(airavata-custos) 01/01: Don't create a pending cluster account in COmange when the user signs-in to the portal

[la...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lahirujayathilake pushed a commit to branch bug-fix
in repository https://gitbox.apache.org/repos/asf/airavata-custos.git

commit 047fd553a6e6a431feafd9e9bd868caa18da9456
Author: lahiruj <la...@gmail.com>
AuthorDate: Thu Oct 1 21:24:48 2026 -0400

    Don't create a pending cluster account in COmange when the user signs-in to the portal
---
 .../internal/operations/orchestrator.go            |  5 ++++
 .../internal/operations/orchestrator_test.go       | 30 +++++++++++++++++++---
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator.go b/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator.go
index c9e7a7fbd..35065847c 100644
--- a/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator.go
+++ b/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator.go
@@ -50,7 +50,12 @@ func New(c *client.Client, core *service.Service) *Orchestrator {
 	return &Orchestrator{c: c, core: core}
 }
 
+// EnsurePOSIXAccount creates the cluster account in the registry. An account
+// that is not approved is skipped, whichever event asked for it.
 func (o *Orchestrator) EnsurePOSIXAccount(ctx context.Context, cu *models.ComputeClusterUser) error {
+	if cu.ApprovalStatus != models.ClusterAccountApproved {
+		return nil
+	}
 	ctx, span := tracing.Start(ctx, "comanage.ensure_posix_account")
 	defer span.End()
 	span.SetAttributes(
diff --git a/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator_test.go b/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator_test.go
index 73724d028..cb62d9226 100644
--- a/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator_test.go
+++ b/connectors/COmanage/Identity-Provisioner/internal/operations/orchestrator_test.go
@@ -82,7 +82,7 @@ func TestEnsurePOSIXAccount_EmitsComanageSpanTree(t *testing.T) {
 	ctx, root := tracing.Start(context.Background(), "test.root")
 	defer root.End()
 
-	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "e2etest"}
+	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "e2etest", ApprovalStatus: models.ClusterAccountApproved}
 	if err := orch.EnsurePOSIXAccount(ctx, cu); err != nil {
 		t.Fatalf("EnsurePOSIXAccount: %v", err)
 	}
@@ -135,7 +135,7 @@ func TestEnsurePOSIXAccount_DlqAuditCarriesTraceID(t *testing.T) {
 	defer root.End()
 	wantTrace := root.SpanContext().TraceID()
 
-	cu := &models.ComputeClusterUser{ID: "ccu-x", UserID: "user-x", LocalUsername: "flx"}
+	cu := &models.ComputeClusterUser{ID: "ccu-x", UserID: "user-x", LocalUsername: "flx", ApprovalStatus: models.ClusterAccountApproved}
 	if err := orch.EnsurePOSIXAccount(ctx, cu); err == nil {
 		t.Fatalf("expected EnsurePOSIXAccount to fail under 500")
 	}
@@ -218,7 +218,7 @@ func TestEnsurePOSIXAccount_CorrectsAutoAssignedPersonUID(t *testing.T) {
 	ctx, root := tracing.Start(context.Background(), "test.root")
 	defer root.End()
 
-	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "cluster-e2etest"}
+	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "cluster-e2etest", ApprovalStatus: models.ClusterAccountApproved}
 	if err := orch.EnsurePOSIXAccount(ctx, cu); err != nil {
 		t.Fatalf("EnsurePOSIXAccount: %v", err)
 	}
@@ -282,7 +282,7 @@ func TestEnsurePOSIXAccount_CreatesOIDCLinkage(t *testing.T) {
 	ctx, root := tracing.Start(context.Background(), "test.root")
 	defer root.End()
 
-	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "e2etest"}
+	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "e2etest", ApprovalStatus: models.ClusterAccountApproved}
 	if err := orch.EnsurePOSIXAccount(ctx, cu); err != nil {
 		t.Fatalf("EnsurePOSIXAccount: %v", err)
 	}
@@ -301,3 +301,25 @@ func TestEnsurePOSIXAccount_CreatesOIDCLinkage(t *testing.T) {
 		}
 	}
 }
+
+// Make sure an account that is still waiting for admin approval is not sent to the registry.
+func TestEnsurePOSIXAccount_SkipsAnAccountThatIsNotApproved(t *testing.T) {
+	calls := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { calls++ }))
+	defer srv.Close()
+
+	core := &fakeCore{user: &models.User{ID: "user-1", FirstName: "Jane", LastName: "Doe", Email: "jdoe@example.edu"}}
+	orch := newOrchestratorForTest(t, srv, core, "")
+
+	cu := &models.ComputeClusterUser{ID: "ccu-1", UserID: "user-1", LocalUsername: "jdoe", ApprovalStatus: models.ClusterAccountPending}
+	if err := orch.EnsurePOSIXAccount(context.Background(), cu); err != nil {
+		t.Fatalf("EnsurePOSIXAccount: %v", err)
+	}
+
+	if calls != 0 {
+		t.Errorf("registry got %d calls for a pending account, want 0", calls)
+	}
+	if len(core.markedProvisioned) != 0 {
+		t.Errorf("pending account was marked provisioned: %v", core.markedProvisioned)
+	}
+}