From accfd7a5bb83551408b05c06e32ec23a08c41416 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 20 Aug 2026 18:49:43 +0000 Subject: [PATCH] authelia/mealie/actualbudget/gitea: no more silent no-op reruns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed live: re-running ActualBudget's Update path produced zero output for the Authelia SSO step — no prompt, no message, straight back to the shell. Root cause: the idempotency guards in _actualbudget_offer_authelia_oidc / _mealie_offer_authelia_oidc / _gitea_offer_actions_runner were plain `grep -q ... && return 0` — silent by construction. Indistinguishable from the step not running at all, which is exactly what it looked like. ActualBudget and Mealie's OIDC offers now explain what they found and ask whether to reconfigure (registers a fresh Authelia client + secret, clearing the old env vars first) instead of silently bailing. Gitea's Actions-runner offer explains what it found and how to check its status (reconfiguring that one means editing a docker-compose service block, not just a couple of env vars, so it just informs rather than offering to redo it). Also: _authelia_scope_access now shows existing Authelia usernames as a numbered list before asking who should have access — picking by number works alongside typing new names directly (mix freely, e.g. "1 3 newperson"), rather than requiring exact usernames typed from memory with no reference and no protection against a typo silently creating a duplicate account. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01YEQNc4NfBST1m9NtCZVYa8 --- services/actualbudget.sh | 15 ++++++++++++++- services/authelia.sh | 34 +++++++++++++++++++++++----------- services/gitea.sh | 6 +++++- services/mealie.sh | 13 ++++++++++++- 4 files changed, 54 insertions(+), 14 deletions(-) diff --git a/services/actualbudget.sh b/services/actualbudget.sh index 3cba7bf..373c599 100644 --- a/services/actualbudget.sh +++ b/services/actualbudget.sh @@ -219,7 +219,20 @@ _actualbudget_offer_authelia_oidc() { [ -d "$DOCKER_DIR/authelia" ] || return 0 declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0 - grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null && return 0 + + # Confirmed live: a silent skip here (just `return 0`, no output) looked + # indistinguishable from the whole SSO step not running at all — a rerun + # against an .env that already had these vars (even from an earlier + # attempt that didn't fully complete) produced zero output, no prompt, + # nothing. Always say something instead, and offer to redo it. + if grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null; then + echo "" + log_info "Authelia SSO is already configured for Actual Budget (ACTUAL_OPENID_* already set in $DIR/.env)." + local RECONFIGURE="" + prompt_yn " Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE + [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0 + sed -i '/^ACTUAL_OPENID_/d' "$DIR/.env" + fi echo "" local USE_SSO="" diff --git a/services/authelia.sh b/services/authelia.sh index 37e929a..fba4e13 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -1038,24 +1038,36 @@ _authelia_scope_access() { local -a existing_users mapfile -t existing_users < <(_authelia_list_usernames "$users_file") + local i if [ "${#existing_users[@]}" -gt 0 ]; then - echo " Existing Authelia users: ${existing_users[*]}" + echo " Existing Authelia users:" + for i in "${!existing_users[@]}"; do + echo " $((i + 1))) ${existing_users[$i]}" + done + echo " Pick by number (space-separated), and/or type new usernames directly" + echo " to create them — mix freely, e.g. \"1 3 newperson\"." else - echo " No existing Authelia users yet — anyone you list below gets created fresh." + echo " No existing Authelia users yet — type usernames below to create them fresh." fi - echo " Usernames who should have access (space-separated). Anyone listed" - echo " who doesn't already have an Authelia account gets one created —" - echo " you'll get their temporary password to hand over. Typos against an" - echo " existing name above create a new, separate account instead of" - echo " matching it, so copy from that list rather than retyping from memory." + echo " Anyone typed (not picked by number) who doesn't already have an" + echo " Authelia account gets one created — you'll get their temporary" + echo " password to hand over." local raw_users="" - prompt_text " Usernames:" "" raw_users - local -a usernames - read -ra usernames <<< "$raw_users" - if [ "${#usernames[@]}" -eq 0 ]; then + prompt_text " Usernames/numbers:" "" raw_users + local -a raw_tokens usernames + read -ra raw_tokens <<< "$raw_users" + if [ "${#raw_tokens[@]}" -eq 0 ]; then log_warning "No usernames entered — leaving $domain open to all Authelia users." return 0 fi + local t + for t in "${raw_tokens[@]}"; do + if [[ "$t" =~ ^[0-9]+$ ]] && [ "$t" -ge 1 ] && [ "$t" -le "${#existing_users[@]}" ]; then + usernames+=("${existing_users[$((t - 1))]}") + else + usernames+=("$t") + fi + done local u start_end start end for u in "${usernames[@]}"; do diff --git a/services/gitea.sh b/services/gitea.sh index 9b6890e..f9ce2a4 100644 --- a/services/gitea.sh +++ b/services/gitea.sh @@ -255,7 +255,11 @@ _gitea_offer_authelia_sso() { _gitea_offer_actions_runner() { local DIR="$1" - grep -q '^ act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null && return 0 + if grep -q '^ act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null; then + log_info "Gitea Actions runner is already set up (act_runner service already in docker-compose.yml) — skipping." + log_info "Check its status: docker compose -f $DIR/docker-compose.yml ps act_runner" + return 0 + fi echo "" local USE_ACTIONS="" diff --git a/services/mealie.sh b/services/mealie.sh index 1db4812..20de5c1 100644 --- a/services/mealie.sh +++ b/services/mealie.sh @@ -219,7 +219,18 @@ _mealie_offer_authelia_oidc() { [ -d "$DOCKER_DIR/authelia" ] || return 0 declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0 - grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null && return 0 + + # Same reasoning as the equivalent check in services/actualbudget.sh: a + # silent `return 0` here is indistinguishable from this step not + # running at all. Always say something, and offer to redo it. + if grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null; then + echo "" + log_info "Authelia SSO is already configured for Mealie (OIDC_* already set in $DIR/.env)." + local RECONFIGURE="" + prompt_yn " Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE + [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0 + sed -i '/^OIDC_/d' "$DIR/.env" + fi local BASE_URL BASE_URL="$(grep '^BASE_URL=' "$DIR/.env" 2>/dev/null | cut -d= -f2-)"