mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
bf1b1f2769
Fider v0.39.0 accepts an OAuth redirect only when its origin equals OAuthBaseURL (isKnownOAuthOrigin compares u.Scheme + "://" + u.Host with it), and in single-host mode OAuthBaseURL is BASE_URL unchanged. The tls lookup's url.base ends with "/", so the comparison never matched and every Keycloak login was rejected. Main run 41925343136 (2df12002c0), Fider#0 compose clearnet centos/ext4: playwright.spec.js:56 and :88 find no .c-menu-user after SSO, and the rescue fider.log shows 11x "OAuth callback state for provider _keycloak points at an unknown origin. Aborting sign in process." The image is the mirrored getfider/fider stable, refreshed 35 hours before the run. The tls lookup now also returns url.origin, the base URL without its slash (the lookup hunk of44aaa68924on feature/store-i18n), and the Fider env passes it as BASE_URL (d531d35823there). url.base keeps its value, so no other consumer changes, and both lines match the store-i18n side for a conflict-free merge. | 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate | | --- | --- | --- | --- | --- | --- | --- | | 88 % | 3 % | – | – | ~100 % | 85 | ⛔ fix 88 % < 90 | Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
119 lines
3.8 KiB
Python
119 lines
3.8 KiB
Python
# STRICT TLS resolver (without SAN/cert identity planning).
|
|
#
|
|
# Certificate identity planning (SAN list, cert/key paths) is moved to:
|
|
# lookup_plugins/cert.py
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from ansible.errors import AnsibleError
|
|
from ansible.plugins.loader import lookup_loader
|
|
from ansible.plugins.lookup import LookupBase
|
|
|
|
from utils.tls_common import (
|
|
AVAILABLE_FLAVORS,
|
|
align_domain_to_consumer,
|
|
as_str,
|
|
collect_domains_for_app,
|
|
norm_domain,
|
|
require,
|
|
resolve_enabled,
|
|
resolve_mode,
|
|
resolve_term,
|
|
uniq_preserve,
|
|
want_get,
|
|
)
|
|
|
|
|
|
class LookupModule(LookupBase):
|
|
def run(self, terms, variables: dict | None = None, **kwargs):
|
|
variables = variables or {}
|
|
|
|
if not terms or len(terms) not in (1, 2):
|
|
raise AnsibleError(
|
|
"tls: one or two terms required: (domain|application_id[, want_path])"
|
|
)
|
|
|
|
templar = getattr(self, "_templar", None)
|
|
term = as_str(templar.template(terms[0]) if templar else terms[0])
|
|
if not term:
|
|
raise AnsibleError("tls: term is empty")
|
|
|
|
want = as_str(terms[1]).strip() if len(terms) == 2 else ""
|
|
|
|
domains = lookup_loader.get(
|
|
"domains", loader=self._loader, templar=getattr(self, "_templar", None)
|
|
).run([], variables=variables)[0]
|
|
applications = lookup_loader.get(
|
|
"applications", loader=self._loader, templar=getattr(self, "_templar", None)
|
|
).run([], variables=variables)[0]
|
|
enabled_default = require(variables, "TLS_ENABLED", (bool, int))
|
|
mode_default = as_str(require(variables, "TLS_MODE", str))
|
|
|
|
if mode_default not in AVAILABLE_FLAVORS:
|
|
raise AnsibleError(
|
|
f"tls: TLS_MODE must be one of {sorted(AVAILABLE_FLAVORS)}, got '{mode_default}'"
|
|
)
|
|
|
|
forced_mode = as_str(kwargs.get("mode", "auto")).lower()
|
|
|
|
app_id, primary_domain = resolve_term(
|
|
term,
|
|
domains=domains,
|
|
applications=applications,
|
|
forced_mode=forced_mode,
|
|
err_prefix="tls",
|
|
)
|
|
|
|
if forced_mode == "app" or (forced_mode == "auto" and "." not in term):
|
|
primary_domain = norm_domain(
|
|
align_domain_to_consumer(
|
|
domains,
|
|
app_id,
|
|
primary_domain,
|
|
variables=variables,
|
|
templar=templar,
|
|
)
|
|
)
|
|
|
|
all_domains = collect_domains_for_app(domains, app_id, err_prefix="tls")
|
|
all_domains = (
|
|
uniq_preserve([primary_domain, *all_domains])
|
|
if all_domains
|
|
else [primary_domain]
|
|
)
|
|
|
|
app = applications.get(app_id, {})
|
|
if not isinstance(app, dict):
|
|
app = {}
|
|
|
|
enabled = resolve_enabled(
|
|
app, bool(enabled_default), primary_domain=primary_domain
|
|
)
|
|
mode = resolve_mode(app, enabled, mode_default, err_prefix="tls")
|
|
|
|
if mode not in {"off"} | AVAILABLE_FLAVORS:
|
|
raise AnsibleError(f"tls: unsupported mode '{mode}' for app '{app_id}'")
|
|
|
|
web_protocol = "https" if enabled else "http"
|
|
websocket_protocol = "wss" if enabled else "ws"
|
|
web_port = 443 if enabled else 80
|
|
origin = f"{web_protocol}://{primary_domain}"
|
|
base_url = f"{origin}/"
|
|
|
|
resolved: dict[str, Any] = {
|
|
"application_id": app_id,
|
|
"domain": primary_domain,
|
|
"enabled": enabled,
|
|
"mode": mode,
|
|
"domains": {"primary": primary_domain, "all": all_domains},
|
|
"protocols": {"web": web_protocol, "websocket": websocket_protocol},
|
|
"ports": {"web": web_port},
|
|
"url": {"base": base_url, "origin": origin},
|
|
}
|
|
|
|
if want:
|
|
return [want_get(resolved, want)]
|
|
return [resolved]
|