FIX - NAS DEPLOY: стабилизация real-domain Tasker OIDC baseline

plane-src/apps/api/plane/authentication/views/app/oidc.py

@@ -343,19 +343,11 @@ def resolve_linked_user(claims, groups, auto_link, auto_create, sync_profile, sk
     if link is None and auto_link and email:
         user = User.objects.filter(email__iexact=email, is_active=True).first()
         if user:
-            link, _ = ExternalIdentityLink.objects.get_or_create(
-                provider=OIDC_PROVIDER,
-                subject=subject,
-                defaults={"user": user, "email": email, "groups": groups},
-            )
+            link = resolve_identity_link_for_user(user, subject, email, groups)
 
     if link is None and auto_create and email:
         user, user_created = get_or_create_oidc_user(email=email, claims=claims)
-        link, _ = ExternalIdentityLink.objects.get_or_create(
-            provider=OIDC_PROVIDER,
-            subject=subject,
-            defaults={"user": user, "email": email, "groups": groups},
-        )
+        link = resolve_identity_link_for_user(user, subject, email, groups)
         if user_created:
             logger.info(
                 "NODEDC OIDC provisioned Tasker user: user_id=%s email_hash=%s subject_hash=%s",
@@ -394,6 +386,52 @@ def resolve_linked_user(claims, groups, auto_link, auto_create, sync_profile, sk
     return user
 
 
+def resolve_identity_link_for_user(user, subject, email, groups):
+    user_link = ExternalIdentityLink.objects.select_related("user").filter(
+        provider=OIDC_PROVIDER,
+        user=user,
+    ).first()
+
+    conflicting_link = ExternalIdentityLink.objects.filter(
+        provider=OIDC_PROVIDER,
+        subject=subject,
+    ).exclude(user=user).first()
+
+    if conflicting_link:
+        logger.warning(
+            "NODEDC OIDC subject is already linked to another user: "
+            "provider=%s user_id=%s subject_hash=%s",
+            OIDC_PROVIDER,
+            conflicting_link.user_id,
+            hash_subject(subject),
+        )
+        return None
+
+    if user_link:
+        if user_link.status != ExternalIdentityLink.Status.ACTIVE:
+            logger.warning(
+                "NODEDC OIDC denied disabled external identity link during email auto-link: "
+                "provider=%s user_id=%s subject_hash=%s",
+                OIDC_PROVIDER,
+                user.id,
+                hash_subject(subject),
+            )
+            return None
+
+        user_link.subject = subject
+        user_link.email = email
+        user_link.groups = groups
+        user_link.save(update_fields=["subject", "email", "groups", "updated_at"])
+        return user_link
+
+    link, _ = ExternalIdentityLink.objects.get_or_create(
+        provider=OIDC_PROVIDER,
+        subject=subject,
+        defaults={"user": user, "email": email, "groups": groups},
+    )
+    return link
+
+
 def get_or_create_oidc_user(email, claims):
     user = User.objects.filter(email__iexact=email).first()