✨(provisioning) expose oidc_autojoin and identity_sync flags

src/backend/core/api/serializers.py

@@ -1808,6 +1808,8 @@ class ProvisioningMailDomainSerializer(serializers.Serializer):
 
     domains = DomainsField()
     custom_attributes = serializers.JSONField(required=False, default=dict)
+    oidc_autojoin = serializers.BooleanField(required=False, default=True)
+    identity_sync = serializers.BooleanField(required=False, default=False)
 
     def create(self, validated_data):
         """This serializer is only used to validate the data, not to create or update."""

src/backend/core/api/viewsets/provisioning.py

@@ -32,6 +32,8 @@ class ProvisioningMailDomainView(APIView):
 
         domains = serializer.validated_data["domains"]
         custom_attributes = serializer.validated_data.get("custom_attributes", {})
+        oidc_autojoin = serializer.validated_data["oidc_autojoin"]
+        identity_sync = serializer.validated_data["identity_sync"]
 
         created = []
         existing = []
@@ -41,13 +43,26 @@ class ProvisioningMailDomainView(APIView):
             try:
                 domain, was_created = MailDomain.objects.get_or_create(
                     name=domain_name,
-                    defaults={"custom_attributes": custom_attributes},
+                    defaults={
+                        "custom_attributes": custom_attributes,
+                        "oidc_autojoin": oidc_autojoin,
+                        "identity_sync": identity_sync,
+                    },
                 )
                 if was_created:
                     created.append(domain_name)
                 else:
+                    updated = False
                     if domain.custom_attributes != custom_attributes:
                         domain.custom_attributes = custom_attributes
+                        updated = True
+                    if domain.oidc_autojoin != oidc_autojoin:
+                        domain.oidc_autojoin = oidc_autojoin
+                        updated = True
+                    if domain.identity_sync != identity_sync:
+                        domain.identity_sync = identity_sync
+                        updated = True
+                    if updated:
                         domain.save()
                     existing.append(domain_name)
             except ValidationError as e:

src/backend/core/tests/api/test_provisioning_maildomains.py

@@ -216,3 +216,94 @@ def test_provisioning_missing_domains_returns_400(client, url, auth_header):
         **auth_header,
     )
     assert response.status_code == 400
+
+
+# -- oidc_autojoin and identity_sync tests --
+
+
+@pytest.mark.django_db
+def test_provisioning_default_oidc_autojoin_true(client, url, auth_header):
+    """oidc_autojoin defaults to True when not provided."""
+    response = client.post(
+        url,
+        data={"domains": ["autojoin.fr"]},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="autojoin.fr")
+    assert domain.oidc_autojoin is True
+
+
+@pytest.mark.django_db
+def test_provisioning_default_identity_sync_false(client, url, auth_header):
+    """identity_sync defaults to False when not provided."""
+    response = client.post(
+        url,
+        data={"domains": ["sync.fr"]},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="sync.fr")
+    assert domain.identity_sync is False
+
+
+@pytest.mark.django_db
+def test_provisioning_explicit_oidc_autojoin_false(client, url, auth_header):
+    """oidc_autojoin can be explicitly set to False."""
+    response = client.post(
+        url,
+        data={"domains": ["nojoin.fr"], "oidc_autojoin": False},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="nojoin.fr")
+    assert domain.oidc_autojoin is False
+
+
+@pytest.mark.django_db
+def test_provisioning_explicit_identity_sync_true(client, url, auth_header):
+    """identity_sync can be explicitly set to True."""
+    response = client.post(
+        url,
+        data={"domains": ["synced.fr"], "identity_sync": True},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="synced.fr")
+    assert domain.identity_sync is True
+
+
+@pytest.mark.django_db
+def test_provisioning_updates_oidc_autojoin_on_existing(client, url, auth_header):
+    """oidc_autojoin is updated on existing domains when it differs."""
+    MailDomainFactory(name="existing.fr", oidc_autojoin=True)
+
+    response = client.post(
+        url,
+        data={"domains": ["existing.fr"], "oidc_autojoin": False},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="existing.fr")
+    assert domain.oidc_autojoin is False
+
+
+@pytest.mark.django_db
+def test_provisioning_updates_identity_sync_on_existing(client, url, auth_header):
+    """identity_sync is updated on existing domains when it differs."""
+    MailDomainFactory(name="existing.fr", identity_sync=False)
+
+    response = client.post(
+        url,
+        data={"domains": ["existing.fr"], "identity_sync": True},
+        content_type="application/json",
+        **auth_header,
+    )
+    assert response.status_code == 200
+    domain = MailDomain.objects.get(name="existing.fr")
+    assert domain.identity_sync is True