feat(auth): mirror Bunyip admin role onto lets-chat users.role (LC-413) #428

Merged

YousifShkara merged 1 commit from feat/LC-413-mirror-bunyip-admin-role into main

2026-06-21 05:28:44 +02:00

YousifShkara commented

2026-06-21 05:28:41 +02:00

Owner

Bunyip is now the source of truth for the top role. On every SSO callback, lets-chat reads the bunyip_role claim from the verified id_token and reconciles the local users.role: a Bunyip admin claim grants admin in lets-chat without a manual promotion, and a non-admin Bunyip claim demotes a stale local admin back to user so a former Bunyip admin does not retain lets-chat admin after a Bunyip-side downgrade. The intermediate moderator role is a lets-chat-internal grant and stays untouched in both directions; only admin/user mirror runs here. Reconcile runs AFTER the first-user-to-admin promotion so a brand-new deployment whose only user is a Bunyip subscriber still ends up with an admin. bunyip_role lands on IdTokenClaims as Option<String> (#[serde(default)]) so a pre-claim Bunyip id_token still verifies.

#LC-413

Bunyip is now the source of truth for the top role. On every SSO callback, lets-chat reads the `bunyip_role` claim from the verified id_token and reconciles the local `users.role`: a Bunyip `admin` claim grants `admin` in lets-chat without a manual promotion, and a non-admin Bunyip claim demotes a stale local `admin` back to `user` so a former Bunyip admin does not retain lets-chat admin after a Bunyip-side downgrade. The intermediate `moderator` role is a lets-chat-internal grant and stays untouched in both directions; only admin/user mirror runs here. Reconcile runs AFTER the first-user-to-admin promotion so a brand-new deployment whose only user is a Bunyip subscriber still ends up with an admin. `bunyip_role` lands on `IdTokenClaims` as `Option<String>` (#[serde(default)]) so a pre-claim Bunyip id_token still verifies. #LC-413

YousifShkara added 1 commit

2026-06-21 05:28:41 +02:00

feat(auth): mirror Bunyip admin role onto lets-chat users.role (LC-413)

check-secrets / Kingfisher (push) Successful in 4s

Details

check-secrets / Nosey parker (push) Successful in 5s

Details

check-secrets / TruffleHog (push) Successful in 7s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

check-secrets / Nosey parker (pull_request) Successful in 4s

Details

check-secrets / Kingfisher (pull_request) Successful in 6s

Details

check-secrets / TruffleHog (pull_request) Successful in 6s

Details

Check / clippy + fmt + tests (pull_request) Successful in 3m36s

Details

a1098665bd

Bunyip is now the source of truth for the top role. On every SSO callback, lets-chat reads the `bunyip_role` claim from the verified id_token and reconciles the local `users.role`: a Bunyip `admin` claim grants `admin` in lets-chat without a manual promotion, and a non-admin Bunyip claim demotes a stale local `admin` back to `user` so a former Bunyip admin does not retain lets-chat admin after a Bunyip-side downgrade. The intermediate `moderator` role is a lets-chat-internal grant and stays untouched in both directions; only admin/user mirror runs here. Reconcile runs AFTER the first-user-to-admin promotion so a brand-new deployment whose only user is a Bunyip subscriber still ends up with an admin. `bunyip_role` lands on `IdTokenClaims` as `Option<String>` (#[serde(default)]) so a pre-claim Bunyip id_token still verifies.

#LC-413