mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 21:26:44 +00:00
kevinveenbirkenbachandClaude Opus 5
3fcbadefd3
3c72c2002a renamed the application administrator from the host account to
platform_administrator, whose username is platformadmin and whose e-mail
differs. Five roles kept addressing the identity that no longer exists.
listmonk was the worst of them, because it failed silently: the realign SQL
and the task beside it both matched WHERE username = 'administrator' while the
account listmonk creates is LISTMONK_ADMIN_USERNAME, so every deploy updated
zero rows and reported ok. Both now take the username the role declares, passed
to psql as -v login.
espocrm carries the existing row onto the declared username rather than leaving
set-password pointed at a login a pre-migration database never had. The row is
found by type = admin, which names no account and so stays inside the rule that
only user-administrator may reference the host account; zero or several
administrator rows refuse with the count instead of guessing. The password path
is untouched, it was already unconditional.
friendica hoists the nickname into a variable and creates, searches and guards
on it, instead of the hardcoded literal that no longer matches the name the
LDAP bind presents.
discourse looks its administrator up by username instead of by e-mail. Keyed on
the e-mail it created a second administrator on an already-deployed instance and
left the first one alive; keyed on the username it converges one row and moves
the e-mail onto it, which keeps the existing readback assertion satisfied.
akaunting only reports. The account is identified by its e-mail, which is also
the login, the role is lifecycle: eol with its primary service disabled, and
rewriting the login of accounting software from an unattended deploy is a
heavier act than the diagnosis is worth. The failure now names the cause and
the remedy, through an unmasked fail task, because the exec task's no_log would
otherwise swallow the message in production.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
52 lines
1.6 KiB
PHP
52 lines
1.6 KiB
PHP
<?php
|
|
// nocheck: mirrored-unit-test - requires /var/www/html/bootstrap.php at the top level
|
|
// and rewrites the live user table through EspoCRM's own entity manager
|
|
/**
|
|
* Move the administrator EspoCRM persisted at install onto the declared username.
|
|
*
|
|
* Env (from the container):
|
|
* ESPOCRM_ADMIN_USERNAME username the deployment declares
|
|
*
|
|
* Exit: 0 with [CHANGED] or [UNCHANGED] on stdout, 1 with [FAIL] on stderr.
|
|
*/
|
|
|
|
require "/var/www/html/bootstrap.php";
|
|
|
|
$userName = getenv('ESPOCRM_ADMIN_USERNAME');
|
|
|
|
if ($userName === false || $userName === '') {
|
|
fwrite(STDERR, "[FAIL] ESPOCRM_ADMIN_USERNAME is empty\n");
|
|
exit(1);
|
|
}
|
|
|
|
$app = new \Espo\Core\Application();
|
|
$app->setupSystemUser();
|
|
|
|
$entityManager = $app->getContainer()->getByClass(\Espo\Core\ORM\EntityManager::class);
|
|
$repository = $entityManager->getRDBRepositoryByClass(\Espo\Entities\User::class);
|
|
|
|
if ($repository->where(['userName' => $userName])->findOne()) {
|
|
echo "[UNCHANGED] an account already carries the declared username\n";
|
|
exit(0);
|
|
}
|
|
|
|
$administrators = [];
|
|
|
|
foreach ($repository->where(['type' => \Espo\Entities\User::TYPE_ADMIN])->find() as $administrator) {
|
|
$administrators[] = $administrator;
|
|
}
|
|
|
|
if (count($administrators) !== 1) {
|
|
fwrite(STDERR, sprintf(
|
|
"[FAIL] no account carries the declared username and %d administrator rows exist,"
|
|
. " so none of them can be carried onto it without picking one by hand\n",
|
|
count($administrators)
|
|
));
|
|
exit(1);
|
|
}
|
|
|
|
$administrators[0]->setUserName($userName);
|
|
$entityManager->saveEntity($administrators[0]);
|
|
|
|
echo "[CHANGED] the installed administrator was carried onto the declared username\n";
|