pas.plugins.kimug 1.4.2__tar.gz → 1.4.3__tar.gz

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/CHANGES.md

@@ -1,3 +1,10 @@
+## 1.4.3 (2026-03-24)
+
+
+- DEVOPS-339 : Fix ConflictError when multiple Zope instances start simultaneously and commit OIDC settings
+  [remdub]
+
+
 ## 1.4.2 (2025-12-10)
 
 - Set administrator role for users in group iA.Smartweb-admin with an imio address.

pas_plugins_kimug-1.4.3/CLAUDE.md

@@ -0,0 +1,89 @@
+# CLAUDE.md — pas.plugins.kimug
+
+Plone PAS plugin that assigns roles to iMio Keycloak users. Extends `pas.plugins.oidc`.
+
+## Build & Run
+
+```bash
+make build          # Install Plone (aliases: install, all)
+make config         # Create instance configuration
+make create-site    # Create a new Plone site
+make start          # Start Plone on localhost:8080
+```
+
+## Testing
+
+Tests require a Docker Keycloak instance (managed by pytest-docker via `tests/docker-compose.yml`).
+
+```bash
+make test                          # Run full test suite (tox -e test)
+tox -e test -- tests/plugin/       # Run a specific test directory
+tox -e test -- -k test_name        # Run a single test by name
+tox -e coverage                    # Tests with coverage report
+```
+
+Test credentials: user `kimug` / password `kimug` / email `kimug@imio.be`
+
+Keycloak test fixtures in `tests/conftest.py`:
+- `keycloak` — session fixture (issuer, client_id `plone`, client_secret `12345678910`)
+- `keycloak_api` — admin API fixture (realm `plone-test`, client `plone-admin`, secret `12345678`)
+- `portal` — integration portal with OIDC plugin configured
+
+## Linting & Formatting
+
+```bash
+make check       # Lint (runs tox -e lint → pre-commit)
+tox -e format    # Auto-format (pyupgrade, isort, black, zpretty)
+```
+
+Pre-commit tools: pyupgrade, isort, black, zpretty, flake8, codespell, check-manifest, pyroma, i18ndude.
+
+## Architecture
+
+### Plugin
+
+`KimugPlugin` (in `src/pas/plugins/kimug/plugin/__init__.py`) extends `OIDCPlugin` from `pas.plugins.oidc` and implements:
+- `IExtractionPlugin` — extracts Bearer token from Authorization header
+- `IAuthenticationPlugin` — decodes JWT (currently without signature verification)
+- `IRolesPlugin` — assigns `Member` to all; adds `Manager` if user is in `{application_id}-admin` group AND has `@imio.be` email
+- `IChallengePlugin` — redirects to Keycloak login
+
+### Key Modules
+
+| Path | Purpose |
+|------|---------|
+| `plugin/__init__.py` | KimugPlugin PAS plugin class |
+| `utils.py` | Keycloak API integration, JWKS, user migration, settings |
+| `browser/view.py` | Views: Login, Callback, Migration, KeycloakUsers, NewUser, PersonalInformation, ChangePassword |
+| `controlpanel/classic.py` | Control panel adapter and form |
+| `setuphandlers/__init__.py` | GenericSetup post_install handler |
+| `interfaces.py` | IBrowserLayer, IKimugPlugin, IKimugSettings |
+| `testing.py` | INTEGRATION_TESTING, FUNCTIONAL_TESTING, ACCEPTANCE_TESTING layers |
+| `subscribers/configure.zcml` | Calls `set_oidc_settings` on IDatabaseOpenedWithRoot |
+
+### Environment Variables
+
+Configuration is read from environment on Zope startup (`set_oidc_settings` subscriber):
+
+- `WEBSITE_HOSTNAME` — hostname for redirect_uri
+- `keycloak_url`, `keycloak_realm` (default: `plone`), `keycloak_issuer`
+- `keycloak_client_id` (default: `plone`), `keycloak_client_secret` (default: `12345678910`)
+- `keycloak_admin_user`, `keycloak_admin_password` — for Keycloak admin API
+- `keycloak_allowed_groups` — comma-separated or `[group1, group2]`
+- `keycloak_add_user_url`, `keycloak_personal_information_url`, `keycloak_change_password_url`
+- `application_id` (default: `iA.Smartweb`) — used for admin group matching
+
+### GenericSetup
+
+- Default profile at `profiles/default/` (version 1002)
+- Uninstall profile at `profiles/uninstall/`
+- Upgrades in `upgrades/profiles/`
+
+## Key Patterns
+
+- **Namespace packages**: `pas` and `pas.plugins` are namespace packages (`setup.py`)
+- **ZCML registration**: `five:registerPackage` with `initialize` function; browser pages, subscribers, controlpanel registered via ZCML includes
+- **z3c.autoinclude**: Plugin auto-discovered by Plone via entry point
+- **Testing layers**: `PloneSandboxLayer` + `PLONE_APP_CONTENTTYPES_FIXTURE`; pytest-plone fixtures; pytest-docker for Keycloak
+- **Dependencies**: `pas.plugins.oidc>=2.0.0b4`, `python-keycloak`, `plone.api`
+- Python ≥ 3.10, Plone 6.0/6.1, GPLv2

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pas.plugins.kimug
-Version: 1.4.2
+Version: 1.4.3
 Summary: A PAS plugin to set roles to imio keycloak users
 Home-page: https://github.com/imio/pas.plugins.kimug
 Author: iMio
@@ -124,6 +124,13 @@ The project is licensed under GPLv2.
 - iMio [devops@imio.be]
 
 
+## 1.4.3 (2026-03-24)
+
+
+- DEVOPS-339 : Fix ConflictError when multiple Zope instances start simultaneously and commit OIDC settings
+  [remdub]
+
+
 ## 1.4.2 (2025-12-10)
 
 - Set administrator role for users in group iA.Smartweb-admin with an imio address.

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/setup.py

@@ -14,7 +14,7 @@ long_description = f"""
 
 setup(
     name="pas.plugins.kimug",
-    version="1.4.2",
+    version="1.4.3",
     description="A PAS plugin to set roles to imio keycloak users",
     long_description=long_description,
     long_description_content_type="text/markdown",

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/src/pas/plugins/kimug/utils.py

@@ -3,6 +3,7 @@ from collections import defaultdict
 from plone import api
 from Products.PluggableAuthService.interfaces.plugins import IAuthenticationPlugin
 from urllib.parse import urlparse
+from ZODB.POSException import ConflictError
 from zope.annotation.interfaces import IAnnotations
 from zope.component.hooks import setSite
 
@@ -74,8 +75,15 @@ def set_oidc_settings(context):
 
         _set_allowed_groups(oidc)
 
-        transaction.commit()
-        logger.info("OIDC settings set with set_oidc_settings()")
+        try:
+            transaction.commit()
+            logger.info("OIDC settings set with set_oidc_settings()")
+        except ConflictError:
+            transaction.abort()
+            logger.warning(
+                "ConflictError committing OIDC settings: another instance already "
+                "committed the same values. Settings are correct; skipping."
+            )
     else:
         logger.warning("Could not find OIDC plugin, not setting OIDC settings")
 

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/src/pas.plugins.kimug.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pas.plugins.kimug
-Version: 1.4.2
+Version: 1.4.3
 Summary: A PAS plugin to set roles to imio keycloak users
 Home-page: https://github.com/imio/pas.plugins.kimug
 Author: iMio
@@ -124,6 +124,13 @@ The project is licensed under GPLv2.
 - iMio [devops@imio.be]
 
 
+## 1.4.3 (2026-03-24)
+
+
+- DEVOPS-339 : Fix ConflictError when multiple Zope instances start simultaneously and commit OIDC settings
+  [remdub]
+
+
 ## 1.4.2 (2025-12-10)
 
 - Set administrator role for users in group iA.Smartweb-admin with an imio address.

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/src/pas.plugins.kimug.egg-info/SOURCES.txt

@@ -1,5 +1,6 @@
 .editorconfig
 CHANGES.md
+CLAUDE.md
 CONTRIBUTORS.md
 LICENSE.GPL
 LICENSE.md

{pas_plugins_kimug-1.4.2 → pas_plugins_kimug-1.4.3}/tests/utils/test_utils.py

@@ -1,5 +1,7 @@
 from pas.plugins.kimug import utils
 from plone import api
+from unittest.mock import patch
+from ZODB.POSException import ConflictError
 from zope.annotation.interfaces import IAnnotations
 
 import os
@@ -122,3 +124,20 @@ class TestUtils:
         utils._set_allowed_groups(oidc)
 
         assert oidc.allowed_groups == ("group.1 is - the first!",)
+
+
+class TestSetOidcSettings:
+    def test_conflict_error_is_handled(self, portal):
+        """ConflictError on commit must be caught and transaction aborted — no exception raised."""
+        with patch("pas.plugins.kimug.utils.transaction") as mock_txn:
+            mock_txn.commit.side_effect = ConflictError()
+            utils.set_oidc_settings(None)
+            mock_txn.abort.assert_called_once()
+
+    def test_settings_are_applied(self, portal):
+        """set_oidc_settings should apply environment values to the OIDC plugin."""
+        with patch.dict(os.environ, {"keycloak_client_id": "my-client"}):
+            with patch("pas.plugins.kimug.utils.transaction"):
+                utils.set_oidc_settings(None)
+        oidc = utils.get_plugin()
+        assert oidc.client_id == "my-client"