Normalize auth taxonomy and Bloom role persistence

[iamh2o]

Summary

• normalize Bloom auth taxonomy so identity groups, service roles, and service entitlements are distinct
• add Bloom user role normalization and migration support for canonical uppercase persisted roles
• update auth docs and focused auth tests for the new contract

Testing

• source ./activate xxyyzz && pytest --no-cov tests/test_group_service_rbac.py tests/test_gui_auth_callback.py tests/test_bloom_user_role_migration.py tests/test_api_auth_rbac.py tests/test_admin_auth.py tests/test_cli_users_issue_token.py -q

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2352f159ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep role lookup from stopping at first group hit

Returning immediately on a non-empty resolution.groups can short-circuit role resolution on cognito_sub before checking the email candidate for a persisted service role. After this change, roles are no longer derived from groups, so a user whose memberships are keyed by sub but whose stored role is keyed by email/login will be assigned the fallback READ_WRITE role instead of their persisted role (e.g., ADMIN) during login.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove legacy memberships with the matched user identifier

The migration infers legacy role groups by checking memberships under multiple identifiers (uid, username, email), but removal is always executed with user_id=str(user.uid). When the active membership is stored under username/email, remove_user_from_group does not match and nothing is actually removed, even though the script records it as removed in the summary.

Useful? React with 👍 / 👎.