feat: check for vidis role on login

serlo · Jul 19, 2024 · 503de6b · 503de6b
1 parent 79d0377
commit 503de6b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/modules/kratos/values.yaml b/modules/kratos/values.yaml
@@ -21,6 +21,9 @@ kratos:
   autoMigrate: true
 
   config:
+    log:
+      leak_sensitive_values: true
+
     dsn: ${dsn}
 
     serve:

diff --git a/modules/kratos/vidis_user_mapper.jsonnet b/modules/kratos/vidis_user_mapper.jsonnet
@@ -21,12 +21,17 @@ local buildUsername = function()
   then preferredUsername + '-' + enshortenUuid(uuid)
   else enshortenUuid(uuid);
 
+local checkIfIsTeacher = function()
+  local rawClaims = extractFromClaims('raw_claims');
+
+  if 'rolle' in rawClaims then rawClaims['rolle'] == 'LEHR' else false;
+
 {
-  identity: {
+  identity: if checkIfIsTeacher() then {
     traits: {
       email: buildEmail(),
       username: buildUsername(),
       interest: 'other',
     },
-  },
+  } else error std.format("ERR_BAD_ROLE"),
 }