scripts/tests/test_mailu_sync.py

@@ -55,11 +55,11 @@ class _FakeResponse:
 
 
 class _FakeSession:
-    def __init__(self, put_resp, get_resps):
+    def __init__(self, put_resp, get_resp):
         self.put_resp = put_resp
-        self.get_resps = list(get_resps)
+        self.get_resp = get_resp
         self.put_called = False
-        self.get_calls = 0
+        self.get_called = False
 
     def post(self, *args, **kwargs):
         return _FakeResponse({"access_token": "dummy"})
@@ -69,26 +69,22 @@ class _FakeSession:
         return self.put_resp
 
     def get(self, *args, **kwargs):
-        self.get_calls += 1
-        if self.get_resps:
-            return self.get_resps.pop(0)
-        return _FakeResponse({})
+        self.get_called = True
+        return self.get_resp
 
 
 def test_kc_update_attributes_succeeds(monkeypatch):
     sync = load_sync_module(monkeypatch)
-    current_resp = _FakeResponse({"attributes": {}})
     ok_resp = _FakeResponse({"attributes": {"mailu_app_password": ["abc"]}})
-    sync.SESSION = _FakeSession(_FakeResponse({}), [current_resp, ok_resp])
+    sync.SESSION = _FakeSession(_FakeResponse({}), ok_resp)
     sync.kc_update_attributes("token", {"id": "u1", "username": "u1"}, {"mailu_app_password": "abc"})
-    assert sync.SESSION.put_called and sync.SESSION.get_calls == 2
+    assert sync.SESSION.put_called and sync.SESSION.get_called
 
 
 def test_kc_update_attributes_raises_without_attribute(monkeypatch):
     sync = load_sync_module(monkeypatch)
-    current_resp = _FakeResponse({"attributes": {}})
     missing_attr_resp = _FakeResponse({"attributes": {}}, status=200)
-    sync.SESSION = _FakeSession(_FakeResponse({}), [current_resp, missing_attr_resp])
+    sync.SESSION = _FakeSession(_FakeResponse({}), missing_attr_resp)
     with pytest.raises(Exception):
         sync.kc_update_attributes("token", {"id": "u1", "username": "u1"}, {"mailu_app_password": "abc"})
 
@@ -148,18 +144,8 @@ def test_main_generates_password_and_upserts(monkeypatch):
     sync = load_sync_module(monkeypatch)
     monkeypatch.setattr(sync.bcrypt_sha256, "hash", lambda password: f"hash:{password}")
     users = [
-        {
-            "id": "u1",
-            "username": "user1",
-            "email": "user1@example.com",
-            "attributes": {"mailu_enabled": ["true"]},
-        },
-        {
-            "id": "u2",
-            "username": "user2",
-            "email": "user2@example.com",
-            "attributes": {"mailu_app_password": ["keepme"], "mailu_enabled": ["true"]},
-        },
+        {"id": "u1", "username": "user1", "email": "user1@example.com", "attributes": {}},
+        {"id": "u2", "username": "user2", "email": "user2@example.com", "attributes": {"mailu_app_password": ["keepme"]}},
         {"id": "u3", "username": "user3", "email": "user3@other.com", "attributes": {}},
     ]
     updated = []
@@ -199,6 +185,6 @@ def test_main_generates_password_and_upserts(monkeypatch):
 
     sync.main()
 
-    # Only mail-enabled users are synced and backfilled.
-    assert len(updated) == 2
-    assert conns and len(conns[0]._cursor.executions) == 2
+    # Always backfill mailu_email, even if Keycloak recovery email is external.
+    assert len(updated) == 3
+    assert conns and len(conns[0]._cursor.executions) == 3

services/bstein-dev-home/backend-deployment.yaml

@@ -33,15 +33,6 @@ spec:
           export PORTAL_E2E_CLIENT_ID="{{ .Data.data.client_id }}"
           export PORTAL_E2E_CLIENT_SECRET="{{ .Data.data.client_secret }}"
           {{ end }}
-          {{ with secret "kv/data/atlas/shared/postmark-relay" }}
-          export SMTP_HOST="mail.bstein.dev"
-          export SMTP_PORT="587"
-          export SMTP_STARTTLS="true"
-          export SMTP_USE_TLS="false"
-          export SMTP_USERNAME="{{ index .Data.data "relay-username" }}"
-          export SMTP_PASSWORD="{{ index .Data.data "relay-password" }}"
-          export SMTP_FROM="no-reply-portal@bstein.dev"
-          {{ end }}
     spec:
       automountServiceAccountToken: true
       serviceAccountName: bstein-dev-home

services/finance/scripts/firefly_user_sync.php

@@ -6,7 +6,6 @@ declare(strict_types=1);
 use FireflyIII\Console\Commands\Correction\CreatesGroupMemberships;
 use FireflyIII\Models\Role;
 use FireflyIII\Repositories\User\UserRepositoryInterface;
-use FireflyIII\Support\Facades\FireflyConfig;
 use FireflyIII\User;
 use Illuminate\Contracts\Console\Kernel as ConsoleKernel;
 
@@ -71,12 +70,6 @@ $app = require $app_bootstrap;
 $kernel = $app->make(ConsoleKernel::class);
 $kernel->bootstrap();
 
-try {
-    FireflyConfig::set('single_user_mode', true);
-} catch (Throwable $exc) {
-    error_line('failed to enforce single_user_mode: '.$exc->getMessage());
-}
-
 $repository = $app->make(UserRepositoryInterface::class);
 
 $existing_user = User::where('email', $email)->first();

services/keycloak/realm-settings-job.yaml

@@ -220,14 +220,6 @@ spec:
                           "permissions": {"view": ["admin"], "edit": ["admin"]},
                           "validations": {"length": {"max": 255}},
                       },
-                      {
-                          "name": "mailu_enabled",
-                          "displayName": "Atlas Mailbox Enabled",
-                          "multivalued": False,
-                          "annotations": {"group": "user-metadata"},
-                          "permissions": {"view": ["admin"], "edit": ["admin"]},
-                          "validations": {"length": {"max": 16}},
-                      },
                       {
                           "name": "nextcloud_mail_primary_email",
                           "displayName": "Nextcloud Mail Primary Email",

services/mailu/scripts/mailu_sync.py

@@ -25,7 +25,6 @@ KC_CLIENT_SECRET = os.environ["KEYCLOAK_CLIENT_SECRET"]
 
 MAILU_DOMAIN = os.environ["MAILU_DOMAIN"]
 MAILU_DEFAULT_QUOTA = int(os.environ.get("MAILU_DEFAULT_QUOTA", "20000000000"))
-MAILU_ENABLED_ATTR = os.environ.get("MAILU_ENABLED_ATTR", "mailu_enabled")
 
 DB_CONFIG = {
     "host": os.environ["MAILU_DB_HOST"],
@@ -87,12 +86,7 @@ def kc_get_users(token):
     while True:
         resp = SESSION.get(
             f"{KC_BASE}/admin/realms/{KC_REALM}/users",
-            params={
-                "first": first,
-                "max": max_results,
-                "enabled": "true",
-                "briefRepresentation": "false",
-            },
+            params={"first": first, "max": max_results, "enabled": "true"},
             headers=headers,
             timeout=20,
         )
@@ -110,20 +104,17 @@ def kc_update_attributes(token, user, attributes):
         "Authorization": f"Bearer {token}",
         "Content-Type": "application/json",
     }
+    payload = {
+        "firstName": user.get("firstName"),
+        "lastName": user.get("lastName"),
+        "email": user.get("email"),
+        "enabled": user.get("enabled", True),
+        "username": user["username"],
+        "emailVerified": user.get("emailVerified", False),
+        "attributes": attributes,
+    }
     user_url = f"{KC_BASE}/admin/realms/{KC_REALM}/users/{user['id']}"
-    current = SESSION.get(
-        user_url,
-        headers={"Authorization": f"Bearer {token}"},
-        params={"briefRepresentation": "false"},
-        timeout=15,
-    )
-    current.raise_for_status()
-    current_payload = current.json()
-    current_attrs = current_payload.get("attributes") if isinstance(current_payload, dict) else None
-    if not isinstance(current_attrs, dict):
-        current_attrs = {}
-    current_attrs.update(attributes)
-    resp = SESSION.put(user_url, headers=headers, json={"attributes": current_attrs}, timeout=20)
+    resp = SESSION.put(user_url, headers=headers, json=payload, timeout=20)
     resp.raise_for_status()
     verify = SESSION.get(
         user_url,
@@ -150,13 +141,6 @@ def get_attribute_value(attributes, key):
     return None
 
 
-def mailu_enabled(attributes) -> bool:
-    raw = get_attribute_value(attributes, MAILU_ENABLED_ATTR)
-    if raw is None:
-        return False
-    return str(raw).strip().lower() in {"1", "true", "yes", "y", "on"}
-
-
 def resolve_mailu_email(user, attributes):
     explicit = get_attribute_value(attributes, "mailu_email")
     if explicit:
@@ -225,10 +209,6 @@ def main():
 
     for user in users:
         attrs = user.get("attributes", {}) or {}
-        if user.get("enabled") is False:
-            continue
-        if not mailu_enabled(attrs):
-            continue
         app_pw = get_attribute_value(attrs, "mailu_app_password")
         mailu_email = resolve_mailu_email(user, attrs)