fix(auth): require preferred username claim

app/auth/keycloak_dependencies.py

@@ -73,14 +73,18 @@ async def get_current_keycloak_sub(
         ) from exc
 
 
-async def get_current_keycloak_username(
-    payload: dict = Depends(get_current_keycloak_payload),
-) -> str:
-    username = payload.get("preferred_username") or payload.get("username")
+def get_keycloak_preferred_username(payload: dict) -> str:
+    username = payload.get("preferred_username")
     if not username:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Missing username claim",
+            detail="Missing preferred_username claim",
             headers={"WWW-Authenticate": "Bearer"},
         )
     return str(username)
+
+
+async def get_current_keycloak_username(
+    payload: dict = Depends(get_current_keycloak_payload),
+) -> str:
+    return get_keycloak_preferred_username(payload)

app/auth/metadata_dependencies.py

@@ -6,7 +6,10 @@ from fastapi import Depends, HTTPException, status
 from sqlalchemy.exc import SQLAlchemyError
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth.keycloak_dependencies import get_current_keycloak_payload
+from app.auth.keycloak_dependencies import (
+    get_current_keycloak_payload,
+    get_keycloak_preferred_username,
+)
 from app.infra.db.metadb.database import get_metadata_session
 from app.infra.db.metadb.repositories.metadata_repository import MetadataRepository
 
@@ -38,11 +41,6 @@ def _keycloak_sub_from_payload(payload: dict) -> UUID:
         ) from exc
 
 
-def _username_from_payload(payload: dict) -> str | None:
-    username = payload.get("preferred_username") or payload.get("username")
-    return str(username) if username else None
-
-
 def _email_from_payload(payload: dict) -> str | None:
     email = payload.get("email")
     return str(email) if email else None
@@ -53,6 +51,7 @@ async def get_current_metadata_user(
     metadata_repo: MetadataRepository = Depends(get_metadata_repository),
 ):
     keycloak_sub = _keycloak_sub_from_payload(keycloak_payload)
+    username = get_keycloak_preferred_username(keycloak_payload)
     try:
         user = await metadata_repo.get_user_by_keycloak_id(keycloak_sub)
     except SQLAlchemyError as exc:
@@ -71,7 +70,7 @@ async def get_current_metadata_user(
     try:
         user = await metadata_repo.refresh_user_keycloak_snapshot(
             user,
-            username=_username_from_payload(keycloak_payload),
+            username=username,
             email=_email_from_payload(keycloak_payload),
         )
     except SQLAlchemyError as exc: