fix(docker): normalize container CPU usage

apps/docs/docs/advanced/single-sign-on/index.mdx

@@ -202,9 +202,9 @@ Homarr supports multiple authentication options, from internal userbase (credent
     | ``AUTH_OIDC_CLIENT_NAME``   | Display name of provider (in login screen)                 | OIDC          |
     | ``AUTH_OIDC_AUTO_LOGIN``    | Automatically redirect to OIDC login                       | false         |
     | ``AUTH_OIDC_SCOPE_OVERWRITE`` | Overwrite default scopes (openid, profile, email)        | openid email profile groups           |
-    | ``AUTH_OIDC_GROUPS_ATTRIBUTE`` | Attribute used for groups (roles) claim. Dot-separated paths such as `resource_access.homarr.roles` are supported. | groups        |
+    | ``AUTH_OIDC_GROUPS_ATTRIBUTE`` | Attribute used for groups (roles) claim                  | groups        |
     | ``AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT`` | Stop syncing group memberships of OIDC users from the groups claim and manage them locally via the group members page instead | false |
-    | ``AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE`` | Overwrite name attribute. Dot-separated paths are supported. By default it will use preferred_username if it does not contain a `@` and otherwise name. | ---          |
+    | ``AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE`` | Overwrite name attribute. By default it will use preferred_username if it does not contain a `@` and otherwise name. | ---          |
     | ``AUTH_OIDC_FORCE_USERINFO`` | Force userinfo endpoint to be used for user information.    | false         |
     | ``AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING`` | Enable account linking for OIDC provider. This will link the OIDC accounts by email. Be sure that you have verified emails to prevent stealing accounts. | false |
     | ``AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING`` | Link an OIDC identity to an existing credentials user with the same email. The credentials login and existing user data are preserved. Requires the OIDC profile to contain `email_verified: true`. | false |

packages/auth/events.ts

@@ -9,7 +9,7 @@ import { groupMembers, groups, users } from "@homarr/db/schema";
 import { colorSchemeCookieKey, everyoneGroup } from "@homarr/definitions";
 
 import { env } from "./env";
-import { extractProfileName, getProfileValueByPath } from "./providers/oidc/profile";
+import { extractProfileName } from "./providers/oidc/oidc-provider";
 
 const logger = createLogger({ module: "authEvents" });
 
@@ -31,11 +31,16 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
     if (!dbUser) throw new Error("User not found");
 
     const groupsKey = env.AUTH_OIDC_GROUPS_ATTRIBUTE;
-    const profileGroups = profile ? getProfileValueByPath(profile, groupsKey) : undefined;
     // Groups from oidc provider are provided from the profile, it's not typed.
-    if (!env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT && dbUser.provider === "oidc" && Array.isArray(profileGroups)) {
+    if (
-      logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(profileGroups)}`);
+      !env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT &&
-      await synchronizeGroupsWithExternalForUserAsync(db, user.id, profileGroups as string[]);
+      dbUser.provider === "oidc" &&
+      profile &&
+      groupsKey in profile &&
+      Array.isArray(profile[groupsKey])
+    ) {
+      logger.debug(`Using profile groups (${groupsKey}): ${JSON.stringify(profile[groupsKey])}`);
+      await synchronizeGroupsWithExternalForUserAsync(db, user.id, profile[groupsKey] as string[]);
     }
 
     // In ldap-authroization we return the groups from ldap, it's not typed.

packages/auth/providers/oidc/oidc-provider.ts

@@ -7,7 +7,6 @@ import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/h
 
 import { env } from "../../env";
 import { createRedirectUri } from "../../redirect";
-import { extractProfileName } from "./profile";
 import { assertVerifiedEmailForCredentialsLinking } from "./verified-email";
 
 export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profile> => ({
@@ -77,3 +76,12 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
   // @ts-expect-error `undici` has a `duplex` option
   [customFetch]: fetchWithTrustedCertificatesAsync,
 });
+
+export const extractProfileName = (profile: Profile) => {
+  if (!env.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE) {
+    // Use the name as the username if the preferred_username is an email address
+    return profile.preferred_username?.includes("@") ? profile.name : profile.preferred_username;
+  }
+
+  return profile[env.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE as keyof typeof profile] as string;
+};

packages/auth/providers/oidc/profile.ts

@@ -1,23 +0,0 @@
-import type { Profile } from "@auth/core/types";
-
-import { env } from "../../env";
-
-export const getProfileValueByPath = (profile: Profile, path: string): unknown => {
-  return path.split(".").reduce<unknown>((value, key) => {
-    if (typeof value !== "object" || value === null || !Object.hasOwn(value, key)) {
-      return undefined;
-    }
-
-    return (value as Record<string, unknown>)[key];
-  }, profile);
-};
-
-export const extractProfileName = (profile: Profile): string | undefined => {
-  if (!env.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE) {
-    // Use the name as the username if the preferred_username is an email address
-    return (profile.preferred_username?.includes("@") ? profile.name : profile.preferred_username) ?? undefined;
-  }
-
-  const profileName = getProfileValueByPath(profile, env.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE);
-  return typeof profileName === "string" ? profileName : undefined;
-};

packages/auth/providers/oidc/test/profile.spec.ts

@@ -1,96 +0,0 @@
-import type { Profile } from "@auth/core/types";
-import { afterEach, describe, expect, test, vi } from "vitest";
-
-const mockEnv = vi.hoisted(() => ({
-  AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE: undefined as string | undefined,
-}));
-
-vi.mock("../../../env", () => ({ env: mockEnv }));
-
-import { extractProfileName, getProfileValueByPath } from "../profile";
-
-afterEach(() => {
-  mockEnv.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE = undefined;
-});
-
-describe("getProfileValueByPath", () => {
-  const profile = {
-    sub: "user-id",
-    resource_access: {
-      homarr: {
-        roles: ["admins"],
-      },
-    },
-  } satisfies Profile;
-
-  test("returns a top-level claim", () => {
-    expect(getProfileValueByPath(profile, "sub")).toBe("user-id");
-  });
-
-  test("returns a nested claim", () => {
-    expect(getProfileValueByPath(profile, "resource_access.homarr.roles")).toEqual(["admins"]);
-  });
-
-  test("returns undefined when the path does not exist", () => {
-    expect(getProfileValueByPath(profile, "resource_access.missing.roles")).toBeUndefined();
-  });
-});
-
-describe("extractProfileName", () => {
-  test("uses preferred_username when overwrite is not set", () => {
-    const profile = {
-      sub: "user-id",
-      preferred_username: "johndoe",
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBe("johndoe");
-  });
-
-  test("uses name when preferred_username is an email", () => {
-    const profile = {
-      sub: "user-id",
-      preferred_username: "john@example.com",
-      name: "John Doe",
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBe("John Doe");
-  });
-
-  test("returns undefined when the fallback name is null", () => {
-    const profile = {
-      sub: "user-id",
-      preferred_username: "john@example.com",
-      name: null,
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBeUndefined();
-  });
-
-  test("returns undefined when preferred_username is missing", () => {
-    const profile = {
-      sub: "user-id",
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBeUndefined();
-  });
-
-  test("uses a nested name claim when configured", () => {
-    mockEnv.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE = "user.profile.display_name";
-    const profile = {
-      sub: "user-id",
-      user: { profile: { display_name: "Nested User" } },
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBe("Nested User");
-  });
-
-  test("returns undefined when the configured claim is not a string", () => {
-    mockEnv.AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE = "user.profile";
-    const profile = {
-      sub: "user-id",
-      user: { profile: { display_name: "Nested User" } },
-    } satisfies Profile;
-
-    expect(extractProfileName(profile)).toBeUndefined();
-  });
-});

packages/auth/test/events.spec.ts

@@ -1,7 +1,7 @@
 import type { ResponseCookie } from "next/dist/compiled/@edge-runtime/cookies";
 import type { ReadonlyRequestCookies } from "next/dist/server/web/spec-extension/adapters/request-cookies";
 import { cookies } from "next/headers";
-import { afterEach, describe, expect, test, vi } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 
 import { eq } from "@homarr/db";
 import type { Database } from "@homarr/db";
@@ -21,12 +21,6 @@ vi.mock("../env", () => {
     env: mockEnv,
   };
 });
-
-afterEach(() => {
-  mockEnv.AUTH_OIDC_GROUPS_ATTRIBUTE = "someRandomGroupsKey";
-  mockEnv.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT = false;
-});
-
 // eslint-disable-next-line @typescript-eslint/consistent-type-imports
 type HeadersExport = typeof import("next/headers");
 vi.mock("next/headers", async (importOriginal) => {
@@ -158,30 +152,6 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
       });
       expect(dbGroupMembers?.groupId).toBe("1");
     });
-    test("should add missing group membership from a nested claim", async () => {
-      // Arrange
-      mockEnv.AUTH_OIDC_GROUPS_ATTRIBUTE = "resource_access.homarr.roles";
-      const db = createDb();
-      await createUserAsync(db, "oidc");
-      await createGroupAsync(db);
-      const eventHandler = createSignInEventHandler(db);
-
-      // Act
-      await eventHandler?.({
-        user: { id: "1", name: "test" },
-        profile: {
-          preferred_username: "test",
-          resource_access: { homarr: { roles: ["test"] } },
-        },
-        account: null,
-      });
-
-      // Assert
-      const dbGroupMembers = await db.query.groupMembers.findFirst({
-        where: eq(groupMembers.userId, "1"),
-      });
-      expect(dbGroupMembers?.groupId).toBe("1");
-    });
     test("should remove group membership", async () => {
       // Arrange
       const db = createDb();

packages/request-handler/src/docker.ts

@@ -481,13 +481,14 @@ export function calculateCpuUsage(stats: ContainerStats): number {
     return 0;
   }
 
-  const numberOfCpus = stats.cpu_stats.online_cpus;
+  const cpuDelta = stats.cpu_stats.cpu_usage.total_usage - (stats.precpu_stats?.cpu_usage?.total_usage ?? 0);
-  const usage = stats.cpu_stats.system_cpu_usage;
+  const systemDelta = (stats.cpu_stats.system_cpu_usage ?? 0) - (stats.precpu_stats?.system_cpu_usage ?? 0);
-  if (!usage || usage === 0) {
+
+  if (systemDelta <= 0 || cpuDelta < 0) {
     return 0;
   }
 
-  return (stats.cpu_stats.cpu_usage.total_usage / usage) * numberOfCpus * 100;
+  return (cpuDelta / systemDelta) * 100;
 }
 
 export function calculateMemoryUsage(stats: ContainerStats): number {

packages/request-handler/src/test/docker.spec.ts

@@ -72,16 +72,16 @@ describe("calculateCpuUsage", () => {
     const stats = createStats({
       cpu_stats: { online_cpus: 4, cpu_usage: { total_usage: 2000 }, system_cpu_usage: 10000 },
     });
-    // (2000 / 10000) * 4 * 100 = 80
+    // (2000 / 10000) * 100 = 20
-    expect(calculateCpuUsage(stats)).toBe(80);
+    expect(calculateCpuUsage(stats)).toBe(20);
   });
 
   test("should handle fractional CPU usage", () => {
     const stats = createStats({
       cpu_stats: { online_cpus: 2, cpu_usage: { total_usage: 500 }, system_cpu_usage: 100000 },
     });
-    // (500 / 100000) * 2 * 100 = 1
+    // (500 / 100000) * 100 = 0.5
-    expect(calculateCpuUsage(stats)).toBe(1);
+    expect(calculateCpuUsage(stats)).toBe(0.5);
   });
 });