Prefer canonical identity and organization directories

src/govoplan_access/backend/semantic.py

@@ -17,7 +17,9 @@ from govoplan_access.backend.db.models import (
     Role,
     User,
 )
+from govoplan_core.core.identity import IdentityDirectory
 from govoplan_core.core.idm import OrganizationFunctionAssignmentRef
+from govoplan_core.core.organizations import ORGANIZATIONS_MODULE_ID, OrganizationDirectory
 from govoplan_core.security.time import utc_now
 
 
@@ -35,7 +37,16 @@ def primary_identity_for_account(session: Session, account_id: str) -> Identity
     )
 
 
-def identity_id_for_account(session: Session, account_id: str) -> str | None:
+def identity_id_for_account(
+    session: Session,
+    account_id: str,
+    *,
+    identity_directory: IdentityDirectory | None = None,
+) -> str | None:
+    if identity_directory is not None:
+        identity = identity_directory.identity_for_account(account_id)
+        if identity is not None and identity.status == "active":
+            return identity.id
     identity = primary_identity_for_account(session, account_id)
     return identity.id if identity is not None else None
 
@@ -163,13 +174,20 @@ def collect_external_function_roles(
     user: User,
     assignments: Iterable[OrganizationFunctionAssignmentRef],
     *,
-    source_module: str = "organizations",
+    source_module: str = ORGANIZATIONS_MODULE_ID,
+    organization_directory: OrganizationDirectory | None = None,
 ) -> list[Role]:
     function_ids = sorted({
         assignment.function_id
         for assignment in assignments
         if assignment.tenant_id == user.tenant_id and assignment.status == "active"
     })
+    if organization_directory is not None and source_module == ORGANIZATIONS_MODULE_ID:
+        function_ids = [
+            function_id
+            for function_id in function_ids
+            if _organization_function_active(organization_directory, function_id, tenant_id=user.tenant_id)
+        ]
     if not function_ids:
         return []
     return (
@@ -184,3 +202,13 @@ def collect_external_function_roles(
         .order_by(Role.name.asc())
         .all()
     )
+
+
+def _organization_function_active(
+    organization_directory: OrganizationDirectory,
+    function_id: str,
+    *,
+    tenant_id: str,
+) -> bool:
+    function = organization_directory.get_function(function_id)
+    return function is not None and function.tenant_id == tenant_id and function.status == "active"