fix(auth): require preferred username claim

2026-07-30 14:21:21 +08:00
parent a475c7b2c3
commit 6a85a7fd78
5 changed files with 82 additions and 13 deletions
@@ -16,7 +16,7 @@ trust frontend-supplied user IDs.
 ## Login Snapshot Refresh

 Every authenticated metadata-user resolution validates the Keycloak access token
-and reads `sub`, `preferred_username` or `username`, and `email` claims. The
+and reads `sub`, `preferred_username`, and `email` claims. The
 backend finds `users` by `keycloak_id = sub`, rejects inactive or missing users,
 then refreshes `username`, `email`, and `last_login_at`.