Merge branch 'main' into authenticated-header

Author: crocodilestick

Dockerfile

@@ -209,6 +209,7 @@ RUN \
   nano \
   sqlite3 \
   zip \
+  gettext \
   libasound2t64 \
   libxtst6 \
   libxrandr2 \

cps/admin.py

@@ -2062,6 +2062,7 @@ def _configuration_update_helper():
 
         # security configuration
         _config_checkbox(to_save, "config_disable_standard_login")
+        _config_checkbox(to_save, "config_enable_oauth_group_admin_management")
         _config_checkbox(to_save, "config_check_extensions")
         _config_checkbox(to_save, "config_password_policy")
         _config_checkbox(to_save, "config_password_number")

cps/config_sql.py

@@ -155,6 +155,7 @@ class _Settings(_Base):
     config_ldap_auto_create_users = Column(Boolean, default=True)
     config_oauth_redirect_host = Column(String, default='')
     config_disable_standard_login = Column(Boolean, default=False)
+    config_enable_oauth_group_admin_management = Column(Boolean, default=True)
 
     schedule_start_time = Column(Integer, default=4)
     schedule_duration = Column(Integer, default=10)

cps/cw_babel.py

@@ -30,6 +30,9 @@ def get_locale():
     preferred = list()
     if has_request_context() and request.accept_languages:
         for x in request.accept_languages.values():
+            # Skip wildcard '*' from Accept-Language headers (common in internal API requests)
+            if x == '*':
+                continue
             try:
                 preferred.append(str(Locale.parse(x.replace('-', '_'))))
             except (UnknownLocaleError, ValueError) as e:

cps/oauth_bb.py

@@ -322,12 +322,16 @@ def register_user_from_generic_oauth(token=None):
         # Apply default configuration settings for new OAuth users (Issue #660)
         # Match the same pattern as normal user creation in admin.py
 
-        # Set role: admin group overrides default role, otherwise use configured default
-        if should_be_admin:
+        # Set role: admin group overrides default role (only if group management enabled), otherwise use configured default
+        if should_be_admin and config.config_enable_oauth_group_admin_management:
             user.role = constants.ROLE_ADMIN
-            log.info("New OAuth user '%s' granted admin role via group '%s'", provider_username, admin_group)
+            log.info("New OAuth user '%s' granted admin role via group '%s' (groups: %s)", 
+                    provider_username, admin_group, user_groups)
         else:
             user.role = config.config_default_role
+            if should_be_admin and not config.config_enable_oauth_group_admin_management:
+                log.debug("New OAuth user '%s' not granted admin role - group-based management disabled", 
+                         provider_username)
 
         # Apply default user settings (same as normal user registration)
         user.sidebar_view = getattr(config, 'config_default_show', 1)
@@ -360,16 +364,23 @@ def register_user_from_generic_oauth(token=None):
     else:
         # Existing user: update admin role based on current group membership (Issue #715)
         # This ensures that users who are added to or removed from admin groups get proper access
+        # Only enforce if group-based admin management is enabled (global setting)
         current_is_admin = user.role_admin()
 
-        if should_be_admin and not current_is_admin:
-            # User was added to admin group - grant admin role
-            user.role |= constants.ROLE_ADMIN
-            log.info("OAuth user '%s' will be granted admin role via group '%s'", provider_username, admin_group)
-        elif not should_be_admin and current_is_admin:
-            # User was removed from admin group - revoke admin role (but keep other roles)
-            user.role &= ~constants.ROLE_ADMIN
-            log.info("OAuth user '%s' admin role will be revoked (not in group '%s')", provider_username, admin_group)
+        if config.config_enable_oauth_group_admin_management:
+            if should_be_admin and not current_is_admin:
+                # User was added to admin group - grant admin role
+                user.role |= constants.ROLE_ADMIN
+                log.info("OAuth user '%s' granted admin role via group '%s' (groups: %s)", 
+                        provider_username, admin_group, user_groups)
+            elif not should_be_admin and current_is_admin:
+                # User was removed from admin group - revoke admin role (but keep other roles)
+                user.role &= ~constants.ROLE_ADMIN
+                log.warning("OAuth user '%s' admin role revoked - not in required group '%s' (user groups: %s)", 
+                           provider_username, admin_group, user_groups)
+        else:
+            log.debug("OAuth group-based admin management disabled - preserving manual role assignments for '%s'", 
+                     provider_username)
         # Note: Changes are not committed yet - will be committed with OAuth entry below
 
     oauth = ub.session.query(ub.OAuth).filter_by(
@@ -394,8 +405,8 @@ def register_user_from_generic_oauth(token=None):
     # Commit all changes together: OAuth entry + Token + User + Role updates
     try:
         ub.session_commit()
-        # Log role changes after successful commit
-        if user.role_admin() and should_be_admin:
+        # Log role changes after successful commit (only if group management is enabled)
+        if user.role_admin() and should_be_admin and config.config_enable_oauth_group_admin_management:
             log.info("OAuth user '%s' has admin role via group '%s'", provider_username, admin_group)
     except Exception as ex:
         log.error("Failed to save OAuth session for user '%s': %s", provider_username, ex)

cps/templates/config_edit.html

@@ -489,6 +489,7 @@ <h5>{{_('Field Mapping Configuration')}}</h5>
           <div class="form-group">
             <label for="config_generic_oauth_admin_group">{{_('OAuth group for Admin')}}</label>
             <input type="text" class="form-control" id="config_generic_oauth_admin_group" name="config_generic_oauth_admin_group" value="{% if generic['oauth_admin_group'] != None %}{{ generic['oauth_admin_group'] }}{% endif %}" autocomplete="off">
+            <div class="help-block">{{_('Name of the OAuth group that grants admin privileges. Leave empty to disable group-based admin management, or use the global setting in Security Settings for more control.')}}</div>
           </div>
           <div class="form-group">
             <label for="config_generic_oauth_login_button">{{_('Login Button Text')}}</label>
@@ -552,6 +553,11 @@ <h4 class="settings-section-header">{{_('Security Settings')}}</h4>
                 <label for="config_disable_standard_login">{{_('Disable Standard Login (Username/Password)')}}</label>
                 <div class="help-block">{{_('Hides the standard login form. Users must log in via OAuth or LDAP. Ensure you have a working alternative login method before enabling.')}}</div>
             </div>
+            <div class="form-group">
+                <input type="checkbox" id="config_enable_oauth_group_admin_management" name="config_enable_oauth_group_admin_management" {% if config.config_enable_oauth_group_admin_management %}checked{% endif %}>
+                <label for="config_enable_oauth_group_admin_management">{{_('Enable OAuth Group-Based Admin Role Management')}}</label>
+                <div class="help-block">{{_('When enabled, admin privileges are automatically granted or revoked based on OAuth group membership. Disable this to manually manage admin roles in the user management panel, preventing OAuth logins from overriding local role assignments.')}}</div>
+            </div>
             <div class="form-group">
               <input type="checkbox" id="config_ratelimiter" name="config_ratelimiter" {% if config.config_ratelimiter %}checked{% endif %}>
               <label for="config_ratelimiter">{{_('Limit failed login attempts')}}</label>
@@ -639,6 +645,16 @@ <h4 class="settings-section-header">{{_('Security Settings')}}</h4>
 
   // Trigger change on load to set initial state
   $('#config_login_type').trigger('change');
+  
+  // Warn about potential lockout when disabling standard login without OAuth (Issue #715)
+  $('#config_disable_standard_login').on('change', function() {
+    var isDisabled = $(this).is(':checked');
+    var loginType = $('#config_login_type').val();
+    
+    if (isDisabled && loginType === '0') {
+      alert('Warning: You are about to disable standard login without enabling OAuth or LDAP authentication. This may lock you out of the system. Ensure you have configured and tested an alternative login method before saving.');
+    }
+  });
 
   $('#test_oidc_connection').on('click', function() {
     var serverUrl = $('#config_generic_oauth_server_url_test').val() || $('#config_generic_oauth_server_url').val();

cps/web.py

@@ -1952,6 +1952,9 @@ def render_login(username="", password=""):
     if url_for("web.logout") == next_url:
         next_url = url_for("web.index")
 
+    # Get OAuth check status
+    oauth_check = oauth_bb.oauth_check if feature_support['oauth'] else {}
+
     # Get generic OAuth login button text for display
     generic_login_button = None
     if feature_support['oauth']:

tests/docker/test_container_startup.py

@@ -90,21 +90,18 @@ def test_port_mapping(self, cwa_api_client):
 class TestDockerHealthChecks:
     """Test container health and readiness."""
 
-    def test_container_stays_running(self):
+    def test_container_stays_running(self, cwa_api_client):
         """Verify container doesn't crash immediately after startup."""
         # Wait 10 seconds and verify it's still running
         time.sleep(10)
 
         # Try to access the web interface - if container crashed, this will fail
-        # Default to 8085 to avoid conflicts with production CWA on 8083
-        test_port = os.getenv('CWA_TEST_PORT', '8085')
-        
+        # The cwa_api_client fixture ensures the container is ready before this test runs
         try:
-            response = requests.get(f"http://localhost:{test_port}", timeout=5)
+            response = cwa_api_client["session"].get(cwa_api_client["base_url"], timeout=5)
             assert response.status_code == 200
         except requests.exceptions.ConnectionError:
-            pytest.skip(f"No CWA container available on port {test_port}")
-        assert response.status_code == 200
+            pytest.fail("Container crashed after initial startup")
 
     def test_logs_directory_created(self, test_volumes):
         """Verify log directory structure is created."""

tests/integration/test_ingest_checksums.py

@@ -150,7 +150,7 @@ def test_multi_format_book_has_multiple_checksums(
         assert len(checksums) >= 1
 
     def test_checksum_persists_after_container_restart(
-        self, cwa_container, ingest_folder, library_folder, test_epub
+        self, container_name, ingest_folder, library_folder, test_epub
     ):
         """Test that checksums survive container restart."""
         from conftest import volume_copy, get_db_path
@@ -172,7 +172,6 @@ def test_checksum_persists_after_container_restart(
         # Restart container (if we have container control)
         # This might not work in all test environments
         try:
-            container_name = cwa_container.name if hasattr(cwa_container, 'name') else 'calibre-web-automated'
             subprocess.run(['docker', 'restart', container_name], check=True, timeout=30)
             time.sleep(20)  # Wait for restart
 
@@ -314,14 +313,12 @@ def test_checksums_generated_on_first_startup(
                 assert len(checksum) == 32
                 assert all(c in '0123456789abcdef' for c in checksum.lower())
 
-    def test_sentinel_file_prevents_regeneration(self, cwa_container):
+    def test_sentinel_file_prevents_regeneration(self, container_name):
         """Test that checksum generation only runs once per library."""
         import subprocess
 
         # Check if sentinel file exists
         try:
-            container_name = cwa_container.name if hasattr(cwa_container, 'name') else 'calibre-web-automated'
-
             result = subprocess.run(
                 ['docker', 'exec', container_name, 'test', '-f', '/config/.checksums_generated'],
                 capture_output=True