kevinveenbirkenbachandClaude Opus 5 b764b00ba3 fix(keycloak): forward the access token only to consumers that read it ...

The SSO gate handed X-Forwarded-Access-Token to every oauth2-fronted upstream, so each of the 28 gated roles received a full-scope bearer for the signed-in user while exactly one, n8n, decodes it. The token also grows with the realm's registered origins, and LAM's Apache rejects a header field above 8190 bytes (Moodle#0, run 33689701895).

Consumers now declare services.sso.oauth2.pass_access_token. Without it oauth2-proxy already answers the auth request without the token, and the gate blanks the upstream header rather than dropping the directive, because nginx inherits proxy_set_header as an array and an unset header would let a client-supplied one through. The new lint keeps declaration and use in step in both directions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:20:19 +02:00

..

__init__.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_active_alertmanager_channels.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_addon_env_flags.py

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

test_api.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_application_gid.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_applications_current_play.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_applications.py

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

test_asset.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_backup_volume.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_ca_injected.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_canonical_url.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_cdn.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_cert.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_command_path.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_external_networks.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_file_args.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_networks.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_only.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_replicas.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_restart.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_volumes_realign.py

fix(compose_volumes): leave the two-engine diagnostic to its owner

2026-08-30 13:56:51 +02:00

test_compose_volumes_render.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_compose_volumes.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_config_lookup.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_address.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_depends_on.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_deploy.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_dns.py

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

test_container_extra_hosts.py

fix(discourse): pin the OIDC issuer for the launcher-built container

2026-09-01 12:00:56 +02:00

test_container_healthcheck.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_hostname.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_image.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_networks.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_ports.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_service.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_container_volumes_render.py

fix(volumes): render a tmpfs size as the byte count compose demands

2026-08-31 01:17:54 +02:00

test_container.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_current_play_redirect_domains.py

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

test_database.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_depends_on.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_deployment.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_docker_cards.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_domain_lookup.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_email.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_engine_qdrant_key.py

fix(qdrant,flowise): authenticate the vector engine and prove what Flowise can reach

2026-08-29 00:49:58 +02:00

test_fediwall_active.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_image.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_local_mtime_qs.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_mcp_client_bearer.py

refactor(mcp)!: prove the endpoint contract with a CLI test, not a deploy probe

2026-09-01 20:46:26 +02:00

test_mcp_credential.py

Merge fork/feature/svc-net-tor into feature/ai-agent-employees

2026-08-24 16:32:30 +02:00

test_mcp_servers.py

fix(mcp): read a provider's bearer where provisioning writes it

2026-08-29 20:57:07 +02:00

test_native_metrics_apps.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_nfs_lookups.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_nginx.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_node_max_old_space_size.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_objstore_consumers.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_objstore.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_path_absolute.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_playwright_workers.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_postgres_libraries.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_prometheus_integration_active.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_proxy_pass.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_rbac_group_path.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_redirect_uris.py

fix(keycloak): register redirect URIs only for the apps a play deploys

2026-09-03 09:18:07 +02:00

test_role_templates_expanded.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_role_tests.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_roles_with_service.py

refactor(mcp): drop the path-addressed endpoint from client discovery

2026-08-29 10:55:34 +02:00

test_scrape_target.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_service_extensions.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_service_registry.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_service.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_shared_network_key.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_smtp_host.py

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

test_sso_oidc_plugin.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_sso_proxy_consumers.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_sso.py

fix(keycloak): forward the access token only to consumers that read it

2026-09-03 09:20:19 +02:00

test_timeout.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_tls.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_tor_ports.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_tor_reachable.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_tor_socks_proxy.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_tor_socks.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_unit_name.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_users_non_reserved.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_users.py

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

test_version.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00

test_volume.py

refactor(layout): sort shipped scripts by language and split the unit suite

2026-08-22 01:31:09 +02:00