Track and harden NK-WP-0025 residuals

identity-provisioner/tests/test_provisioner.py

@@ -3,7 +3,15 @@ import sys
 import unittest
 
 sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
-from provisioner import _username, dispatch, DriftResult, LLDAPProvisioner, Result
+from provisioner import (
+    _directory_username,
+    _oidc_subject,
+    _username,
+    dispatch,
+    DriftResult,
+    LLDAPProvisioner,
+    Result,
+)
 
 
 class Fake:
@@ -19,6 +27,17 @@ class ProvisionerTests(unittest.TestCase):
     def test_username_is_stable_and_sanitized(self):
         self.assertEqual("bernd.worsch", _username("Bernd.Worsch@binky-hedgehog.com"))
 
+    def test_oidc_subject_is_canonical_ldap_dn(self):
+        self.assertEqual(
+            "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local",
+            _oidc_subject("bernd.worsch"),
+        )
+
+    def test_directory_lifecycle_normalizes_canonical_ldap_dn(self):
+        subject = "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local"
+        self.assertEqual("bernd.worsch", _directory_username(subject))
+        self.assertEqual("bernd.worsch", _directory_username("bernd.worsch"))
+
     def test_preferred_username_is_honored_and_validated(self):
         self.assertEqual("chosen.name", _username("other@example.test", "Chosen.Name"))
         with self.assertRaisesRegex(ValueError, "invalid"):