Greptile Summary

This PR fixes a bug in the OIDC authentication flow where an existing user's role could be unintentionally overwritten (typically downgraded to VIEWER) when the OIDC provider was configured to supply role claims but omitted the claim from a particular userinfo response. The fix is minimal and surgical: a claims_provided boolean gate is introduced so that db_user_handler.update_user is only called when the role claim was genuinely present in the token, not merely when the claim key is configured. A corresponding test was added and follows the project's asyncio_mode = auto pattern correctly.

Key changes:

• base_handler.py: Replaces the OIDC_CLAIM_ROLES and user.role != role guard with claims_provided and user.role != role, where claims_provided is only True when OIDC_CLAIM_ROLES is configured and present in userinfo.
• test_oidc.py: New test test_oidc_valid_no_edit_user_role_if_claim_not_in_userinfo patches OIDC_CLAIM_ROLES/OIDC_ROLE_ADMIN, ensures "roles" is absent from the token's userinfo, and asserts that update_user is never called and the user's ADMIN role is preserved.

One note worth considering: When a new user (not yet in the database) logs in and the role claim is absent from userinfo, they are still created with the default Role.VIEWER. This is an asymmetry — existing users retain their current role, new users receive VIEWER. This pre-existing behaviour is unchanged by this PR and is arguably a safe default, but could be surprising in deployments where role claims are intermittently absent.

Confidence Score: 5/5

• This PR is safe to merge — the change is minimal, targeted, and correctly fixes the role-downgrade bug without affecting any other code paths.
• The fix is a one-line guard change backed by a well-structured new test. The logic is straightforward, the pre-existing test suite still covers all prior scenarios, and no regressions are introduced. The asyncio_mode = auto pytest config is already in place so the new async test will run correctly without any decorator changes.
• No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Receive OIDC token] --> B{userinfo present?}
    B -- No --> ERR1[400 Bad Request]
    B -- Yes --> C{email present?}
    C -- No --> ERR2[400 Bad Request]
    C -- Yes --> D{email_verified check}
    D -- Fail --> ERR3[400 Bad Request]
    D -- Pass --> E["role = VIEWER\nclaims_provided = False"]
    E --> F{"OIDC_CLAIM_ROLES configured\nAND present in userinfo?"}
    F -- Yes --> G["claims_provided = True\nResolve role from claim"]
    G --> H{Role matched?}
    H -- No match --> ERR4[403 Forbidden]
    H -- Match --> I{User in DB?}
    F -- No --> I
    I -- "No (new user)" --> J["Create user with current role\n(VIEWER if claims_provided=False)"]
    I -- "Yes (existing user)" --> K{"claims_provided AND\nuser.role != resolved role?"}
    K -- No --> L[Preserve existing role]
    K -- Yes --> M[Update user role in DB]
    J --> N{user.enabled?}
    L --> N
    M --> N
    N -- No --> ERR5[UserDisabledException]
    N -- Yes --> Z[Return user, userinfo]

_{Last reviewed commit: cf6f69b}