angee.iam.identity

Identity helpers: user-reference display without exposing the user object.

The OIDC login/link resolution that used to live here moved to the iam_integrate_oidc addon (it composes the integrate connection substrate with this user). What remains is the pure user-reference display other addons use to label a grant/principal without pulling a guarded user row into their scope.

user_label

def user_label(user: Any) -> str

Return any user model's human label from the Django auth contract.

user_public_id

def user_public_id(user_id: Any) -> str | None

Return a user's opaque public id without fetching the user row.

user_display_labels

def user_display_labels(
        user_ids: Iterable[Any],
        *,
        request: HttpRequest | None = None) -> dict[Any, str | None]

Return user display labels for user_ids with one elevated read.

Resolved under system_context (IAM's elevation for server-side reads) so an actor-scoped caller never pulls a guarded User row into its own queryset — REBAC rejects that; only a display string leaves the helper.

Pass the Django request to prime and reuse the request-scoped label memo: list resolvers can ask for all distinct ids up front and pay one query.

user_display_label

def user_display_label(user_id: Any,
                       *,
                       request: HttpRequest | None = None) -> str | None

Return one user's display label without exposing the user object.

user_principal

def user_principal(principal_id: str) -> Any

Return the user addressed by a role-grant principal id.

user_from_public_id

def user_from_public_id(user_id: Any) -> Any

Return the user addressed by one GraphQL public id, or raise.