TODO

• files/python/apply/oidc_settings.py:87-91 stores the Keycloak group to ERPNext role map of vars/main.yml (ERPNEXT_OIDC_GROUP_ROLE_MAP) as the site default erpnext_oidc_group_role_map on every deploy with sso enabled, and nothing reads that key: no file of this role and no file of the Frappe 16.36 source tree references it (read, not measured with a Keycloak sign-in, because sso was disabled on the design stack). The roles the map names (System Manager, Sales User, Purchase User, Stock User, Accounts User, Customer) are therefore not assigned through it, and whether an account that Keycloak creates reaches the desk at all is unproven: files/playwright/test-login-administrator.js:13 only checks that the page text contains one of desk, workspace, erpnext, home or dashboard. Options: assign the roles from the group claim in code that runs at the OAuth sign-in (a server script or a small app with a hook), or sync them from an Ansible task, or delete the map together with its variable.

• tasks/02_bench_bootstrap.yml:21-22 and tasks/02_bench_bootstrap/create_site.yml:16-17 expand $ADMIN_PASSWORD and $DB_ROOT_PASSWORD into the argument list of bench inside the backend container (set-admin-password "$ADMIN_PASSWORD", --admin-password=, --db-root-password=), so both values are part of a process argument list while the command runs (read in the task files, not measured). Cause: the commands receive the secrets as arguments. Options: set the Administrator password through the bench Python interpreter with the value in the environment, the way files/python/apply/api_bot.py receives the API bot password, and hand the database root credentials to bench new-site through a file or the environment.

• No schema migration runs after an image bump (measured on frappe/erpnext:v16.50.0): the backend starts /usr/local/bin/entrypoint.sh, which only links the baked assets into sites/assets and executes gunicorn, the image command start.sh only starts gunicorn, the configurator only runs bench set-config, and no task of this role calls bench migrate. A site created under v16.37.0 therefore keeps its old schema after the v16.50.0 bump on main, and Frappe 16.50 renders “This site needs a migration” on the desk of such a site (www/desk.py); a fresh site is not affected (measured: desk boots, Frappe 16.51.0, ERPNext 16.50.0). Option: an idempotent bench --site <site> migrate task in tasks/02_bench_bootstrap.yml before the design task, with changed_when on its output.

• Every desk list page logs one Executing inline event handler violates the following Content Security Policy directive 'script-src-attr 'self'' per page menu entry (measured: 17 a.grey-link[onclick] on /desk/build/todo, 16 on /desk/users/user, 49 console errors after two list pages). Cause: Frappe renders the page menu entries with onClick="return false;" (frappe/public/js/frappe/ui/page.js:564,577 at v16.50.0) and meta/csp.yml allows no inline handler, so a click on such an entry also follows its href="#". Options: allow that one handler through 'unsafe-hashes' plus its hash in script-src-attr, or accept the blocked handler since the menu actions run through jQuery handlers.

• On the signed-in desk Chromium reports Creating a worker from 'blob:https://<domain>/...' violates the following Content Security Policy directive: "worker-src 'self'" (measured three times while opening 20 desk routes, the route that starts the worker was not isolated). Cause: meta/csp.yml whitelists no blob: source for worker-src. Options: find the feature that starts the worker and whitelist blob: for worker-src, or keep it blocked when that feature is not needed.

• “Realign the Administrator password with the declared one” reports changed on every deploy (measured 2026-10-11 in two consecutive closing role syncs), so the role never shows idempotent. Option: check the stored password first and run set-admin-password only on a mismatch, with changed_when on that branch.