fix(auth): require preferred username claim

tests/auth/test_keycloak_dependencies.py

@@ -0,0 +1,30 @@
+import pytest
+from fastapi import HTTPException
+
+from app.auth.keycloak_dependencies import get_current_keycloak_username
+
+
+@pytest.fixture
+def anyio_backend():
+    return "asyncio"
+
+
+@pytest.mark.anyio
+async def test_current_username_uses_preferred_username_only():
+    username = await get_current_keycloak_username(
+        {
+            "preferred_username": "tjwater",
+            "username": "legacy-name",
+        }
+    )
+
+    assert username == "tjwater"
+
+
+@pytest.mark.anyio
+async def test_current_username_rejects_username_fallback():
+    with pytest.raises(HTTPException) as exc:
+        await get_current_keycloak_username({"username": "legacy-name"})
+
+    assert exc.value.status_code == 401
+    assert exc.value.detail == "Missing preferred_username claim"

tests/auth/test_metadata_dependencies.py

@@ -81,3 +81,26 @@ async def test_current_metadata_user_rejects_invalid_keycloak_sub():
     assert exc.value.status_code == 401
     repo.get_user_by_keycloak_id.assert_not_called()
     repo.refresh_user_keycloak_snapshot.assert_not_called()
+
+
+@pytest.mark.anyio
+async def test_current_metadata_user_rejects_username_claim_fallback():
+    keycloak_id = uuid4()
+    repo = SimpleNamespace(
+        get_user_by_keycloak_id=AsyncMock(),
+        refresh_user_keycloak_snapshot=AsyncMock(),
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await metadata_dependencies.get_current_metadata_user(
+            {
+                "sub": str(keycloak_id),
+                "username": "legacy-name",
+            },
+            metadata_repo=repo,
+        )
+
+    assert exc.value.status_code == 401
+    assert exc.value.detail == "Missing preferred_username claim"
+    repo.get_user_by_keycloak_id.assert_not_called()
+    repo.refresh_user_keycloak_snapshot.assert_not_called()