Repository navigation
fix(chart): DevLogin's admin list reached no container — it was never templated - #2362
Conversation
… templated DevLogin is a PAIR of settings and only one was rendered: Authentication__EnableDevLogin templated -> the login appears Authentication__DevAdminUsers ABSENT -> nobody is ever granted admin DevAuthController.IsConfiguredDevAdmin reads DevAdminUsers and calls UserOnboardingService.GrantPlatformAdmin for a match. With the key absent the list is always empty, so a developer signs in successfully and then administers nothing -- and there is no error anywhere, because the configmap names every key explicitly and the Deployment's only env path is envFrom on it. A key the template does not list is simply absent, while helm reports success. The symptom is the misleading part: it reads as "DevLogin does not work", which sends you to the auth code rather than to the chart. Confirmed on a live local install rather than argued from the template: an overlay setting BOTH keys rolled out clean, and the pod came up with EnableDevLogin=true and no DevAdminUsers at all. Third occurrence of this defect class, after Modules__Root (#1924) and Modules__Required__N (#2104). The general guard from #2104 covers keys a TRACKED values file sets; these two are set by a developer in their own out-of-band overlay, so nothing was watching them -- hence a test that names the pair. written before the fix 1 failed (DevAdminUsers), 1 passed (EnableDevLogin) after the fix 2 passed line removed again the DevAdminUsers case fails, naming the key Gates: chart invariants clean across all 3 values combinations; MeshWeaver.Documentation.Test 62/62. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes a Helm chart configuration gap where DevLogin’s administrator list (Authentication__DevAdminUsers) was not rendered into the portal ConfigMap, causing developer logins to succeed but never grant platform admin rights. It also adds a focused regression test and a “What’s New” entry documenting the user-visible impact.
Changes:
- Template
Authentication__DevAdminUsersintomemex-portal-configso the setting reliably reaches containers. - Add a test that asserts both DevLogin settings are explicitly bound in the ConfigMap template (to prevent silent regressions).
- Add a
Category: FixWhat’s New entry describing the defect and the remediation.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| test/MeshWeaver.Documentation.Test/DevLoginConfigBindingTest.cs | Adds a regression test asserting both DevLogin keys are explicitly rendered/bound in the chart template. |
| src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-26-dev-login-grants-its-admins.md | Documents the fix as a user-visible “Fix” entry for the What’s New feed. |
| deploy/helm/templates/memex-portal/config.yaml | Renders Authentication__DevAdminUsers into the portal ConfigMap alongside Authentication__EnableDevLogin. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Test Results (shard 3) 9 files 9 suites 5m 9s ⏱️ Results for commit 4db99f2. |
Test Results (shard 5) 9 files 9 suites 4m 44s ⏱️ Results for commit 4db99f2. |
Test Results (shard 0)593 tests 589 ✅ 17m 42s ⏱️ Results for commit 4db99f2. |
Test Results (shard 1)2 048 tests 1 855 ✅ 8m 26s ⏱️ Results for commit 4db99f2. |
Test Results (shard 2)2 831 tests 2 728 ✅ 9m 22s ⏱️ Results for commit 4db99f2. |
Test Results (shard 4)2 064 tests 2 061 ✅ 14m 7s ⏱️ Results for commit 4db99f2. |
Test Results 53 files 53 suites 59m 34s ⏱️ Results for commit 4db99f2. |
The defect
DevLogin is a pair of settings, and only one was rendered into the portal's configmap:
Authentication__EnableDevLoginAuthentication__DevAdminUsersDevAuthController.IsConfiguredDevAdminreadsDevAdminUsersand callsUserOnboardingService.GrantPlatformAdminon a match. With the key absent the list is always empty,so a developer signs in successfully and then administers nothing — with no error anywhere,
because the configmap names every key explicitly and the Deployment's only env path is
envFromonit. A key the template does not list is simply absent while helm reports success.
The symptom is the misleading part: it reads as "DevLogin does not work", which sends you to the
authentication code rather than to the chart.
Confirmed on a live install, not argued from the template
An overlay setting both keys was rolled out to a local Colima install. It applied cleanly, and
the pod came up with:
Third occurrence of this defect class
After
Modules__Root(#1924) andModules__Required__N(#2104). The general guard added with #2104covers any key a tracked values file sets — but these two are set by a developer in their own
out-of-band overlay, where nothing was watching. Hence a test that names the pair explicitly.
Test first
DevAdminUsers), 1 passed (EnableDevLogin)DevAdminUserscase fails, naming the keyThe assertion strips Helm and YAML comments before matching, so a key mentioned only in prose does
not satisfy it.
Gates
Ships with a
Category: FixWhat's New entry.