fix(workshop): harden deployment and deep links (#6542)

apps/workshop/Dockerfile

@@ -26,7 +26,7 @@ FROM ${POCKETBASE_IMAGE} AS pocketbase-runtime
 ENV PORT=8090
 RUN addgroup -S pocketbase && adduser -S -G pocketbase pocketbase
 COPY apps/workshop/entrypoint.sh /usr/local/bin/workshop-entrypoint
-RUN chmod +x /usr/local/bin/workshop-entrypoint && mkdir -p /pb_data /pb_public && chown pocketbase:pocketbase /pb_data
+RUN chmod 755 /usr/local/bin/workshop-entrypoint && mkdir -p /pb_data /pb_public && chown pocketbase:pocketbase /pb_data
 ENTRYPOINT ["workshop-entrypoint"]
 
 FROM pocketbase-runtime AS development

apps/workshop/README.md

@@ -90,6 +90,7 @@ GITHUB_CLIENT_SECRET=...
 OAuth settings synchronize on every PocketBase startup. Restart after rotation. A production deployment must never
 supply only one credential. `PB_ALLOWED_ORIGINS=*` is appropriate for the central community because arbitrary
 self-hosted Homarr origins must open its OAuth popup; a restricted list must include every allowed browser origin.
+Workshop uses the OAuth provider username as the public display name instead of the profile's full name.
 
 ## Promote a Workshop moderator
 

apps/workshop/pb_hooks/workshop-utils.js

@@ -25,7 +25,7 @@ const deriveGithubIdentity = (oauthUser, recordId) => {
   const githubUsername =
     GITHUB_USERNAME_PATTERN.test(candidateUsername) && !candidateUsername.includes("--") ? candidateUsername : "";
   const displayName =
-    normalizedIdentityText(oauthUser && oauthUser.name, rawUser.name, githubUsername, rawUser.login).slice(0, 100) ||
+    normalizedIdentityText(githubUsername, rawUser.login, oauthUser && oauthUser.name, rawUser.name).slice(0, 100) ||
     `GitHub user ${String(recordId || "").slice(0, 8)}`;
   const candidateAvatarUrl = normalizedIdentityText(
     oauthUser && oauthUser.avatarURL,

apps/workshop/pb_hooks/workshop.pb.js

@@ -11,6 +11,7 @@ onBootstrap((event) => {
   event.next();
   const users = event.app.findCollectionByNameOrId("users");
   users.oauth2.enabled = configured;
+  users.oauth2.mappedFields = { id: "", name: "", username: "displayName", avatarURL: "avatarUrl" };
   users.oauth2.providers = configured ? [{ name: "github", clientId, clientSecret }] : [];
   event.app.save(users);
   console.log(JSON.stringify({ event: "workshop_oauth_synchronized", enabled: configured }));

apps/workshop/tests/oauth-sync.integration.mjs

@@ -23,5 +23,12 @@ const github = users.oauth2?.providers?.find((provider) => provider.name === "gi
 if (!users.oauth2?.enabled || github?.clientId !== expectedClientId) {
   throw new Error(`GitHub OAuth was not synchronized for ${expectedClientId}`);
 }
+if (
+  users.oauth2?.mappedFields?.username !== "displayName" ||
+  users.oauth2?.mappedFields?.name ||
+  users.oauth2?.mappedFields?.avatarURL !== "avatarUrl"
+) {
+  throw new Error(`GitHub OAuth field mapping was not synchronized: ${JSON.stringify(users.oauth2?.mappedFields)}`);
+}
 
 console.log(`Workshop OAuth synchronization passed for ${expectedClientId}`);

apps/workshop/tests/workshop-identity.mjs

@@ -13,7 +13,7 @@ const identity = deriveGithubIdentity(
   "record123456",
 );
 if (
-  identity.displayName !== "Octo Cat" ||
+  identity.displayName !== "octocat" ||
   identity.githubUsername !== "octocat" ||
   identity.githubProfileUrl !== "https://github.com/octocat" ||
   identity.avatarUrl !== "https://avatars.githubusercontent.com/u/1?v=4"
@@ -35,7 +35,7 @@ const rawFallback = deriveGithubIdentity(
   "record123456",
 );
 if (
-  rawFallback.displayName !== "Raw User" ||
+  rawFallback.displayName !== "raw-user" ||
   rawFallback.githubUsername !== "raw-user" ||
   rawFallback.githubProfileUrl !== "https://github.com/raw-user"
 ) {