fix(health): run context-less health checks as the system user #16

2026-10-14T23:25:07Z

KofTwentyTwo commented

2026-10-14 23:25:07 +00:00

(Migrated from github.com)

Problem

CrmHealthChecks.indicators() used a plain tokenless new QSession() when it was registered without a caller session (host startup). OAuth2 and Auth0 accept a tokenless QSystemUserSession and reject every other tokenless session, so on those hosts (kof22) each CRM check failed session validation and reported UNKNOWN.

Fix

With no caller session, each check runs as core QSystemUserSession(instance), created at check time (the instance is known then). This is the same pattern as qbit-backups#24 and qbit-object-storage#18. A monitoring session the host passes to indicators(QSession) is still used unchanged. The checks return only UP/DEGRADED, never record values.

Tests

TokenRequiredAuthenticationModule (test scope) behaves like OAuth2: it accepts the system user and sessions it issued, and throws The token is null for anything else.
CrmHealthBulkLoadTest.contextlessIndicatorsRunOnTokenRequiredHost registers the indicators with no session on a token-required host and expects UP. It fails without the fix (UNKNOWN).
./mvnw verify: 490 tests, 0 skipped; checkstyle and JaCoCo green.

🤖 Generated with Claude Code

## Problem `CrmHealthChecks.indicators()` used a plain tokenless `new QSession()` when it was registered without a caller session (host startup). OAuth2 and Auth0 accept a tokenless `QSystemUserSession` and reject every other tokenless session, so on those hosts (kof22) each CRM check failed session validation and reported UNKNOWN. ## Fix With no caller session, each check runs as core `QSystemUserSession(instance)`, created at check time (the instance is known then). This is the same pattern as qbit-backups#24 and qbit-object-storage#18. A monitoring session the host passes to `indicators(QSession)` is still used unchanged. The checks return only UP/DEGRADED, never record values. ## Tests - `TokenRequiredAuthenticationModule` (test scope) behaves like OAuth2: it accepts the system user and sessions it issued, and throws `The token is null` for anything else. - `CrmHealthBulkLoadTest.contextlessIndicatorsRunOnTokenRequiredHost` registers the indicators with no session on a token-required host and expects UP. It fails without the fix (UNKNOWN). - `./mvnw verify`: 490 tests, 0 skipped; checkstyle and JaCoCo green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-crm#16