From 24415ee42790e2d3b797855c025fd80f7e4f0b75 Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Mon, 22 Jun 2026 12:08:20 +0800
Subject: [PATCH] Track forwarded users in online presence

---
 tests/test_web_observability.py | 27 +++++++++++++++++++++++++++
 web/auth/guards.py              |  2 ++
 2 files changed, 29 insertions(+)

diff --git a/tests/test_web_observability.py b/tests/test_web_observability.py
index d6fdd0ee..fb1b5470 100644
--- a/tests/test_web_observability.py
+++ b/tests/test_web_observability.py
@@ -3866,6 +3866,33 @@ def test_backend_entitlement_token_binds_forwarded_supabase_identity(monkeypatch
     assert request.state.auth_email == "user@example.com"
 
 
+def test_backend_entitlement_token_records_forwarded_supabase_activity(monkeypatch):
+    import src.utils.online_tracker as online_tracker
+
+    recorded = []
+    monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "enabled", True)
+    monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "supabase_url", "https://example.supabase.co")
+    monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "anon_key", "anon-key")
+    monkeypatch.setattr(web_core, "_SUPABASE_AUTH_REQUIRED", True)
+    monkeypatch.setattr(web_core, "_ENTITLEMENT_TOKEN", "backend-token")
+    monkeypatch.setattr(online_tracker, "record_activity", recorded.append)
+
+    request = Request(
+        {
+            "type": "http",
+            "headers": [
+                (b"x-polyweather-entitlement", b"backend-token"),
+                (b"x-polyweather-auth-user-id", b"user-1"),
+                (b"x-polyweather-auth-email", b"user@example.com"),
+            ],
+        }
+    )
+
+    web_core._assert_entitlement(request)
+
+    assert recorded == ["user-1"]
+
+
 def test_backend_entitlement_token_without_forwarded_identity_validates_bearer(monkeypatch):
     monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "enabled", True)
     monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "supabase_url", "https://example.supabase.co")
diff --git a/web/auth/guards.py b/web/auth/guards.py
index ddc8c7c3..a65bccd2 100644
--- a/web/auth/guards.py
+++ b/web/auth/guards.py
@@ -63,6 +63,8 @@ def _bind_forwarded_supabase_identity(request: Request) -> bool:
     request.state.auth_email = str(
         request.headers.get(_FORWARDED_SUPABASE_EMAIL_HEADER) or ""
     ).strip()
+    from src.utils.online_tracker import record_activity
+    record_activity(forwarded_user_id)
     return True