('addon_env_flags', application_id) }}
|
|
|