Add company welcome and verified NetKingdom sign-in

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

vergabe_teilnahme/apps/accounts/middleware.py

@@ -1,3 +1,7 @@
+import time
+
+from django.conf import settings
+from django.contrib.auth import logout
 from django.contrib.auth.middleware import LoginRequiredMiddleware
 from django.contrib.auth.views import redirect_to_login
 from django.http import HttpResponse
@@ -8,15 +12,31 @@ from django.utils.cache import add_never_cache_headers
 class PilotLoginRequiredMiddleware(LoginRequiredMiddleware):
     """Use Django's default-deny gate, including full-page HTMX reauthentication."""
 
+    def process_request(self, request):
+        expiry = request.session.get("oidc_expires")
+        if expiry is not None and (
+            expiry <= time.time()
+            or request.user.is_staff
+            or request.user.is_superuser
+            or not settings.NETKINGDOM_ENABLED
+            or request.session.get("oidc_binding")
+            != [
+                settings.NETKINGDOM_ISSUER,
+                settings.NETKINGDOM_TENANT,
+                settings.NETKINGDOM_CLIENT_ID,
+            ]
+        ):
+            logout(request)
+
     def handle_no_permission(self, request, view_func):
-        if request.headers.get('HX-Request') == 'true':
+        if request.headers.get("HX-Request") == "true":
             # The original URL may render only a fragment or accept only POST.
-            login = redirect_to_login(reverse('home'), self.get_login_url(view_func))
-            return HttpResponse(status=401, headers={'HX-Redirect': login.url})
+            login = redirect_to_login(reverse("home"), self.get_login_url(view_func))
+            return HttpResponse(status=401, headers={"HX-Redirect": login.url})
         return super().handle_no_permission(request, view_func)
 
     def process_response(self, request, response):
         # Company records and account pages must not survive in shared caches.
-        if request.path_info != '/health/':
+        if request.path_info != "/health/":
             add_never_cache_headers(response)
         return response