From 352f4cf52bd59ac5e3666e28763d42e50bce30ae Mon Sep 17 00:00:00 2001 From: holden093 Date: Tue, 30 Jun 2026 20:33:15 +0200 Subject: [PATCH] fix(oidc): enforce reserved-username check in _create_user_locked The reserved-username guard was only in create_user(), but setup() now calls _create_user_locked() directly (to avoid nested flock deadlock). Move the check into the shared helper so it applies regardless of which path creates the user. Fixes CI failure in test_setup_rejects_reserved_admin_username. --- core/auth.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/core/auth.py b/core/auth.py index 9cc431a03..c4373fcca 100644 --- a/core/auth.py +++ b/core/auth.py @@ -346,6 +346,9 @@ class AuthManager: def _create_user_locked(self, username: str, password: str, is_admin: bool) -> bool: """Internal helper — caller must hold _interprocess_auth_lock and _config_lock. Does not reload (caller did that).""" + if username in RESERVED_USERNAMES: + logger.warning("Refused to create reserved username '%s'", username) + return False if username in self._config.get("users", {}): return False if "users" not in self._config: