add insecure to search reindex (#3505)

services/search/MIGRATION.md

@@ -13,7 +13,7 @@ Fill the new index by indexing all spaces again:
 
 ```shell
 # the service keeps running while it happens
-opencloud search index --all-spaces
+opencloud search index --all-spaces --insecure
 ```
 
 Once the new index is filled, every index but the one with the highest
@@ -31,7 +31,7 @@ The new index is a directory next to the old `bleve` one, both in
 bleve index cannot be copied, index all spaces again:
 
 ```shell
-opencloud search index --all-spaces
+opencloud search index --all-spaces --insecure
 ```
 
 Once the new index is filled, every directory but the one with the highest

services/search/README.md

@@ -124,14 +124,14 @@ opencloud search index --space $SPACE_ID
 It can also be used to re-index all spaces:
 
 ```shell
-opencloud search index --all-spaces
+opencloud search index --all-spaces --insecure
 ```
 
 Please note that a reindex only picks up new or changed files. Files that have already been indexed are not scanned again, even if the configuration or the whole extractor has been changed. To force a full rescan (re-running the extractor on every file) you need to use the `force-rescan` flag:
 
 
 ```shell
-opencloud search index --all-spaces --force-rescan
+opencloud search index --all-spaces --force-rescan --insecure
 ```
 
 ## Metrics

services/search/pkg/mapping/reconcile.go

@@ -27,7 +27,7 @@ func Reconcile(index string, r SchemaReconciler, logger log.Logger) (Classificat
 	case VerdictAdditive:
 		persisted, err := r.ApplyAdditive()
 		if persisted {
-			logger.Warn().Strs("fields", classification.NewFields).Str("index", index).Msg("extended the search index mapping with new fields; documents indexed before the upgrade do not contain them and queries on these fields will miss those documents until they are re-indexed; to re-index everything run: opencloud search index --all-spaces --force-rescan")
+			logger.Warn().Strs("fields", classification.NewFields).Str("index", index).Msg("extended the search index mapping with new fields; documents indexed before the upgrade do not contain them and queries on these fields will miss those documents until they are re-indexed; to re-index everything run: opencloud search index --all-spaces --force-rescan --insecure")
 		}
 		if err != nil {
 			return classification, err
@@ -40,5 +40,5 @@ func Reconcile(index string, r SchemaReconciler, logger log.Logger) (Classificat
 // LogNewIndexCreated logs that a fresh, empty index was created and how to
 // backfill it. The create path does not run through Reconcile.
 func LogNewIndexCreated(logger log.Logger, index string) {
-	logger.Info().Str("index", index).Msg("created a new empty search index; if this OpenCloud instance already held files, they are not in it yet, index them by running: opencloud search index --all-spaces --force-rescan")
+	logger.Info().Str("index", index).Msg("created a new empty search index; if this OpenCloud instance already held files, they are not in it yet, index them by running: opencloud search index --all-spaces --force-rescan --insecure")
 }

tests/acceptance/TestHelpers/TokenHelper.php

@@ -32,37 +32,10 @@ class TokenHelper {
 	private const LOGON_URL = '/signin/v1/identifier/_/logon';
 	private const REDIRECT_URL = '/oidc-callback.html';
 	private const TOKEN_URL = '/konnect/v1/token';
-	private const TRANSPORT_RETRY_LIMIT = 3;
 
 	// Static cache [username => token_data]
 	private static array $tokenCache = [];
 
-	/**
-	 * Run a token exchange and retry it if it fails with a transport error. The
-	 * limit counts retries, the exchange runs at most one time more than that.
-	 *
-	 * @param callable $exchange returns the token data array
-	 *
-	 * @return array
-	 * @throws GuzzleException the last error if every attempt fails
-	 */
-	private static function retryOnTransportError(callable $exchange): array {
-		$attempt = 0;
-		while (true) {
-			try {
-				return $exchange();
-			} catch (GuzzleException $e) {
-				if ($attempt >= self::TRANSPORT_RETRY_LIMIT) {
-					throw $e;
-				}
-				$attempt++;
-				echo "[INFO] token exchange failed with '" . $e->getMessage() .
-					"', retrying ($attempt)...\n";
-				\sleep(1);
-			}
-		}
-	}
-
 	/**
 	 * @return bool
 	 */
@@ -107,35 +80,24 @@ class TokenHelper {
 				return $cachedToken;
 			}
 
-			try {
-				$refreshedToken = self::retryOnTransportError(
-					fn () => self::refreshToken($cachedToken['refresh_token'], $baseUrl)
-				);
-				$tokenData = [
-					'access_token' => $refreshedToken['access_token'],
-					'refresh_token' => $refreshedToken['refresh_token'],
-					// set expiry to 240 (4 minutes) seconds to allow for some buffer
-					// token actually expires in 300 seconds (5 minutes)
-					'expires_at' => time() + 240
-				];
-				self::$tokenCache[$cacheKey] = $tokenData;
-				return $tokenData;
-			} catch (\Exception $e) {
-				echo "[INFO] token refresh failed with '" . $e->getMessage() .
-					"', falling back to a full login...\n";
-				unset(self::$tokenCache[$cacheKey]);
-			}
+			$refreshedToken = self::refreshToken($cachedToken['refresh_token'], $baseUrl);
+			$tokenData = [
+				'access_token' => $refreshedToken['access_token'],
+				'refresh_token' => $refreshedToken['refresh_token'],
+				// set expiry to 240 (4 minutes) seconds to allow for some buffer
+				// token actually expires in 300 seconds (5 minutes)
+				'expires_at' => time() + 240
+			];
+			self::$tokenCache[$cacheKey] = $tokenData;
+			return $tokenData;
 		}
 
 		// Get new tokens
-		$tokens = self::retryOnTransportError(
-			function () use ($username, $password, $baseUrl) {
-				$cookieJar = new CookieJar();
-				$continueUrl = self::getAuthorizedEndPoint($username, $password, $baseUrl, $cookieJar);
-				$code = self::getCode($continueUrl, $baseUrl, $cookieJar);
-				return self::getToken($code, $baseUrl, $cookieJar);
-			}
-		);
+		$cookieJar = new CookieJar();
+
+		$continueUrl = self::getAuthorizedEndPoint($username, $password, $baseUrl, $cookieJar);
+		$code = self::getCode($continueUrl, $baseUrl, $cookieJar);
+		$tokens = self::getToken($code, $baseUrl, $cookieJar);
 
 		$tokenData = [
 			'access_token' => $tokens['access_token'],