Multi-tenant SSO and account linking

"""Eight sign-ins through three ways of finding the account of a person who signs in through a company's identity provider.

Each sign-in arrives on one connection, and each connection belongs to one tenant and one identity provider. The tenant
comes from the connection the response arrived on, never from the response. A person's account is wrong in three ways: it
is shared with someone else, it is made twice for one person, or it belongs to another tenant."""

CONNECTIONS = {  # the connection a response arrived on -> its tenant and the issuer set up for it
    "acme-main": ("acme", "https://login.acme.example/saml"),
    "acme-merger": ("acme", "https://sso.merger.example/saml"),
    "globex-main": ("globex", "https://idp.globex.example/saml"),
}
# (what happens, the connection it arrives on, the subject, the email address, the person who really signed in)
SIGN_INS = [
    ("Asha signs in for the first time", "acme-main", "s-1", "asha@acme.example", "Asha"),
    ("Asha signs in again", "acme-main", "s-1", "asha@acme.example", "Asha"),
    ("Dev, whose provider also uses s-1", "acme-merger", "s-1", "dev@merger.example", "Dev"),
    ("Ravi signs in at Globex", "globex-main", "g-7", "ravi@partner.example", "Ravi"),
    ("Ravi signs in at Acme, same address", "acme-main", "s-4", "ravi@partner.example", "Ravi"),
    ("Asha's address changed, her subject not", "acme-main", "s-1", "asha.k@acme.example", "Asha"),
    ("A newcomer holds Asha's old address", "acme-main", "s-9", "asha@acme.example", "Newcomer"),
    ("A newcomer holds Asha's new address", "acme-main", "s-12", "asha.k@acme.example", "Newcomer 2"),
]


class Directory:
    def __init__(self):
        self.accounts = {}  # id -> {"tenant": ..., "email": ...}
        self.links = {}  # a key -> account id

    def create(self, tenant, email):
        account = f"a{len(self.accounts) + 1}"
        self.accounts[account] = {"tenant": tenant, "email": email}
        return account


def by_email(directory, connection, subject, email):
    for account, data in directory.accounts.items():
        if data["email"].lower() == email.lower():
            return account  # an account with this address exists: join it
    return directory.create(CONNECTIONS[connection][0], email)


def by_subject(directory, connection, subject, email):
    if subject not in directory.links:
        directory.links[subject] = directory.create(CONNECTIONS[connection][0], email)
    return directory.links[subject]


def by_tenant_issuer_subject(directory, connection, subject, email):
    tenant, issuer = CONNECTIONS[connection]
    key = (tenant, issuer, subject)
    if key in directory.links:
        account = directory.links[key]
        directory.accounts[account]["email"] = email  # the address is an attribute that can change
        return account
    if any(a["tenant"] == tenant and a["email"].lower() == email.lower() for a in directory.accounts.values()):
        return "held"  # an address is never a reason to join accounts: a person confirms or an administrator decides
    directory.links[key] = directory.create(tenant, email)
    return directory.links[key]


LINKERS = [("email", by_email), ("subject", by_subject), ("tenant, issuer, subject", by_tenant_issuer_subject)]
results = {}
for name, linker in LINKERS:
    directory = Directory()
    results[name] = (directory, [linker(directory, connection, subject, email) for _, connection, subject, email, _ in SIGN_INS])

print((f"{'sign-in':<40}" + "".join(f"{name:<26}" for name, _ in LINKERS)).rstrip())
for i, (what, *_) in enumerate(SIGN_INS):
    print((f"{what:<40}" + "".join(f"{results[name][1][i]:<26}" for name, _ in LINKERS)).rstrip())

print("\nwhat went wrong")
for name, _ in LINKERS:
    directory, outcome = results[name]
    placed = [(connection, person, account) for (_, connection, _, _, person), account in zip(SIGN_INS, outcome) if account != "held"]
    shared = len([a for a in directory.accounts if len({p for _, p, acc in placed if acc == a}) > 1])
    split = len({(p, CONNECTIONS[c][0]) for c, p, _ in placed if len({acc for c2, p2, acc in placed if p2 == p and CONNECTIONS[c2][0] == CONNECTIONS[c][0]}) > 1})
    foreign = len([1 for c, _, acc in placed if directory.accounts[acc]["tenant"] != CONNECTIONS[c][0]])
    held = outcome.count("held")
    print(f"  {name:<26}shared by two people: {shared}, one person with two accounts in a tenant: {split}, in another tenant: {foreign}, held: {held}")

sign-in                                 email                     subject                   tenant, issuer, subject
Asha signs in for the first time        a1                        a1                        a1
Asha signs in again                     a1                        a1                        a1
Dev, whose provider also uses s-1       a2                        a1                        a2
Ravi signs in at Globex                 a3                        a2                        a3
Ravi signs in at Acme, same address     a3                        a3                        a4
Asha's address changed, her subject not a4                        a1                        a1
A newcomer holds Asha's old address     a1                        a4                        a5
A newcomer holds Asha's new address     a4                        a5                        held

what went wrong
  email                     shared by two people: 2, one person with two accounts in a tenant: 1, in another tenant: 1, held: 0
  subject                   shared by two people: 1, one person with two accounts in a tenant: 0, in another tenant: 0, held: 0
  tenant, issuer, subject   shared by two people: 0, one person with two accounts in a tenant: 0, in another tenant: 0, held: 1