Stan Silvert 4473217f4b Resolve organizations live for purged users instead of copying their state ...

Review follow-up to the account-purged support.

The snapshot copied each organization's ssf.* attributes and answered the
subject gate's org questions itself. That hardcoded the default attribute
semantics and bypassed SsfSubjectInclusionResolver, a documented extension
point -- so a deployment overriding it got one verdict for every event type
and a different one for purges.

Organizations outlive the user, which buildTenantSubjectFromSnapshot already
depends on. So capture only the aliases and re-resolve live OrganizationModels
at filter time. All three org branches now run the same code for purged and
live users, and the resolver stays authoritative for both. getByMember is
left as the single thing being substituted, which is what the class javadoc
already claimed the exception was.

Also bound snapshot retention. The workflow delete step removes every due user
on one session and fires no admin or user event, so those snapshots are never
read; without a cap a retention run purging tens of thousands of accounts
would hold every one of them for the life of the session.

Smaller fixes from the same review: verify the realm on snapshot lookup rather
than trusting the user id alone; normalize the email index key with
KeycloakModelUtils.toLowerCaseSafe so it matches how the adapter stores the
address; document the workflow-delete gap on RiscAccountPurged and in the
guide, since a data-retention deletion is exactly what a receiver would expect
account-purged to cover; and refresh the canConvert(AdminEvent) javadoc, which
still listed three admin paths.

Adds an integration test for the org-excluded branch, and a wire-format test
pinning that account-purged carries no reason claim.

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5

2026-09-23 07:04:22 -03:00

..

src

Resolve organizations live for purged users instead of copying their state

2026-09-23 07:04:22 -03:00

pom.xml

…