Skip to main content

upsert_oidc_user

teamcraft::services::users

Function upsert_oidc_user 

Source 
pub async fn upsert_oidc_user(
    pool: &PgPool,
    ident: OidcIdentity,
) -> AppResult<User>
Expand description

Finds or provisions the user for an OIDC identity and synchronises name, e-mail and role (derived from groups) on every login.

§Invariants

  • Permission: a deactivated user is refused (403).
  • Locks: the existing user row (FOR UPDATE).
  • Data: the role always follows the IdP groups; a new user gets a free username (suffix -2 to -99, else 409). Memberships from the IdP are added and dropped to match the groups; manual ones are kept. The claims that a need-to-know group’s conditions name replace the stored ones (users.idp_claims); other claims are not kept.
  • Audit: user.provision for a new user, user.role_sync when the role changed.
  • Notifications / webhooks: none.
  • Atomic: one transaction.