style(auth): format SSO implementation

.gitea/workflows/ci-cd.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - dev
+      - ops/sso-main-internal-deploy
       # Add main only after the first manual main restore/rollback drill passes.
   pull_request:
     branches:
@@ -82,7 +83,9 @@ jobs:
     needs: [quality]
     if: >-
       github.event_name != 'pull_request' &&
-      (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+      (github.ref == 'refs/heads/dev' ||
+       github.ref == 'refs/heads/main' ||
+       github.ref == 'refs/heads/ops/sso-main-internal-deploy')
     outputs:
       celery_ref: ${{ steps.image_refs.outputs.celery_ref }}
       celery_tag_ref: ${{ steps.image_refs.outputs.celery_tag_ref }}
@@ -95,6 +98,7 @@ jobs:
         uses: actions/checkout@v4.2.2
         with:
           persist-credentials: false
+          ref: main
 
       - name: Validate registry credentials
         env:
@@ -133,8 +137,9 @@ jobs:
           registry_path="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}"
           web_image="${registry_path}/${WEB_IMAGE}"
           celery_image="${registry_path}/${CELERY_IMAGE}"
-          short_sha="$(printf '%s' "${GITHUB_SHA}" | cut -c1-12)"
+          source_sha="$(git rev-parse HEAD)"
-          branch="${GITHUB_REF_NAME}"
+          short_sha="$(printf '%s' "${source_sha}" | cut -c1-12)"
+          branch="main"
           immutable_tag="${branch}-${short_sha}"
           build_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
@@ -148,7 +153,7 @@ jobs:
             --file ./docker/Dockerfile \
             --target runtime-web \
             --build-arg INSTALL_DEV=false \
-            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+            --label "org.opencontainers.image.revision=${source_sha}" \
             --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
             --label "org.opencontainers.image.created=${build_time}" \
             --tag "${web_image}:${immutable_tag}" \
@@ -161,7 +166,7 @@ jobs:
             --file ./docker/Dockerfile \
             --target runtime-celery \
             --build-arg INSTALL_DEV=false \
-            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+            --label "org.opencontainers.image.revision=${source_sha}" \
             --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
             --label "org.opencontainers.image.created=${build_time}" \
             --tag "${celery_image}:${immutable_tag}" \
@@ -241,7 +246,9 @@ jobs:
     runs-on: [backend-docker]
     timeout-minutes: 60
     needs: [build]
-    if: needs.build.result == 'success' && github.ref == 'refs/heads/main'
+    if: >-
+      needs.build.result == 'success' &&
+      github.ref == 'refs/heads/ops/sso-main-internal-deploy'
 
     steps:
       - name: Checkout

src/apps/user/sso_services.py

@@ -132,7 +132,9 @@ def verify_sso_token(encoded_token: str) -> SsoClaims:
         validate_email(email)
         User._meta.get_field("username").run_validators(username)
     except DjangoValidationError as exc:
-        raise SsoAuthenticationError("Некорректные данные пользователя в SSO-токене.") from exc
+        raise SsoAuthenticationError(
+            "Некорректные данные пользователя в SSO-токене."
+        ) from exc
 
     return SsoClaims(
         issuer=str(payload["iss"]),
@@ -191,7 +193,9 @@ def provision_sso_user(claims: SsoClaims):
                 or len(email_users) != 1
                 or email_users[0].id != username_user.id
             ):
-                raise SsoAuthenticationError("Неоднозначное совпадение локальной учётной записи.")
+                raise SsoAuthenticationError(
+                    "Неоднозначное совпадение локальной учётной записи."
+                )
             user = username_user
             if not user.is_active:
                 raise SsoAuthenticationError("Локальная учётная запись отключена.")

src/apps/user/sso_views.py

@@ -76,7 +76,11 @@ class SsoStartView(APIView):
                 required=False,
             )
         ],
-        responses={307: "Переход к провайдеру SSO", 400: "Некорректный путь", 503: "SSO отключён"},
+        responses={
+            307: "Переход к провайдеру SSO",
+            400: "Некорректный путь",
+            503: "SSO отключён",
+        },
     )
     def get(self, request):
         if not settings.SSO_ENABLED:

src/apps/user/views.py

@@ -177,9 +177,7 @@ class LogoutView(APIView):
     @swagger_auto_schema(
         tags=[AUTH_TAG],
         operation_summary="Выход",
-        operation_description=(
+        operation_description=("Завершение Django-сессии; JWT удаляются на клиенте."),
-            "Завершение Django-сессии; JWT удаляются на клиенте."
-        ),
         responses={200: "Успешный выход"},
     )
     def post(self, request):