fix(auth): require preferred username claim

tests/auth/test_keycloak_dependencies.py

@@ -0,0 +1,30 @@
+import pytest
+from fastapi import HTTPException
+
+from app.auth.keycloak_dependencies import get_current_keycloak_username
+
+
+@pytest.fixture
+def anyio_backend():
+    return "asyncio"
+
+
+@pytest.mark.anyio
+async def test_current_username_uses_preferred_username_only():
+    username = await get_current_keycloak_username(
+        {
+            "preferred_username": "tjwater",
+            "username": "legacy-name",
+        }
+    )
+
+    assert username == "tjwater"
+
+
+@pytest.mark.anyio
+async def test_current_username_rejects_username_fallback():
+    with pytest.raises(HTTPException) as exc:
+        await get_current_keycloak_username({"username": "legacy-name"})
+
+    assert exc.value.status_code == 401
+    assert exc.value.detail == "Missing preferred_username claim"