Files
computer-playbook/roles/web-app-openproject/files/ruby/lock_seeded_admin.rb
T
kevinveenbirkenbachandClaude Opus 5.5 ccbf8f168d feat(web-app-openproject): finish the corporate design and lock the seeded admin
templates/style.css.j2 now covers the whole interface: the header is the
brand frame, page, text and primary action take the palette, focus
indicators use the frame text color in the header and the link color
elsewhere, and administration tiles and disabled fields leave upstream's
colors; it shows the generated logo (260x94 on frame chrome) and icon
slots meta/services.yml declares. templates/design.js.j2 mirrors a theme
picked in the interface settings, and with design on templates/env.j2
sets the application title and makes "sync with OS" the default theme,
so accounts without a stored theme follow the browser.

OpenProject seeds an upstream account admin/admin. templates/env.j2 sets
OPENPROJECT_SEED__ADMIN__USER__LOCKED and tasks/04_admin.yml runs
files/ruby/lock_seeded_admin.rb, which locks that account unless its
login is the configured administrator; files/playwright/
test-seeded-admin.js proves the published password no longer signs in
with sso off.

files/playwright/test-design.js checks tokens, the browser-following
default, header frame and palette, focus colors, login page,
administration tiles, a picked theme, logo and title, every image the
stylesheet references, and captures the gallery. README.md gains the
resource links; TODO.md records two credentials in container exec argv
and the tasks that report changed on every deploy.

Verified green on the compose stack (15 passed); only README.md and
TODO.md changed after that run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-13 13:10:12 +02:00

11 lines
407 B
Ruby

# nocheck: mirrored-unit-test - runs in the OpenProject console against User and Setting;
# the models only exist once OpenProject has booted
platform_login = ENV.fetch("OPENPROJECT_ADMIN_LOGIN")
User.where(login: "admin", mail: Setting.seed_admin_user_mail).find_each do |user|
next if user.login.casecmp?(platform_login) || user.locked?
user.locked!
puts "Locked seeded account #{user.login}"
end