Adopt a member the portal vouches for

A share link admits somebody at the portal, so this instance first hears of
them when they arrive rather than when a superuser types their code in.
An unmapped portal identity is now checked once against the portal's own
list of who may reach this instance and given an ordinary local account
only if the portal vouches for it.

Asking rather than believing the token is the point: a token stays signed
and valid until it expires, so trusting its claims would let one rebuild
the account somebody deleted here and deleting a user would stop being the
whole of the revocation.

The account-making itself moved out of the route, since both ways in build
the same thing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GPMNwB2mGBP5j7dXRopcPH

backend/fluksio/cloud/enroll.py

@@ -9,17 +9,24 @@ before the engine has started, holding nothing but the database.
 
 from __future__ import annotations
 
+import logging
+import secrets
 from datetime import UTC, datetime
 from typing import Any
 from urllib.parse import urlsplit
 
 import httpx
+from sqlalchemy.exc import IntegrityError
 from sqlmodel import Session, col, select
 
 import fluksio
+from fluksio import crud
 from fluksio.cloud import config as cloud_config
+from fluksio.core.security import get_password_hash
 from fluksio.models import User
 
+logger = logging.getLogger(__name__)
+
 
 class EnrollError(Exception):
     """A failure with the status the API should answer with."""
@@ -127,3 +134,85 @@ def enroll(
     session.add(user)
     session.commit()
     return config
+
+
+def lookup_member(portal_sub: str, *, timeout: float = 5.0) -> dict[str, Any] | None:
+    """Ask the portal whether it knows this account as a member of ours.
+
+    ``None`` for every kind of no — not enrolled, not a member, or a portal
+    that cannot be reached. The caller turns that into "no user", which is a
+    refused request rather than an error: an outage must not be a way in, and
+    it must not be a 500 either.
+    """
+    config = cloud_config.load()
+    if config is None:
+        return None
+    try:
+        response = httpx.get(
+            f"{config.portal_url.rstrip('/')}/api/v1/instance-members/{portal_sub}",
+            headers={"Authorization": f"Bearer {config.token}"},
+            timeout=timeout,
+        )
+    except httpx.HTTPError as exc:
+        logger.warning("Could not ask the portal about %s: %s", portal_sub, exc)
+        return None
+    if response.status_code != 200:
+        return None
+    data: dict[str, Any] = response.json()
+    return data
+
+
+def create_remote_user(session: Session, portal_sub: str, email: str) -> User:
+    """The ordinary local account a portal identity acts as here.
+
+    Ordinary is the point: it shows up under Admin → Users like everyone
+    else, holds no superuser flag, and is removed by deleting it there.
+    """
+    if session.exec(select(User).where(User.portal_sub == portal_sub)).first():
+        raise EnrollError(409, "That account already has access")
+    if crud.get_user_by_email(session=session, email=email) is not None:
+        # Never quietly hand an existing local account — possibly a superuser's
+        # — to whoever holds that address on the portal.
+        raise EnrollError(409, "A local user with this email already exists")
+    user = User(
+        email=email,
+        # Unusable by construction: this account is reached through the portal
+        # or not at all.
+        hashed_password=get_password_hash(secrets.token_urlsafe(32)),
+        is_superuser=False,
+        is_active=True,
+        portal_sub=portal_sub,
+    )
+    session.add(user)
+    session.commit()
+    session.refresh(user)
+    return user
+
+
+def adopt_member(session: Session, portal_sub: str) -> User | None:
+    """Give a portal identity the portal vouches for a local account.
+
+    The other way somebody gets in: a superuser here typing their code makes
+    the account up front, while an owner's share link admits them at the portal
+    and this instance first hears of it when they arrive. Asking the portal
+    rather than believing the token is what keeps deleting the local account a
+    revocation — the token stays signed and valid until it expires, and on its
+    own it must not build the account back.
+
+    # ponytail: one outbound GET per request from a subject with no local
+    # account, which is every request of somebody removed here. Cache it behind
+    # a short TTL if that ever shows up in a profile.
+    """
+    member = lookup_member(portal_sub)
+    if member is None:
+        return None
+    try:
+        return create_remote_user(session, portal_sub, str(member["email"]))
+    except EnrollError:
+        return None
+    except IntegrityError:
+        # A first page load fires several requests and the websocket at once,
+        # all of them missing the row and all of them creating it. Whoever
+        # loses reads back what the winner wrote.
+        session.rollback()
+        return session.exec(select(User).where(User.portal_sub == portal_sub)).first()