coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

Browse source 
HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.
This commit is contained in:
tegwick 2026-08-09 01:56:44 +02:00
parent a6a380b19f
commit d88767f05b
13 changed files with 325 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

23
coulomb_social/apps/identity/services.py
View file

@ -14,20 +14,27 @@ from .user_engine import IdentityClaims, get_user_engine_client
def establish_session(request: HttpRequest, claims: IdentityClaims) -> Member:
"""Link platform identity → Member, log Django user in. No passwords."""
tenant_id = settings.DEFAULT_TENANT_ID
tenant_id = claims.tenant or settings.DEFAULT_TENANT_ID
application_id = settings.USER_ENGINE_APPLICATION_ID
link = get_user_engine_client().link_or_create(
claims, tenant_id=tenant_id, application_id=application_id
)
member = Member.objects.filter(issuer=claims.issuer, subject=claims.subject).first()
display = claims.name or claims.preferred_username or claims.email or claims.subject
display = (
link.display_name
or claims.name
or claims.preferred_username
or claims.email
or claims.subject
)
email = link.email or claims.email or ""
username = f"{claims.subject}@{_issuer_slug(claims.issuer)}"[:255]
if member is None:
user = User.objects.create_user(
username=username,
email=claims.email or "",
email=email,
full_name=display,
)
member = Member.objects.create(
@ -37,21 +44,25 @@ def establish_session(request: HttpRequest, claims: IdentityClaims) -> Member:
issuer=claims.issuer,
subject=claims.subject,
display_name=display,
email=claims.email or "",
email=email,
)
else:
user = member.user
user.email = claims.email or user.email
user.email = email or user.email
user.full_name = display or user.full_name
user.save(update_fields=["email", "full_name"])
member.display_name = display
member.email = claims.email or member.email
member.email = email or member.email
member.user_engine_user_id = link.user_id
member.tenant_id = tenant_id
member.last_login_at = timezone.now()
member.save()
# Stash provenance for debugging shell (no secrets)
request.session["user_engine_source"] = link.source
request.session["user_engine_user_id"] = link.user_id
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
return member