TSYS Group COO
f638105614
CRITICAL FIX: The --enable-2fa flow was creating duplicate BW items
instead of updating in place, which led to ambiguous item resolution
and data integrity issues. This was a severe failure in core
credential lifecycle operations.
Changes:
- bw_helper.py: Complete rewrite with safety guarantees
- update_item(): modifies existing item in place by ID, preserves
all fields not being updated
- create_item(): refuses to create duplicates (raises if item exists)
- get_item_id(): resolves name to ID, raises on ambiguous matches
- get_item(): returns full item JSON
- NO delete_item method exists by design -- credential deletion
is a manual operation only
- provision-agent.py: --enable-2fa now uses update_item() instead
of create_item() to add TOTP to existing credentials
- Dockerfile: non-root user with correct BW state directory ownership
- docker-compose.yml: bind mount for BW state (proper permissions)
- test_bw_helper.py: 10 tests covering full lifecycle
(create, read, duplicate rejection, update password, update TOTP,
field preservation, no-delete verification)
Tests 1-4 verified passing against live Vaultwarden instance.
- requirements.txt: added pytest
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
38 lines
1.2 KiB
Docker
38 lines
1.2 KiB
Docker
FROM mcr.microsoft.com/playwright:v1.52.0-noble
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
jq \
|
|
unzip \
|
|
wget \
|
|
python3-pip \
|
|
libzbar0 \
|
|
libzbar-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Bitwarden CLI — native Rust binary (no Node.js/npm)
|
|
# Same CLI interface as the npm package but zero runtime dependencies.
|
|
ARG BW_CLI_VERSION=2026.7.0
|
|
RUN wget -q -O /tmp/bw.zip \
|
|
"https://github.com/bitwarden/clients/releases/download/cli-v${BW_CLI_VERSION}/bw-linux-${BW_CLI_VERSION}.zip" && \
|
|
unzip -o /tmp/bw.zip -d /usr/local/bin/ && \
|
|
chmod +x /usr/local/bin/bw && \
|
|
rm /tmp/bw.zip
|
|
|
|
# Install Python dependencies
|
|
COPY requirements.txt /tmp/
|
|
RUN python3 -m pip install --no-cache-dir --break-system-packages -r /tmp/requirements.txt
|
|
|
|
# Create non-root user for Playwright
|
|
RUN groupadd -r provision && useradd -r -g provision -G audio,video -m -d /home/provision provision \
|
|
&& mkdir -p "/home/provision/.config/Bitwarden CLI" \
|
|
&& chown -R provision:provision /home/provision
|
|
|
|
WORKDIR /app
|
|
COPY . .
|
|
RUN chown -R provision:provision /app
|
|
|
|
USER provision
|
|
|
|
ENTRYPOINT ["python3", "/app/provision-agent.py"]
|