authelia/mealie/actualbudget/gitea: no more silent no-op reruns

Confirmed live: re-running ActualBudget's Update path produced zero
output for the Authelia SSO step — no prompt, no message, straight back
to the shell. Root cause: the idempotency guards in
_actualbudget_offer_authelia_oidc / _mealie_offer_authelia_oidc /
_gitea_offer_actions_runner were plain `grep -q ... && return 0` — silent
by construction. Indistinguishable from the step not running at all,
which is exactly what it looked like.

ActualBudget and Mealie's OIDC offers now explain what they found and
ask whether to reconfigure (registers a fresh Authelia client + secret,
clearing the old env vars first) instead of silently bailing. Gitea's
Actions-runner offer explains what it found and how to check its status
(reconfiguring that one means editing a docker-compose service block,
not just a couple of env vars, so it just informs rather than offering
to redo it).

Also: _authelia_scope_access now shows existing Authelia usernames as a
numbered list before asking who should have access — picking by number
works alongside typing new names directly (mix freely, e.g. "1 3
newperson"), rather than requiring exact usernames typed from memory
with no reference and no protection against a typo silently creating a
duplicate account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEQNc4NfBST1m9NtCZVYa8

services/actualbudget.sh

@@ -219,7 +219,20 @@ _actualbudget_offer_authelia_oidc() {
 
     [ -d "$DOCKER_DIR/authelia" ] || return 0
     declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
-    grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null && return 0
+
+    # Confirmed live: a silent skip here (just `return 0`, no output) looked
+    # indistinguishable from the whole SSO step not running at all — a rerun
+    # against an .env that already had these vars (even from an earlier
+    # attempt that didn't fully complete) produced zero output, no prompt,
+    # nothing. Always say something instead, and offer to redo it.
+    if grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null; then
+        echo ""
+        log_info "Authelia SSO is already configured for Actual Budget (ACTUAL_OPENID_* already set in $DIR/.env)."
+        local RECONFIGURE=""
+        prompt_yn "  Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
+        [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
+        sed -i '/^ACTUAL_OPENID_/d' "$DIR/.env"
+    fi
 
     echo ""
     local USE_SSO=""

services/authelia.sh

@@ -1038,24 +1038,36 @@ _authelia_scope_access() {
 
     local -a existing_users
     mapfile -t existing_users < <(_authelia_list_usernames "$users_file")
+    local i
     if [ "${#existing_users[@]}" -gt 0 ]; then
-        echo "  Existing Authelia users: ${existing_users[*]}"
+        echo "  Existing Authelia users:"
+        for i in "${!existing_users[@]}"; do
+            echo "    $((i + 1))) ${existing_users[$i]}"
+        done
+        echo "  Pick by number (space-separated), and/or type new usernames directly"
+        echo "  to create them — mix freely, e.g. \"1 3 newperson\"."
     else
-        echo "  No existing Authelia users yet — anyone you list below gets created fresh."
+        echo "  No existing Authelia users yet — type usernames below to create them fresh."
     fi
-    echo "  Usernames who should have access (space-separated). Anyone listed"
-    echo "  who doesn't already have an Authelia account gets one created —"
-    echo "  you'll get their temporary password to hand over. Typos against an"
-    echo "  existing name above create a new, separate account instead of"
-    echo "  matching it, so copy from that list rather than retyping from memory."
+    echo "  Anyone typed (not picked by number) who doesn't already have an"
+    echo "  Authelia account gets one created — you'll get their temporary"
+    echo "  password to hand over."
     local raw_users=""
-    prompt_text "  Usernames:" "" raw_users
-    local -a usernames
-    read -ra usernames <<< "$raw_users"
-    if [ "${#usernames[@]}" -eq 0 ]; then
+    prompt_text "  Usernames/numbers:" "" raw_users
+    local -a raw_tokens usernames
+    read -ra raw_tokens <<< "$raw_users"
+    if [ "${#raw_tokens[@]}" -eq 0 ]; then
         log_warning "No usernames entered — leaving $domain open to all Authelia users."
         return 0
     fi
+    local t
+    for t in "${raw_tokens[@]}"; do
+        if [[ "$t" =~ ^[0-9]+$ ]] && [ "$t" -ge 1 ] && [ "$t" -le "${#existing_users[@]}" ]; then
+            usernames+=("${existing_users[$((t - 1))]}")
+        else
+            usernames+=("$t")
+        fi
+    done
 
     local u start_end start end
     for u in "${usernames[@]}"; do

services/gitea.sh

@@ -255,7 +255,11 @@ _gitea_offer_authelia_sso() {
 _gitea_offer_actions_runner() {
     local DIR="$1"
 
-    grep -q '^  act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null && return 0
+    if grep -q '^  act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null; then
+        log_info "Gitea Actions runner is already set up (act_runner service already in docker-compose.yml) — skipping."
+        log_info "Check its status: docker compose -f $DIR/docker-compose.yml ps act_runner"
+        return 0
+    fi
 
     echo ""
     local USE_ACTIONS=""

services/mealie.sh

@@ -219,7 +219,18 @@ _mealie_offer_authelia_oidc() {
 
     [ -d "$DOCKER_DIR/authelia" ] || return 0
     declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
-    grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null && return 0
+
+    # Same reasoning as the equivalent check in services/actualbudget.sh: a
+    # silent `return 0` here is indistinguishable from this step not
+    # running at all. Always say something, and offer to redo it.
+    if grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null; then
+        echo ""
+        log_info "Authelia SSO is already configured for Mealie (OIDC_* already set in $DIR/.env)."
+        local RECONFIGURE=""
+        prompt_yn "  Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
+        [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
+        sed -i '/^OIDC_/d' "$DIR/.env"
+    fi
 
     local BASE_URL
     BASE_URL="$(grep '^BASE_URL=' "$DIR/.env" 2>/dev/null | cut -d= -f2-)"