feat(accounts): account profile view backend — contact_email + PATCH /v2/users/me/ (GUNDI-5347)

[amicavi]

Summary

Backend support for the Account Profile View (GUNDI-5347, sub-ticket of the epic GUNDI-5247 — see the backend implementation plan).

• New field AccountProfile.contact_email (EmailField, nullable). Independent of User.email, which stays managed by the auth provider — needed for the upcoming Auth0 migration.
• GET /v2/users/me/ now also returns first_name, last_name, contact_email, and workspaces[] (each with id, workspace_id, name, role) so the frontend can populate the whole Account Page with a single request.
• New PATCH /v2/users/me/ to let users update first_name, last_name, contact_email — transactional so a partial failure can't leave the User and AccountProfile out of sync.
• Refactor: Keycloak integration extracted from accounts/utils.py into accounts/keycloak.py (prep for the Auth0 swap). add_account now has an HTTP timeout, a single bool return, and proper network-error handling.

API changes

Method	Endpoint	Notes
GET	/v2/users/me/	Response gains first_name, last_name, contact_email, workspaces[]. Existing fields unchanged.
PATCH	/v2/users/me/	New. Body accepts any subset of {first_name, last_name, contact_email}. Returns the retrieve shape.

Frontend can populate the Account Page from a single GET /v2/users/me/:

```json
{
"id": ...,
"username": "...",
"first_name": "...",
"last_name": "...",
"contact_email": "user@example.com" | null,
"workspaces": [
{"id": 42, "workspace_id": "<org_uuid>", "name": "Workspace A", "role": "admin"}
]
}
```

workspaces[].id is the membership row id (integer, AccountProfileOrganization.id is a BigAutoField today). workspaces[].workspace_id is the organization UUID.

Out of scope (deferred to sibling sub-tickets of the epic)

• `account_setup_complete` first-login flag
• `POST /v2/users/me/leave-workspace/`
• Auto-seeding `contact_email` from invite emails
• Exposing `contact_email` (read-only) in the org members serializer
• Renaming `AccountProfileOrganization` reverse manager (will land with the Organization → Workspace rename)

Test plan

• `pytest cdip_admin/api/v2/tests/test_users_api.py` — covers GET shape (admin/viewer/superuser-without-profile), PATCH happy path, partial PATCH, invalid email, null contact_email, profile auto-create for superusers, unauthenticated, and N+1 regression on workspaces.
• `pytest cdip_admin/api/v2/tests/test_organizations_api.py` — invite flow still passes after the Keycloak mock target moved from `accounts.utils.add_account` to `accounts.keycloak.add_account`.
• `python3 manage.py makemigrations accounts --dry-run --check` — should report "No changes detected" (migration was hand-written; this confirms no drift, now that `help_text` is included on both model and migration).
• Manual: hit `/v2/users/me/` via Swagger; PATCH a profile; confirm `contact_email` visible/searchable in Django admin.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds backend support for an Account Profile view by introducing a user-controlled contact_email, expanding the /v2/users/me/ payload to include profile + workspace membership data, and adding a self-service PATCH /v2/users/me/ for updating profile fields. This also refactors Keycloak integration into a dedicated module in preparation for an Auth0 migration.

Changes:

• Add AccountProfile.contact_email (nullable) plus Django admin/search support and a migration.
• Expand GET /v2/users/me/ response to include first_name, last_name, contact_email, and workspaces[]; add PATCH /v2/users/me/ with atomic updates across User + AccountProfile.
• Extract Keycloak logic into accounts/keycloak.py, update call sites, and adjust tests/mocks accordingly.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
cdip_admin/emails/utils.py	Updates Keycloak import path for password reset link helper.
cdip_admin/api/v2/views.py	Enables user self-service PATCH via UpdateModelMixin and action-based serializer selection.
cdip_admin/api/v2/urls.py	Routes PATCH /v2/users/me/ to partial_update.
cdip_admin/api/v2/serializers.py	Adds workspace serializer; extends /me retrieve fields; adds atomic PATCH serializer with retrieve-shaped response.
cdip_admin/api/v2/tests/test_users_api.py	Adds coverage for expanded /me shape, PATCH behaviors, auth requirement, and N+1 guard.
cdip_admin/api/v2/tests/test_organizations_api.py	Updates Keycloak mock patch target to new module.
cdip_admin/accounts/utils.py	Switches to new accounts.keycloak.add_account and refactors org-member group assignment.
cdip_admin/accounts/models.py	Adds contact_email field to AccountProfile.
cdip_admin/accounts/migrations/0017_accountprofile_contact_email.py	Introduces DB schema change for contact_email.
cdip_admin/accounts/keycloak.py	New Keycloak integration module with timeout and network-error handling.
cdip_admin/accounts/admin.py	Exposes contact_email in admin list/search and edits fieldsets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

[chrisdoehring]

Possible dead code: keycloak.get_password_reset_link()

This PR removes the from accounts.utils import get_password_reset_link import from emails/utils.py, and a repo-wide grep now finds no callers of get_password_reset_link() — only its definition in accounts/keycloak.py:68. It looks like it was already an unused import before this change.

Suggest either wiring it up where it was intended to be used, or dropping it so we don't carry dead code into the Auth0 migration. (Worth a quick double-check that it isn't referenced from a template or other non-.py location first.)

🤖 Generated with Claude Code

[chrisdoehring]

Nice work on two things in the Keycloak refactor that are easy to miss 👏

1. Fixed a latent truthiness bug. The old add_account returned a JsonResponse(status=403) when no admin token was available, and the caller did if response:. A JsonResponse is truthy, so the old path would create the Django user even when Keycloak creation had effectively failed. Returning a plain bool makes if not keycloak.add_account(...): raise SuspiciousOperation behave correctly.

2. Bounded the outbound Keycloak call. Adding KEYCLOAK_HTTP_TIMEOUT plus except requests.RequestException replaces a previously unbounded requests.post — a real robustness win that keeps a portal request from hanging on a slow/unreachable Keycloak.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

[chrisdoehring]

Data-model follow-up filed: GUNDI-5377

A design review of the User / AccountProfile split (prompted by adding contact_email here) concluded the separation is sound and idiomatic — this PR is safe to merge as-is and is a good citizen (proper select_related, N+1 regression test, defensive profile reads).

The one genuine, pre-existing risk surfaced is that the "every User has exactly one AccountProfile" invariant is unenforced (the OIDC login path creates a User with no profile), which is why the codebase carries scattered getattr/try-except guards — and one unguarded spot (integrations/views.py:829) that 500s instead of 403s. That's tracked separately in GUNDI-5377 (auto-create + backfill + the 403 fix) and does not block this PR.

🤖 Generated with Claude Code

[amicavi]

Good catch — confirmed dead code. Verified there's no password_reset_link reference in emails/templates/invite_email.html or invite_email.txt either; the invite copy explicitly instructs the user to click "Forgot Password?" in the portal UI, so there's no email-embedded reset link.

Dropped get_password_reset_link and the now-unused KEYCLOAK_CLIENT constant in ddce5f9. If a reset link is ever needed again it should be added via the AuthProvider abstraction at that time, not carried into the Auth0 migration as Keycloak-specific glue.

[amicavi]

Thanks for calling those out — appreciated. Both were genuinely latent: the if response: against a truthy JsonResponse would have created Django users orphaned from any Keycloak account on a missing-token path, and an unbounded requests.post is the kind of thing that only shows up as a portal-wide stall during a Keycloak outage. Glad they're closed off now.

[amicavi]

Acknowledged and thanks for the design review. Agreed the User/AccountProfile split is the right shape — and the unenforced 1:1 invariant is the real source of the scattered defensive reads (including the get_or_create inside UserDetailsUpdateSerializer.update in this PR, which is precisely that pattern). Tracking the auto-create + backfill + the integrations/views.py:829 403-vs-500 fix under GUNDI-5377 is the right call; keeping it out of this PR keeps the scope honest.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

[chrisdoehring]

It looks good.