Validate config before writing .env in CLI server install#1663
Validate config before writing .env in CLI server install#1663
Conversation
Adds _validate_config() that checks for common misconfigurations before writing: Azure storage without credentials, SMTP with placeholder server, OIDC without discovery URL, and OAuth providers without client ID/secret. Shows warnings and prompts the user to confirm or abort.
Paragon SummaryThis pull request review identified 1 issue across 1 category in 1 file. The review analyzed code changes, potential bugs, security vulnerabilities, performance issues, and code quality concerns using automated analysis tools. This PR adds pre-write validation to the CLI server install flow so common configuration mistakes are caught before Key changes:
Confidence score: 3/5
1 file reviewed, 1 comment Severity breakdown: High: 1 Tip: |
![paragon-review[bot]](https://avatars.githubusercontent.com/in/1544258?s=60&v=4){kind=small}
| if not from_addr: | ||
| warnings.append("SMTP is enabled but no 'From' address is configured.") | ||
|
|
||
| # OIDC: discovery URL is required when enabled |
There was a problem hiding this comment.
Bug: OIDC checks only a client ID
OIDC checks only a client ID. Broken SSO configs can still be saved. Require the rest of the OIDC fields before continuing.
View Details
Location: cli/src/transformerlab_cli/commands/server.py (lines 317)
Analysis
OIDC checks only a client ID. Broken SSO configs can still be saved
| What fails | The validation gate misses incomplete OIDC setups unless a client ID is present, so invalid SSO configuration can be persisted. |
| Result | The config is accepted and written even though OIDC is incomplete. |
| Expected | OIDC should be rejected unless all required fields for an enabled provider are present. |
| Impact | Users can save a configuration that looks accepted but fails at login time, breaking SSO setup in production. |
How to reproduce
Run the CLI server install flow, enable OIDC, fill only OIDC_0_CLIENT_ID, and continue past the warning prompt.Patch Details
- if env_vars.get("OIDC_0_CLIENT_ID"):
- discovery = env_vars.get("OIDC_0_DISCOVERY_URL", "").strip()
- if not discovery:
- warnings.append("OIDC is enabled but the discovery URL is empty.")
+ if env_vars.get("OIDC_0_CLIENT_ID") or env_vars.get("OIDC_0_DISCOVERY_URL"):
+ discovery = env_vars.get("OIDC_0_DISCOVERY_URL", "").strip()
+ if not discovery:
+ warnings.append("OIDC is enabled but the discovery URL is empty.")AI Fix Prompt
Fix this issue: OIDC checks only a client ID. Broken SSO configs can still be saved. Require the rest of the OIDC fields before continuing.
Location: cli/src/transformerlab_cli/commands/server.py (lines 317)
Problem: The validation gate misses incomplete OIDC setups unless a client ID is present, so invalid SSO configuration can be persisted.
Current behavior: The config is accepted and written even though OIDC is incomplete.
Expected: OIDC should be rejected unless all required fields for an enabled provider are present.
Steps to reproduce: Run the CLI server install flow, enable OIDC, fill only OIDC_0_CLIENT_ID, and continue past the warning prompt.
Provide a code fix.
Tip: Reply with @paragon-run to automatically fix this issue
1 participant
Summary
_validate_config()that checks the collected env vars for common misconfigurations before writing to diskTest plan
cd cli && python -m pytest tests/ -v)tfl server install, select Azure storage, press Enter through empty defaults → expect warningsmtp.example.com→ expect warning