Implement user-engine portal foundation

tests/test_verified_claims.py

@@ -0,0 +1,31 @@
+import unittest
+
+from user_engine.adapters import VerifiedIdentityClaimsAdapter
+from user_engine.errors import ValidationError
+
+
+class VerifiedIdentityClaimsAdapterTests(unittest.TestCase):
+    def setUp(self):
+        self.adapter = VerifiedIdentityClaimsAdapter(
+            expected_issuer="https://kc.example",
+            expected_audience="user-engine",
+        )
+        self.claims = {
+            "iss": "https://kc.example/",
+            "sub": "person-1",
+            "aud": ["user-engine"],
+            "tenant": "tenant:friendly:binky",
+            "principal_type": "human",
+            "roles": ["tenant-admin"],
+        }
+
+    def test_normalizes_verified_claims(self):
+        actor = self.adapter.normalize(self.claims)
+        self.assertEqual("person-1", actor.subject)
+        self.assertEqual(("tenant-admin",), actor.roles)
+
+    def test_rejects_wrong_issuer_and_audience(self):
+        with self.assertRaises(ValidationError):
+            self.adapter.normalize({**self.claims, "iss": "https://evil.example"})
+        with self.assertRaises(ValidationError):
+            self.adapter.normalize({**self.claims, "aud": ["other"]})