@@ -13,6 +13,26 @@ const uid2SupportRole = 'prod-uid2.0-support';
1313
1414export type ElevatedRole = 'SuperUser' | 'UID2 Support' ;
1515
16+ export const queryKeycloakUsersByEmail = async (
17+ kcAdminClient : KeycloakAdminClient ,
18+ email : string
19+ ) => {
20+ return kcAdminClient . users . find ( {
21+ email,
22+ extract : true ,
23+ } ) ;
24+ } ;
25+
26+ function toGroupsArray ( groupsRaw : unknown ) : string [ ] {
27+ if ( Array . isArray ( groupsRaw ) ) {
28+ return groupsRaw . filter ( ( g ) : g is string => typeof g === 'string' ) ;
29+ }
30+ if ( typeof groupsRaw === 'string' ) {
31+ return [ groupsRaw ] ;
32+ }
33+ return [ ] ;
34+ }
35+
1636/**
1737 * Resolves elevated role from Keycloak user attributes (key "groups"), not realm Groups.
1838 * Used when the viewed user has no portal participants but may have SuperUser/UID2 Support in IdP.
@@ -25,12 +45,7 @@ export const getElevatedRoleByEmail = async (
2545 if ( ! users . length ) return null ;
2646
2747 const attrs = users [ 0 ] . attributes ;
28- const groupsRaw = attrs ?. groups ;
29- const groups : string [ ] = Array . isArray ( groupsRaw )
30- ? groupsRaw
31- : typeof groupsRaw === 'string'
32- ? [ groupsRaw ]
33- : [ ] ;
48+ const groups = toGroupsArray ( attrs ?. groups ) ;
3449
3550 if ( groups . includes ( developerElevatedRole ) ) return 'SuperUser' ;
3651 if (
@@ -42,16 +57,6 @@ export const getElevatedRoleByEmail = async (
4257 return null ;
4358} ;
4459
45- export const queryKeycloakUsersByEmail = async (
46- kcAdminClient : KeycloakAdminClient ,
47- email : string
48- ) => {
49- return kcAdminClient . users . find ( {
50- email,
51- extract : true ,
52- } ) ;
53- } ;
54-
5560export const doesUserExistInKeycloak = async (
5661 kcAdminClient : KeycloakAdminClient ,
5762 email : string
0 commit comments