Enable osm-web API endpoints with auth token

[jeffmaki]

AZDO: #3967, #3966

Summary

• Added OSM OAuth application and scope configuration settings.
• Implemented best-effort bridging of validated TDEI/Keycloak JWTs into OSM users and oauth_access_tokens.
• Added token expiry, scope, and token rotation handling, including revocation of superseded tokens.
• Added unit tests covering bridging, revocation, disabled configuration, expiry handling, and database failures.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds configurable mirroring of validated TDEI tokens into OSM OAuth tables, revocation of superseded tokens during JWT rotation, and unit tests for bridge, expiry, disabled, and failure-handling behavior.

Changes

OSM OAuth token bridge

Layer / File(s)	Summary
OSM OAuth bridge settings api/core/config.py	Adds the target OSM OAuth application ID and required OAuth scopes, with bridging disabled when the application ID is 0.
Token mirroring and rotation api/core/security.py	Mirrors validated tokens and users into OSM, derives token expiry from JWT metadata, and best-effort revokes superseded tokens during JWT rotation.
Bridge and revocation tests tests/unit/test_token_bridge.py	Tests disabled behavior, upserts, expiry handling, targeted revocation, commits, and rollback on database errors.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant validate_token
  participant OSMDatabase
  Client->>validate_token: Present bearer JWT
  validate_token->>OSMDatabase: Upsert TDEI user and OAuth token
  OSMDatabase-->>validate_token: Commit mirrored token
  validate_token-->>Client: Validated authentication

Loading

Suggested reviewers: MashB, cyrossignol, sujata-m, susrisha

Poem

A rabbit hops through tokens bright,
Mirroring OAuth by moonlit night.
Old paws are revoked when rotations appear,
New scopes and users are safely held near.
SQL whispers, “Welcome,” and errors disappear.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: bridging auth tokens to enable osm-web API endpoints.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

api/core/security.py (1)

341-426: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract the shared users-provisioning SQL. The users insert is duplicated in _provision_users_from_tdei; a shared helper would keep the two paths from diverging.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/core/security.py` around lines 341 - 426, Extract the duplicated
users-table provisioning INSERT from _bridge_token_to_osm and
_provision_users_from_tdei into a shared helper, preserving the existing SQL,
parameters, conflict behavior, and transaction semantics. Update both callers to
use the helper and retain their current subsequent user lookup and error
handling.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@api/core/security.py`:
- Around line 341-426: Extract the duplicated users-table provisioning INSERT
from _bridge_token_to_osm and _provision_users_from_tdei into a shared helper,
preserving the existing SQL, parameters, conflict behavior, and transaction
semantics. Update both callers to use the helper and retain their current
subsequent user lookup and error handling.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 10246820-51bc-4e30-87a5-2dfa2a7f399b

📥 Commits

Reviewing files that changed from the base of the PR and between 6d98fcb and 0070a2f.

📒 Files selected for processing (3)

• api/core/config.py
• api/core/security.py
• tests/unit/test_token_bridge.py