Make Gitea publishing claimant controlled

thinkstorm/auth.py

@@ -72,10 +72,20 @@ def get_or_create_gitea_user(gitea_user_data: Dict[str, Any]) -> User:
     with get_db() as conn:
         row = conn.execute("SELECT id, username, password_hash, role, created_at FROM users WHERE username = ? OR gitea_id = ?", (username, gitea_id)).fetchone()
         if row:
-            # Update role if promoted
-            if is_gitea_admin and row["role"] != "ADMIN":
-                conn.execute("UPDATE users SET role = 'ADMIN' WHERE id = ?", (row["id"],))
-            return User(id=row["id"], username=row["username"], password_hash=row["password_hash"], role=role, created_at=row["created_at"])
+            # Record the verified Gitea identity when an existing local account links
+            # through OAuth, and promote the role when appropriate.
+            resolved_role = "ADMIN" if is_gitea_admin else row["role"]
+            conn.execute(
+                "UPDATE users SET gitea_id = ?, role = ? WHERE id = ?",
+                (gitea_id, resolved_role, row["id"])
+            )
+            return User(
+                id=row["id"],
+                username=row["username"],
+                password_hash=row["password_hash"],
+                role=UserRole(resolved_role),
+                created_at=row["created_at"]
+            )
         
         # Insert new user
         dummy_pass = hash_password(secrets.token_hex(16))