lahirujayathilake opened a new pull request, #512: URL: https://github.com/apache/airavata-custos/pull/512
Closes #511 Today the resolver only accepts OIDC sign-ins for users that already have a matching `user_identities` row with an `oidc_sub`. That leaves two paths broken: the bootstrap super-admin (created from an env var, never has an OIDC binding) and every AMIE-provisioned user (the handler creates the user with `oidc_sub` NULL). Both require an admin to hand-insert a row before the user can sign in. - New `PENDING` user lifecycle state and `SYSTEM` user type. Provisioners (bootstrap, AMIE) write `PENDING`, the resolver flips to `ACTIVE` once the user signs in - Resolver gains a tightly gated email-fallback. When the JWT's `sub` has no binding, the resolver checks the JWT's `email`/`email_verified`, matches a single PENDING user by email, refuses if that user has any other OIDC binding already, then inserts the binding, sets the user ACTIVE, and emits an `IDENTITY_LINKED` audit event. - `BootstrapSuperAdmin` self-contained - if `CUSTOS_BOOTSTRAP_ADMIN_EMAIL` points at a missing user, the bootstrap path creates the `system` org + a PENDING SYSTEM user, grants `super_admin`, and emits `USER_BOOTSTRAPPED`. - AMIE handlers (`request_project_create`, `request_account_create`) provision users as PENDING. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
