mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Dave Page
35d68c47eb
Flask-Security-Too 5.8.2, released on 12 August 2026, fixed a long-standing inversion in its login forms: `LoginForm.validate()` previously read a `True` return from `UserMixin.is_locked()` as "not locked, carry on", and the base implementation unconditionally returned `True`. Our `User.is_locked()` was written against that inverted convention, so as soon as CI began resolving 5.8.2 through the loose `Flask-Security-Too==5.8.*` pin, an unlocked user returned `True`, form validation failed, the login POST redirected with a 302 and every subsequent request arrived as `AnonymousUser`. The server-mode data isolation tests caught it, though the breakage is not limited to tests: on 5.8.2 nobody could log in at all. `User.is_locked()` now returns `True` when the account is locked, matching the corrected upstream contract, and the dependency is floored at 5.8.2 so that we cannot silently resolve a release which reads the value backwards. The two conventions are mutually exclusive, hence a floor rather than a version check in the model. The regression tests are updated to assert the fixed contract.