[BACK-2785] Add keycloak extension endpoint to extract and create a new custodian user from a fake child account. #28
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ewollesen
reviewed
Apr 24, 2024
admin/src/main/java/org/tidepool/keycloak/extensions/resource/CloneUserBody.java
Outdated
Show resolved
Hide resolved
admin/src/main/java/org/tidepool/keycloak/extensions/resource/TidepoolAdminResource.java
Outdated
Show resolved
Hide resolved
admin/src/main/java/org/tidepool/keycloak/extensions/resource/TidepoolAdminResource.java
Outdated
Show resolved
Hide resolved
admin/src/main/java/org/tidepool/keycloak/extensions/resource/TidepoolAdminResource.java
Outdated
Show resolved
Hide resolved
admin/src/main/java/org/tidepool/keycloak/extensions/resource/CloneUserBody.java
Outdated
Show resolved
Hide resolved
lostlevels
changed the title
toddkazakov
reviewed
Apr 25, 2024
| // CUSTODIAN_ROLE is the role to give custodians accounts extracted from | ||
| // profiles that contain a fake child. | ||
| // TODO: decide on actual role | ||
| private static final String CUSTODIAN_ROLE = "custodian"; |
There was a problem hiding this comment.
I suggest using care_partner. @ewollesen thoughts?
There was a problem hiding this comment.
While I think a custodian is a care_partner, I'm not sure that a care_partner is a custodian.
Custodian implies more access and responsbility.
So migrating these roles to care_partner is OK, but we need to be sure we don't accidentally equate care_partner with custodian in other ways.
toddkazakov
reviewed
Apr 25, 2024
| if (user == null) { | ||
| throw new NotFoundException("User not found."); | ||
| } | ||
| boolean alreadyMigrated = user.getUsername() != null && TidepoolAdminResource.UNCLAIMED_CUSTODIAL.matcher(user.getUsername()).find(); |
There was a problem hiding this comment.
I suggest keeping a ref to the userId of custodiaN in the custodiaL (child) profile in case something goes wrong.
toddkazakov
reviewed
Apr 25, 2024
| // The Keycloak 24+ modules have removed cache eviction methods, so instead set child user's email and username "again" through the model. If we got this far, | ||
| // the previous transaction has succeeded so this is "safe" and will cause a user updated event which will clear the cache entry for the given user. | ||
| user.setEmail(newUsername); | ||
| user.setUsername(newUsername); |
There was a problem hiding this comment.
You should add custodial_account role
lostlevels
force-pushed
the
jimmy/back-2785
branch
from
3f790d1
to
6586868
Compare
child with a new username and email and giving the newly created parent the child's previous username and email along w/ all other properties.
and have a separate EntityManager per transaction.
…e it if it's already in that format.
lostlevels
force-pushed
the
jimmy/back-2785
branch
from
1d207ed
to
71f3966
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Used for migrating fake child accounts.
Creates a new "parent" user with email of target "child" account, copying over most fields, except a few custodiaL attributes. Parent will assume the email and username of the child, and the child will be given a new username and email as part of the request body.