- Duplicate Authentik accounts now surfaced automatically: a "⚠ Doublons (N)"
filter chip + the warning badge itself is clickable to clean up (the 7 dup
people are status=ok, so they were hidden under the default orphan filter).
- "Horaire" button on rows with a tech reuses the SAME Planification schedule
module (TechScheduleDialog: recurring template + congés + pause) via a
/planification?sched=<tech_id> deep-link — no inferior rebuild.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
POST /auth/staff/dedupe {email}: keeps the used account (has last_login, else
oldest) and deletes ONLY never-logged-in duplicate Authentik records for that
email — safe (no sessions/history, ERPNext untouched since it's one User per
email). Console shows "Nettoyer le doublon" on flagged rows with a confirm.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- resolveEmployeeForEmail + /auth/staff now resolve the Employee through the
unified identity's aliases: louis@targo.ca finds HR-EMP-4 (under
louispaul@targointernet.com). Fixes "no employee linked" for Louis-Paul.
- /auth/staff collapses multiple Authentik accounts with the same email into one
row (username `joseph` + `joseph@...` → one), flags dup_accounts for cleanup.
- provision LINKS an existing Employee (match user_id → company_email → name)
instead of creating a duplicate — fixes the Aurélie HR-EMP-107 doublon risk.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Settings → Staff tab: one row per internal Authentik user with provisioning
state (active, groups, System User / Employee / Dispatch Technician / identity),
flagging orphan (active but no System User → not provisioned, e.g. Karim
Takougang), departed (inactive/identity-departed), ok.
Hub /auth/staff (GET reconciliation) + /auth/staff/provision (groups + System
User + Employee + Tech + identity in one click) + /auth/staff/active
(deactivate/reactivate, non-destructive) + /auth/staff/impact + guarded DELETE
(refuses with 409 if tickets/jobs reference the person → offers deactivate).
Writes admin-gated. identity.js gains programmatic upsert/setActive.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
