mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
641f7a40dd
Sociallogin creates a Nextcloud user as "<provider name>-<keycloak sub>",
and the provider name was the Keycloak domain. On an onion variant that
domain alone is 67 chars, so every OIDC callback died with
InvalidArgumentException "Username is too long" and HTTP 500 at
/apps/sociallogin/custom_oidc/auth.<onion> (run 34615516009,
Nextcloud#1, 204 occurrences). The whiteboard and admin OIDC specs failed
on the same login.
This is the second derived identifier an onion domain overflows; the
kernel hostname is the first, clamped to 63 bytes by container_hostname
since the pretix and bookwyrm fixes. The domain-or-entity rule now lives in
one lookup, bounded_name(application_id, max_length): the primary domain
when it fits, otherwise the entity name. container_hostname delegates to it
at 63 and keeps its eight callers and its behaviour.
The provider name is bounded_name('web-app-keycloak', 64 - 1 - 36), the uid
limit minus the separator and the UUID sub. A short clearnet domain stays
the name, so existing users keep their uids; an onion deploy gets
"keycloak", which, unlike a hash of the domain, survives a rotated onion
address.
Tests cover the lookup's fit, boundary and fallback cases and its argument
validation, container_hostname's delegation at 63, and the provider name's
room for the sub.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
30 lines
957 B
Python
30 lines
957 B
Python
import unittest
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from ansible.errors import AnsibleError
|
|
|
|
from plugins.lookup.container_hostname import LookupModule
|
|
|
|
|
|
class TestContainerHostnameLookup(unittest.TestCase):
|
|
def test_delegates_to_bounded_name_at_the_kernel_limit(self):
|
|
bounded = MagicMock()
|
|
bounded.run.return_value = ["xwiki"]
|
|
with patch(
|
|
"plugins.lookup.container_hostname.lookup_loader.get",
|
|
return_value=bounded,
|
|
) as get:
|
|
result = LookupModule().run(["web-app-xwiki"], variables={"k": "v"})
|
|
|
|
self.assertEqual(result, ["xwiki"])
|
|
self.assertEqual(get.call_args.args[0], "bounded_name")
|
|
bounded.run.assert_called_once_with(["web-app-xwiki", 63], variables={"k": "v"})
|
|
|
|
def test_bad_arity_raises(self):
|
|
with self.assertRaises(AnsibleError):
|
|
LookupModule().run([], variables={})
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|