Class: AtlasRb::System::User

Inherits:
Object
  • Object
show all
Extended by:
FaradayHelper
Defined in:
lib/atlas_rb/system/user.rb

Overview

SSO-callback user provisioning. Finds the Atlas User row keyed on the supplied email — the account key — (creating it if missing) and replaces its groups with the IdP-asserted set. Full replace, not merge — the IdP assertion is authoritative. Keying on email keeps a person's staff/student logins as distinct accounts under one NUID.

Always authenticates via FaradayHelper#system_connection, so the caller has no way to act as a non-system principal. Atlas allows this endpoint only for the system token + system NUID pairing.

Constant Summary

Constants included from FaradayHelper

FaradayHelper::ASSERTION_AUDIENCE, FaradayHelper::ASSERTION_ISSUER, FaradayHelper::ASSERTION_TTL, FaradayHelper::INSTRUMENTATION_EVENT

Class Method Summary collapse

Methods included from FaradayHelper

connection, multipart, system_connection, with_file_part

Class Method Details

.find_or_create(email:, nuid: nil, groups: [], name: nil, affiliation: nil) ⇒ AtlasRb::Mash

Find-or-create the User keyed on email and replace its groups.

Email is the account key: a person's staff and student logins share a NUID but present a different email each, so keying on email keeps them as distinct accounts instead of collapsing (last-write-wins) on NUID.

Examples:

From Cerberus's SSO callback

AtlasRb::System::User.find_or_create(
  email: "j.doe@northeastern.edu",
  nuid: "001234567",
  groups: ["northeastern:staff", "drs:editors"],
  name: "Jane Doe",
  affiliation: "staff"
)

Parameters:

  • email (String) —

    the account key — the login's mail. This is the subject of the operation, not the actor; the actor is always the system fixture.

  • nuid (String, nil) (defaults to: nil) —

    the person's NUID (the grouping thread that ties a person's accounts together). Forwarded when available.

  • groups (Array<String>) (defaults to: []) —

    full group set; replaces, not merges.

  • name (String, nil) (defaults to: nil) —

    forwarded if the SSO callback has it; Atlas treats this field as optional.

  • affiliation (String, nil) (defaults to: nil) —

    the login's unscoped-affiliation, a human label for the account (e.g. "staff"/"student"); optional.

Returns:

  • (AtlasRb::Mash) —

    the resulting User record (id, nuid, name, email, role, groups, affiliation, preferred).



68
69
70
71
72
73
74
75
76
 
# File 'lib/atlas_rb/system/user.rb', line 68

def self.find_or_create(email:, nuid: nil, groups: [], name: nil, affiliation: nil)
  body = { groups: groups }
  body[:nuid]        = nuid        if nuid
  body[:name]        = name        if name
  body[:affiliation] = affiliation if affiliation

  response = system_connection.put("/users/by_email/#{email}", body.to_json)
  AtlasRb::Mash.new(JSON.parse(response.body))["user"]
end