From e2d07b275ad19d7767a9c48e4c76e73d8fd1062f Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 14 Oct 2026 15:14:13 -0500 Subject: [PATCH] fix(health): run the context-less health check as the system user BackupsHealthIndicator made its own context with a plain tokenless QSession. Token-based authentication modules (OAuth2, Auth0) reject any tokenless session other than QSystemUserSession, so the plan query failed session validation and the check errored on such hosts (kof22). Use core QSystemUserSession(instance). Co-Authored-By: Claude Opus 5.5 --- .../backups/health/BackupsHealthIndicator.java | 15 ++++++++++++++- .../health/BackupsHealthIndicatorTest.java | 13 +++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicator.java b/src/main/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicator.java index 26511f1..c867f2a 100644 --- a/src/main/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicator.java +++ b/src/main/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicator.java @@ -32,6 +32,7 @@ import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; import com.kingsrook.qqq.backend.core.model.data.QRecord; import com.kingsrook.qqq.backend.core.model.metadata.QInstance; import com.kingsrook.qqq.backend.core.model.session.QSession; +import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession; import com.kingsrook.qqq.middleware.health.HealthIndicator; import com.kingsrook.qqq.middleware.health.model.metadata.HealthCheckResult; import com.kingsrook.qqq.middleware.health.model.metadata.HealthStatus; @@ -79,7 +80,7 @@ public class BackupsHealthIndicator implements HealthIndicator boolean ownsContext = QContext.getQInstance() == null; if(ownsContext) { - QContext.init(qInstance, new QSession()); + QContext.init(qInstance, systemSession(qInstance)); } try { @@ -117,4 +118,16 @@ public class BackupsHealthIndicator implements HealthIndicator } } } + + + + /******************************************************************************* + ** The session for a health request that has no QQQ context. It must be the + ** core system user: token-based authentication modules (OAuth2, Auth0) + ** reject any other tokenless session, which failed the check on such hosts. + *******************************************************************************/ + static QSession systemSession(QInstance qInstance) + { + return (new QSystemUserSession(qInstance)); + } } diff --git a/src/test/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicatorTest.java b/src/test/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicatorTest.java index 9ba10c6..b12fb16 100644 --- a/src/test/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicatorTest.java +++ b/src/test/java/com/kingsrook/qbits/backups/health/BackupsHealthIndicatorTest.java @@ -116,4 +116,17 @@ class BackupsHealthIndicatorTest QContext.init(qInstance, new com.kingsrook.qqq.backend.core.model.session.QSession()); } } + + + + /******************************************************************************* + ** The indicator's own context runs as the core system user, which token-based + ** authentication modules accept without a token. + *******************************************************************************/ + @Test + void testOwnContextUsesSystemUserSession() + { + assertThat(BackupsHealthIndicator.systemSession(QContext.getQInstance())) + .isInstanceOf(com.kingsrook.qqq.backend.core.model.session.QSystemUserSession.class); + } } -- 2.54.0