From e70fab777095f25367100752f6656c1e3955a3fa Mon Sep 17 00:00:00 2001
From: robinvandermolen <robin@maykinmedia.nl>
Date: Wed, 18 Dec 2024 09:41:18 +0100
Subject: [PATCH] :sparkles: [#4863] Allow authentication with employee_id

---
 src/openforms/authentication/models.py | 17 +++++++++++++++++
 src/openforms/authentication/types.py  | 12 ++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/src/openforms/authentication/models.py b/src/openforms/authentication/models.py
index 940bb467b1..fd27cc55bd 100644
--- a/src/openforms/authentication/models.py
+++ b/src/openforms/authentication/models.py
@@ -20,6 +20,7 @@
     DigiDMachtigenContext,
     EHerkenningContext,
     EHerkenningMachtigenContext,
+    EmployeeContext,
 )
 
 logger = logging.getLogger(__name__)
@@ -254,6 +255,7 @@ def to_auth_context_data(
         | DigiDMachtigenContext
         | EHerkenningContext
         | EHerkenningMachtigenContext
+        | EmployeeContext
     ):
         if self.attribute_hashed:
             logger.debug(
@@ -347,6 +349,21 @@ def to_auth_context_data(
                         "branchNumber"
                     ] = branch_number
                 return ehm_context
+
+            # Experimental feature that is different from the defined authentication context.
+            # This will have to be re-worked and re-thought-out, and will most definitely change.
+            # This is a fix for #4863
+            case (AuthAttribute.employee_id, ""):
+                employee_context: EmployeeContext = {
+                    "source": "custom",
+                    "levelOfAssurance": self.loa,
+                    "representee": {
+                        "identifierType": "employee_id",
+                        "identifier": self.value,
+                    },
+                }
+                return employee_context
+
             case _:  # pragma: no cover
                 raise RuntimeError(f"Unknown attribute: {self.attribute}")
 
diff --git a/src/openforms/authentication/types.py b/src/openforms/authentication/types.py
index 96da16bb45..62e1dfad5b 100644
--- a/src/openforms/authentication/types.py
+++ b/src/openforms/authentication/types.py
@@ -80,3 +80,15 @@ class EHMandate(TypedDict):
 class EHerkenningMachtigenContext(EHerkenningContext):
     representee: EHRepresenteeEntity
     mandate: EHMandate
+
+
+class EmployeeRepresenteeEntity(TypedDict):
+    identifierType: Literal["employee_id"]
+    identifier: str
+
+
+# This type definition is highly experimental, and will most definitely change
+class EmployeeContext(TypedDict):
+    source: Literal["custom"]
+    levelOfAssurance: None
+    representee: EmployeeRepresenteeEntity