Todos

  • Implement working logout for all applications

  • Implement general logout button

Req 019 rollout: deploy gate

  • During the autonomous req 019 rollout, make compose-deploy mode=reinstall apps=web-app-keycloak full_cycle=true failed with two unrelated assertions:

    • kcadm.sh config credentials failed during the keycloak admin login phase (likely transient or env-scoped).

    • run_once_web_app_mailu is defined assertion failed in sys-svc-mail, indicating the service-loader did not preload Mailu in the keycloak-only deploy path.

  • These are deployment-orchestration failures, not playwright-parity failures, and were therefore deferred per the autonomy escape clause (archived req 019).

  • The role’s playwright lint contracts (Tests A + B + env_keys_used) are green; role-closure remains pending the orchestration fix.

Trusted-header SSO bridge migration

Roles still to migrate to the trusted-header SSO bridge (pattern: web-app-baserow / web-app-bookwyrm):

  • web-app-kix — native OTRS header-auth module

  • web-app-friendica — addon/hook: header → session

  • web-app-akaunting — Laravel controller shim (stage shim into the named volume on every deploy)

  • web-app-magento — custom Infinito_HeaderSso module (bypass FPC/Varnish on the handoff route)

  • web-app-funkwhale — django header / remote-user auth backend

  • Excluded: web-app-flowise (session-minting code is commercial-licensed), web-app-jitsi (no HTTP session — use native AUTH_TYPE=jwt), web-app-suitecrm (upstream SAML — use native AUTH_TYPE=saml)