erabo/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-08-11 13:55:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(oidc): enforce reserved-username check in _create_user_locked

Browse source 
The reserved-username guard was only in create_user(), but setup()
now calls _create_user_locked() directly (to avoid nested flock
deadlock).  Move the check into the shared helper so it applies
regardless of which path creates the user.

Fixes CI failure in test_setup_rejects_reserved_admin_username.
This commit is contained in:
holden093 2026-06-30 20:33:15 +02:00
parent 817281716d
commit 352f4cf52b
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
core/auth.py
View file

@ -346,6 +346,9 @@ class AuthManager:
def _create_user_locked(self, username: str, password: str, is_admin: bool) -> bool:
"""Internal helper — caller must hold _interprocess_auth_lock
and _config_lock. Does not reload (caller did that)."""
if username in RESERVED_USERNAMES:
logger.warning("Refused to create reserved username '%s'", username)
return False
if username in self._config.get("users", {}):
return False
if "users" not in self._config: