Expose identity lookup API

2026-07-10 18:57:19 +02:00
parent 4f4d05db42
commit d7bf71a2d9
6 changed files with 144 additions and 3 deletions
--- a/src/govoplan_identity/backend/api/v1/routes.py
+++ b/src/govoplan_identity/backend/api/v1/routes.py
@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy import func, or_
+from sqlalchemy.orm import Session
+
+from govoplan_core.auth import ApiPrincipal, require_any_scope
+from govoplan_core.db.session import get_session
+from govoplan_identity.backend.db.models import Identity, IdentityAccountLink
+
+from .schemas import IdentityItem, IdentityListResponse
+
+
+router = APIRouter(prefix="/identity", tags=["identity"])
+
+IDENTITY_READ_SCOPES = (
+    "identity:identity:read",
+    "identity:read",
+    "admin:users:read",
+    "system:accounts:read",
+    "organizations:function:assign",
+)
+
+
+@router.get("/identities", response_model=IdentityListResponse)
+def list_identities(
+    query: str | None = Query(default=None, min_length=1, max_length=255),
+    limit: int = Query(default=25, ge=1, le=100),
+    include_inactive: bool = False,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_any_scope(*IDENTITY_READ_SCOPES)),
+) -> IdentityListResponse:
+    del principal
+    identity_query = session.query(Identity)
+    if not include_inactive:
+        identity_query = identity_query.filter(Identity.is_active.is_(True))
+    if query:
+        pattern = f"%{query.strip().casefold()}%"
+        matching_account_links = session.query(IdentityAccountLink.identity_id).filter(
+            func.lower(IdentityAccountLink.account_id).like(pattern)
+        )
+        identity_query = identity_query.filter(
+            or_(
+                func.lower(Identity.id).like(pattern),
+                func.lower(Identity.display_name).like(pattern),
+                func.lower(Identity.external_subject).like(pattern),
+                Identity.id.in_(matching_account_links),
+            )
+        )
+
+    identities = identity_query.order_by(Identity.display_name.asc(), Identity.id.asc()).limit(limit).all()
+    identity_ids = [identity.id for identity in identities]
+    links_by_identity: dict[str, list[IdentityAccountLink]] = {identity_id: [] for identity_id in identity_ids}
+    if identity_ids:
+        links = (
+            session.query(IdentityAccountLink)
+            .filter(IdentityAccountLink.identity_id.in_(identity_ids))
+            .order_by(IdentityAccountLink.is_primary.desc(), IdentityAccountLink.account_id.asc())
+            .all()
+        )
+        for link in links:
+            links_by_identity.setdefault(link.identity_id, []).append(link)
+
+    return IdentityListResponse(
+        identities=[
+            _identity_item(identity, links_by_identity.get(identity.id, []))
+            for identity in identities
+        ]
+    )
+
+
+def _identity_item(identity: Identity, links: list[IdentityAccountLink]) -> IdentityItem:
+    primary_link = next((link for link in links if link.is_primary), None)
+    return IdentityItem(
+        id=identity.id,
+        display_name=identity.display_name,
+        external_subject=identity.external_subject,
+        source=identity.source,
+        primary_account_id=primary_link.account_id if primary_link is not None else None,
+        account_ids=[link.account_id for link in links],
+        status="active" if identity.is_active else "inactive",
+    )