Object storage metadata keys are case insensitive per the S3
specification, but implementations don't agree on the case they give
back. When head_object returns a capitalized "Status", updating the
attachment status added a second, lowercase entry instead of replacing
it, and the copy request ended up carrying two x-amz-meta-status
headers. Ceph RadosGW loses one of them behind a proxy, which
invalidates the request signature.
The same assumption was made when reading the status back in media-auth
and media-check, where an attachment stored on such a backend stayed in
"processing" forever.
Metadata read from the storage is now normalized to lowercase keys
before being consumed or copied over.
Signed-off-by: risk-alt <aldu6974@gmail.com>
The Keycloak container ignored KC_DB_HOST, KC_DB_NAME and KC_DB_USER:
the Quarkus distribution expects KC_DB_URL_HOST, KC_DB_URL_DATABASE and
KC_DB_USERNAME instead. Keycloak silently fell back to its default JDBC
URL on localhost:5432 and could not reach the database container.
The host value also pointed to "postgresql" while the service is named
kc_postgresql in the example compose file, so it is fixed as well.
These names already match the ones used in env.d/development/kc_auth.
Signed-off-by: risk-alt <aldu6974@gmail.com>
The migrate and createsuperuser jobs polled `manage.py check` with its
output sent to /dev/null, then printed "Database not ready" whatever
the reason. Any failure the check reports, a missing setting or a bad
credential for instance, looked like a database that had not started
yet, and the job looped forever without a single clue in its logs.
The check output is now captured and printed on each failed attempt,
along with the attempt number, so the reason the job is still waiting
is readable with kubectl logs. The retry behaviour is unchanged.
Applied to both jobs in the chart values and in the dev and feature
helmfile environments. The chart README table is regenerated
accordingly.
Signed-off-by: risk-alt <aldu6974@gmail.com>
Blocknote highlights the selected table cells with #c8c8ff66 and draws
the drop cursor of a moved block with #ddeeff: two different colors,
both out of the palette.
Use --c--contextuals--background--semantic--brand--tertiary for both, and
for the drop indicator of a moved table row or column which was #adf.
The cell overlay is blended with multiply because it is drawn on top of
the cell content while the token is opaque.
Signed-off-by: risk-alt <aldu6974@gmail.com>
Images embedded with a relative url such as /assets/logo.png were routed
through the CORS proxy: the same origin check used a substring match on
window.location.hostname, which a relative url never contains. The
backend rejects those urls with a 400 as it only validates absolute
http(s) urls.
Resolve the url against the current origin instead, so relative and
absolute same origin urls are fetched directly. This also stops matching
unrelated external urls that merely contain the hostname, and replaces
the "base64" substring check by an explicit data: scheme check.
exportResolveFileUrl now checks response.ok as well: fetch() only
rejects on network errors, so the 400 payload was returned as a blob and
embedded in the export instead of falling back to the url.
Signed-off-by: risk-alt <aldu6974@gmail.com>
