[servicememeai]

Goal

Fix mixed legacy OAuth2 / new OIDC entry points so their authenticated identity always resolves via the exact Etech UID stored in Profile.login_id to the same enabled Seafile native account and its existing permissions. Preserve existing user/storage/ACL data.

Changes

• Add strict UID-based social subject -> native-user binding, refusing alias, unprovisioned UID, duplicate/colliding subject, disabled native user and system admin.
• Stop legacy OAuth callback from using email / stale provider subject to log into a different account, or treating a failed login_id update as successful authentication.
• Enforce OAuth state and OIDC nonce/ID Token subject checks before account linking; preserve separate EAP OIDC bridge.
• Prepare Etech directory subject before session publication where configured; optional contact/name stay metadata only.
• Add focused UID regression tests and update direct callback test contracts.

Validation

• Python AST syntax and git diff --check: pass.
• python3 -m unittest discover -s cloudfile_ext/sso/tests -p test_uid_binding.py -v: 3 tests pass.
• Django/pytest suite not run (test Python on remote host lacks pytest); real DEV/Authentik, Etech permission and full login flow NOT verified.
• No Docker build, no release, no DB changes.

Review / merge gate

Verify legacy OAuth, new OIDC and EAP-authenticating portal flows with the same Etech UID and differing email/employee data. Verify existing bindings, negative UID/sub conflicts, directory unavailable, active/disabled, ACL and actual file permissions before merging/deploying. This is intentionally a draft PR.

[servicememeai]

已按统一方案收口：PR #35 已 squash 合并到 dev（ee732e74c），本 PR #34 保持 Closed / not merged，不再作为独立修复入口。

吸收到 #35 的有效内容：

• 可信 Etech userId 对应 Profile.login_id 的精确原生账号匹配；现有 provider/sub 不能指向另一账号，UID 冲突拒绝，而不是按邮箱/工号自动归并。
• OAuth state 消费/校验；/oidc/login/ 的 nonce、ID Token 与 UserInfo sub 校验。
• 认证与目录状态不正确时拒绝发放 Session，并补充相应专项测试。
• 修复原 OAuth 回调局部变量 _ 遮蔽 gettext 的异常路径问题。

没有原样合入 #34 的完整 Seahub 回调替换。保留 V2 当前禁止引用退役 EAP OAuth 桥接的规则，未配置可信 userId 的通用旧 OAuth 兼容路径保持不变。新增关联使用 V2 独立逻辑，无新表、无镜像构建或部署。

代码及轻量 CI 已通过；真实 DEV/Authentik/Etech 登录与文件权限联验尚未执行，不能视为部署验收。详情见 #35。