Ë
    ŽZ¸iX  ã                   ó2   — d dl mZ d dlmZ  G d„ de«      Zy)é    )ÚOIDCAuthenticationBackend)ÚUserProfilec                   ó:   ‡ — e Zd Zˆ fd„Zd„ Zˆ fd„Zd„ Zd„ Zˆ xZS )Ú EntraIDOIDCAuthenticationBackendc                 óT   •— t         ‰| �  |||«      }|j                  dg «      |d<   |S )zÆ
        Microsoft Entra ID does not include the 'roles' array in the standard 
        /userinfo endpoint response. We must explicitly inject it from the 
        initial ID token payload.
        Úroles)ÚsuperÚget_userinfoÚget)ÚselfÚaccess_tokenÚid_tokenÚpayloadÚ	user_infoÚ	__class__s        €ú/var/www/aura-ras/api/auth.pyr
   z-EntraIDOIDCAuthenticationBackend.get_userinfo   s3   ø€ ô ‘GÑ(¨°xÀÓIˆ	Ø$Ÿ[™[¨°"Ó5ˆ	�'ÑØÐó    c                 ój  — |j                  d«      xs |j                  d«      }|s$| j                  j                  j                  «       S 	 | j                  j                  j	                  |¬«      S # | j                  j
                  $ r' | j                  j                  j                  «       cY S w xY w)NÚpreferred_usernameÚemail)Úemail__iexact)r   Ú	UserModelÚobjectsÚnoneÚfilterÚDoesNotExist)r   Úclaimsr   s      r   Úfilter_users_by_claimsz7EntraIDOIDCAuthenticationBackend.filter_users_by_claims   s�   € Ø—
‘
Ð/Ó0ÒG°F·J±J¸wÓ4GˆÙØ—>‘>×)Ñ)×.Ñ.Ó0Ð0ð	1à—>‘>×)Ñ)×0Ñ0¸uÐ0ÓEÐEøØ�~‰~×*Ñ*ò 	1Ø—>‘>×)Ñ)×.Ñ.Ó0Ò0ð	1ús   Á%A2 Á2=B2Â1B2c                 ó^  •— t         t        | �  |«      }|j                  d«      xs |j                  d«      }|j                  dd«      |_        |j                  dd«      |_        ||_        |r|j                  d«      d   nd|_        |j                  «        | j                  ||«       |S )Nr   r   Ú
given_nameÚ Úfamily_nameú@r   )r	   r   Úcreate_userr   Ú
first_nameÚ	last_namer   ÚsplitÚusernameÚsaveÚ_update_user_role)r   r   Úuserr   r   s       €r   r$   z,EntraIDOIDCAuthenticationBackend.create_user   s”   ø€ ÜÔ5°tÑHÈÓPˆØ—
‘
Ð/Ó0ÒG°F·J±J¸wÓ4Gˆà Ÿ*™* \°2Ó6ˆŒØŸ™ M°2Ó6ˆŒØˆŒ
á/4˜Ÿ™ CÓ(¨Ò+¸"ˆŒØ�	‰	Œà×Ñ˜t VÔ,Øˆr   c                 óê   — |j                  d«      xs |j                  d«      }|r:|j                  d«      d   }|j                  |k7  r||_        |j                  «        | j	                  ||«       |S )Nr   r   r#   r   )r   r'   r(   r)   r*   )r   r+   r   r   Ú
short_names        r   Úupdate_userz,EntraIDOIDCAuthenticationBackend.update_user'   sh   € à—
‘
Ð/Ó0ÒG°F·J±J¸wÓ4GˆÙØŸ™ SÓ)¨!Ñ,ˆJØ�}‰} 
Ò*Ø *�”Ø—	‘	”ð 	×Ñ˜t VÔ,Øˆr   c                 ót  — |j                  dg «      }t        j                  j                  |¬«      \  }}d|v rd|_        d|_        d|_        nId|v rd|_        d|_        d|_        n/d	|v rd	|_        d|_        d|_        nd
|_        d|_        d|_        |j                  «        |j                  «        y )Nr   )r+   ÚServerAdminzServer AdministratorTÚDesktopAdminzDesktop AdministratorFÚCustomerÚ
Unassigned)r   r   r   Úget_or_createÚroleÚis_staffÚis_superuserr)   )r   r+   r   Úentra_rolesÚprofileÚ_s         r   r*   z2EntraIDOIDCAuthenticationBackend._update_user_role4   sµ   € à—j‘j ¨"Ó-ˆÜ ×(Ñ(×6Ñ6¸DÐ6ÓA‰
ˆ�ð ˜KÑ'Ø1ˆGŒLØ ˆDŒMØ $ˆDÕØ˜{Ñ*Ø2ˆGŒLØ!ˆDŒMØ %ˆDÕØ˜;Ñ&Ø%ˆGŒLØ!ˆDŒMØ %ˆDÕð (ˆGŒLØ!ˆDŒMØ %ˆDÔà�	‰	ŒØ�‰�r   )	Ú__name__Ú
__module__Ú__qualname__r
   r   r$   r.   r*   Ú__classcell__)r   s   @r   r   r      s   ø„ ôò1ôòör   r   N)Úmozilla_django_oidc.authr   Ú
api.modelsr   r   © r   r   ú<module>rB      s   ðÝ >Ý "ôIÐ'@õ Ir   