[PR] Bootstrap admin user and link upstream-provisioned users on first OID… [airavata-custos]

["lahirujayathilake (via GitHub)" <gi...@apache.org>]

lahirujayathilake opened a new pull request, #512:
URL: https://github.com/apache/airavata-custos/pull/512

   Closes #511 
   
   Today the resolver only accepts OIDC sign-ins for users that already have a matching `user_identities` row with an `oidc_sub`. That leaves two paths broken: the bootstrap super-admin (created from an env var, never has an OIDC binding) and every AMIE-provisioned user (the handler creates the user with `oidc_sub` NULL). Both require an admin to hand-insert a row before the user can sign in.
   
   - New `PENDING` user lifecycle state and `SYSTEM` user type. Provisioners (bootstrap, AMIE) write `PENDING`, the resolver flips to `ACTIVE` once the user signs in
   - Resolver gains a tightly gated email-fallback. When the JWT's `sub` has no binding, the resolver checks the JWT's `email`/`email_verified`, matches a single PENDING user by email, refuses if that user has any other OIDC binding already, then inserts the binding, sets the user ACTIVE, and emits an `IDENTITY_LINKED` audit event.
   - `BootstrapSuperAdmin` self-contained - if `CUSTOS_BOOTSTRAP_ADMIN_EMAIL` points at a missing user, the bootstrap path creates the `system` org + a PENDING SYSTEM user, grants `super_admin`, and emits `USER_BOOTSTRAPPED`.
   - AMIE handlers (`request_project_create`, `request_account_create`) provision users as PENDING.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: custos-unsubscribe@airavata.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org