fix(auth): require preferred username claim

2026-07-30 14:21:21 +08:00
parent 31e2728db1
commit 437eb5a19a
5 changed files with 69 additions and 13 deletions
@@ -16,7 +16,7 @@ trust frontend-supplied user IDs.
 ## Login Snapshot Refresh

 Every authenticated metadata-user resolution validates the Keycloak access token
-and reads `sub`, `preferred_username` or `username`, and `email` claims. The
+and reads `sub`, `preferred_username`, and `email` claims. The
 backend finds `users` by `keycloak_id = sub`, rejects inactive or missing users,
 then refreshes `username`, `email`, and `last_login_at`.