fix(auth): require preferred username claim

2026-07-30 14:21:21 +08:00
parent 31e2728db1
commit 437eb5a19a
5 changed files with 69 additions and 13 deletions
@@ -73,14 +73,18 @@ async def get_current_keycloak_sub(
        ) from exc


-async def get_current_keycloak_username(
-    payload: dict = Depends(get_current_keycloak_payload),
-) -> str:
-    username = payload.get("preferred_username") or payload.get("username")
+def get_keycloak_preferred_username(payload: dict) -> str:
+    username = payload.get("preferred_username")
    if not username:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Missing username claim",
+            detail="Missing preferred_username claim",
            headers={"WWW-Authenticate": "Bearer"},
        )
    return str(username)
+
+
+async def get_current_keycloak_username(
+    payload: dict = Depends(get_current_keycloak_payload),
+) -> str:
+    return get_keycloak_preferred_username(payload)