Merge main

modules/gitea/provisioner/index.ts

@@ -44,11 +44,21 @@ runProvisioner("npm-package-registry", {
     const teamId = await gitea.ensureTeam(ORG, PACKAGE_TEAM, true);
     // The user carries the consumer's login and the mesh's minted password, set every run so a
     // rotation takes. Membership of the package team is what grants read+write on packages.
-    await gitea.ensureUser(p.as, p.password, `${p.as}@localhost`);
+    //
+    // The address is gitea's own convention for one that is not real: its email validation
+    // requires a dotted domain, so `@localhost` was refused at create — the fault that had this
+    // grant retrying for a day — while `@noreply.localhost` is the shape gitea itself gives
+    // hidden addresses.
+    await gitea.ensureUser(p.as, p.password, `${p.as}@noreply.localhost`);
     await gitea.addUserToTeam(teamId, p.as);
   },
 
   async remove(p: { as: string }): Promise<void> {
     await gitea.deleteUser(p.as);
   },
+  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
+  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
+  async holds(p: Provision): Promise<boolean> {
+    return gitea.holdsTeamMember(ORG, PACKAGE_TEAM, p.as, p.password);
+  },
 });