АРХ - МЕЖПРОЕКТНАЯ КОММУНИКАЦИЯ: Authentik profile projection

infra/authentik/bootstrap-dev.py

@@ -118,9 +118,42 @@ def ensure_groups_scope_mapping():
     return mapping
 
 
+def ensure_profile_scope_mapping():
+    expression = """
+attributes = request.user.attributes or {}
+display_name = request.user.name or request.user.username
+name_parts = display_name.split(" ", 1)
+avatar_url = attributes.get("picture") or attributes.get("avatar_url") or attributes.get("avatar")
+
+return {
+    "name": display_name,
+    "given_name": name_parts[0] if name_parts else display_name,
+    "family_name": name_parts[1] if len(name_parts) > 1 else "",
+    "preferred_username": request.user.username,
+    "nickname": request.user.username,
+    "picture": avatar_url,
+    "avatar_url": avatar_url,
+}
+""".strip()
+    mapping, _ = ScopeMapping.objects.get_or_create(
+        name="NODE.DC OAuth Mapping: profile context",
+        defaults={
+            "scope_name": "profile",
+            "description": "Adds normalized NODE.DC profile claims to OIDC tokens.",
+            "expression": expression,
+        },
+    )
+    mapping.scope_name = "profile"
+    mapping.description = "Adds normalized NODE.DC profile claims to OIDC tokens."
+    mapping.expression = expression
+    mapping.save()
+    return mapping
+
+
 def default_scope_mappings():
-    scope_names = ["openid", "email", "profile", "offline_access"]
+    scope_names = ["openid", "email", "offline_access"]
     mappings = list(ScopeMapping.objects.filter(scope_name__in=scope_names))
+    mappings.append(ensure_profile_scope_mapping())
     mappings.append(ensure_groups_scope_mapping())
     return mappings