feat(user-sync): strip employment status and warn on missing email

Author: raederan

src/osw/tools/user_sync/build.py

@@ -12,6 +12,7 @@
 
 from opensemantic.base.v1 import Organization, User
 
+from .config import PROTECTED_FIELDS
 from .mapping import ProposedOrganization, ProposedUser
 
 # The concrete DisplayName type used by the label field.
@@ -22,12 +23,20 @@ def _labels(text: str) -> List[Any]:
     return [_DISPLAY_NAME(text=text)]
 
 
+def _strip_protected(entity: Any) -> None:
+    """Remove protected relation defaults (e.g. employment_contract_status)."""
+    iris = getattr(entity, "__iris__", None)
+    if isinstance(iris, dict):
+        for name in PROTECTED_FIELDS:
+            iris.pop(name, None)
+
+
 def build_organization(proposed: ProposedOrganization) -> Organization:
     return Organization(uuid=proposed.uuid, label=_labels(proposed.name))
 
 
 def build_user(proposed: ProposedUser) -> User:
-    """Build a full User entity for creation."""
+    """Build a full User entity for creation (never carries protected fields)."""
     args: dict = {
         "uuid": proposed.uuid,
         "username": proposed.username,
@@ -43,11 +52,17 @@ def build_user(proposed: ProposedUser) -> User:
         args["website"] = set(proposed.websites)
     if proposed.organizations:
         args["organization"] = list(proposed.organizations)
-    return User(**args)
+    entity = User(**args)
+    _strip_protected(entity)
+    return entity
 
 
 def apply_update(entity: Any, proposed: ProposedUser, apply_fields: Set[str]) -> Any:
-    """Apply the accepted fields onto a loaded existing entity, in place."""
+    """Apply the accepted fields onto a loaded existing entity, in place.
+
+    Fields whose proposal is empty (REMOVE) are cleared; protected fields in
+    ``apply_fields`` are stripped from the entity's ``__iris__`` map.
+    """
     if "label" in apply_fields:
         entity.label = _labels(proposed.label)
     if "first_name" in apply_fields:
@@ -61,5 +76,10 @@ def apply_update(entity: Any, proposed: ProposedUser, apply_fields: Set[str]) ->
     if "websites" in apply_fields:
         entity.website = set(proposed.websites)
     if "organizations" in apply_fields:
-        entity.__iris__["organization"] = list(proposed.organizations)
+        if proposed.organizations:
+            entity.__iris__["organization"] = list(proposed.organizations)
+        else:
+            entity.__iris__.pop("organization", None)
+    if any(name in apply_fields for name in PROTECTED_FIELDS):
+        _strip_protected(entity)
     return entity

src/osw/tools/user_sync/sync.py

@@ -38,14 +38,16 @@ class SyncReport:
     failed: Dict[str, str] = field(default_factory=dict)
     redirects_created: List[str] = field(default_factory=list)
     organizations: List[str] = field(default_factory=list)
+    missing_email: List[str] = field(default_factory=list)
     accepted: bool = False
 
     def summary(self) -> str:
         state = "applied" if self.accepted else "no changes written"
         return (
             f"{state}: created={len(self.created)} updated={len(self.updated)} "
             f"skipped={len(self.skipped)} failed={len(self.failed)} "
-            f"redirects={len(self.redirects_created)} orgs={len(self.organizations)}"
+            f"redirects={len(self.redirects_created)} orgs={len(self.organizations)} "
+            f"missing_email={len(self.missing_email)}"
         )
 
 
@@ -144,6 +146,14 @@ def _create_redirects(osw: Any, resolution: Resolution, report: SyncReport) -> N
             report.failed[f"redirect:{proposed.username}"] = str(exc)
 
 
+def _warn_missing_email(prompter: Prompter, missing: List[str]) -> None:
+    if missing:
+        prompter.write(
+            f"WARNING: {len(missing)} user(s) have no ORCID email: "
+            + ", ".join(missing)
+        )
+
+
 def _verify(osw: Any, report: SyncReport) -> None:
     titles = report.created + report.updated
     if not titles:
@@ -175,6 +185,7 @@ def run_user_sync(
     prompter = prompter or Prompter()
 
     proposed_users, org_map = _build_proposals(config, osw, session)
+    missing_email = [p.username for p in proposed_users if not p.emails]
     existing = load_existing_users(osw)
     plan = reconcile(
         proposed_users,
@@ -197,8 +208,9 @@ def run_user_sync(
         summary_lines=summary_lines,
     )
 
-    report = SyncReport(accepted=resolution.accepted)
+    report = SyncReport(accepted=resolution.accepted, missing_email=missing_email)
     if not resolution.accepted:
+        _warn_missing_email(prompter, missing_email)
         return report
 
     if config.link_organizations:
@@ -207,4 +219,5 @@ def run_user_sync(
     if config.create_redirects:
         _create_redirects(osw, resolution, report)
     _verify(osw, report)
+    _warn_missing_email(prompter, missing_email)
     return report

tests/tools/test_user_sync_build.py

@@ -0,0 +1,77 @@
+"""Unit tests for entity building/updating helpers (fakes; no live models)."""
+
+import uuid
+from types import SimpleNamespace
+
+from osw.tools.user_sync.build import _strip_protected, apply_update
+from osw.tools.user_sync.mapping import ProposedUser
+
+
+def _proposed(**kw):
+    base = dict(
+        uuid=uuid.uuid4(),
+        username="u",
+        first_name="F",
+        surname="S",
+        label="F S",
+        orcid=None,
+        emails=[],
+        websites=[],
+        organizations=[],
+    )
+    base.update(kw)
+    return ProposedUser(**base)
+
+
+def _entity():
+    return SimpleNamespace(
+        label=[],
+        first_name="",
+        surname="",
+        orcid=None,
+        email=set(),
+        website=set(),
+        __iris__={
+            "organization": ["Item:OSWa"],
+            "employment_contract_status": "Item:OSWx",
+        },
+    )
+
+
+def test_strip_protected_removes_only_protected():
+    entity = _entity()
+    _strip_protected(entity)
+    assert "employment_contract_status" not in entity.__iris__
+    assert "organization" in entity.__iris__
+
+
+def test_apply_update_strips_protected_when_in_fields():
+    entity = _entity()
+    apply_update(entity, _proposed(), {"employment_contract_status"})
+    assert "employment_contract_status" not in entity.__iris__
+
+
+def test_apply_update_keeps_protected_when_not_in_fields():
+    entity = _entity()
+    apply_update(entity, _proposed(surname="New"), {"surname"})
+    assert "employment_contract_status" in entity.__iris__
+    assert entity.surname == "New"
+
+
+def test_apply_update_clears_organization_when_empty():
+    entity = _entity()
+    apply_update(entity, _proposed(organizations=[]), {"organizations"})
+    assert "organization" not in entity.__iris__
+
+
+def test_apply_update_sets_organization_when_present():
+    entity = _entity()
+    apply_update(entity, _proposed(organizations=["Item:OSWb"]), {"organizations"})
+    assert entity.__iris__["organization"] == ["Item:OSWb"]
+
+
+def test_apply_update_clears_website():
+    entity = _entity()
+    entity.website = {"https://x"}
+    apply_update(entity, _proposed(websites=[]), {"websites"})
+    assert entity.website == set()

tests/tools/test_user_sync_sync.py

@@ -96,6 +96,8 @@ def test_dry_run_previews_without_writing():
     joined = "\n".join(io.outputs)
     assert ORCID in joined
     assert "new=1" in joined  # bot excluded, only the ORCID user
+    assert report.missing_email == [ORCID]  # record has no email
+    assert "no ORCID email" in joined
 
 
 def test_requires_connection():