From 388e7f38c9d76e07d4294bc6ca7cc90a497361e2 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Tue, 4 Aug 2026 00:13:50 +0000 Subject: [PATCH] upstream(lasuite-docs): record v5.4.0 Bearer-auth removal + redis sidecar note --- cc-ci-plan/upstream/lasuite-docs.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/cc-ci-plan/upstream/lasuite-docs.md b/cc-ci-plan/upstream/lasuite-docs.md index 299b809..9566399 100644 --- a/cc-ci-plan/upstream/lasuite-docs.md +++ b/cc-ci-plan/upstream/lasuite-docs.md @@ -21,3 +21,13 @@ - v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT. Both are backward-compatible (no action required for existing deployments). - Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version. +- **v5.4.0 removed Bearer/JWT auth on the API** (upstream PR suitenumerique/docs#2480 dropped + `mozilla_django_oidc.contrib.drf.OIDCAuthentication` from DRF DEFAULT_AUTHENTICATION_CLASSES). + The API now accepts only the app's session cookie from the real OIDC authorization-code flow. + Any test/assertion that sends `Authorization: Bearer ` to `/api/v1.0/*` will get 401 — this is + the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in + cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies + and assert Bearer is rejected. Don't revert to Bearer assertions. +- redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a + feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor + with many new features.