Enrich professor profiles and harden client policy

src/SGU.AuthBroker/Services/NtlmCredentialValidator.cs

@@ -325,15 +325,19 @@ public sealed class NtlmCredentialValidator : INtlmCredentialValidator
                         response,
                         identity,
                         timeout.Token).ConfigureAwait(false);
-                    if (identity.Role == InstitutionalRole.Administrative &&
-                        string.Equals(
-                            profile?.EmployeeNumber,
-                            identity.NumericId,
-                            StringComparison.Ordinal))
+                    bool mayEnrichStaffProfile =
+                        (identity.Role == InstitutionalRole.Administrative &&
+                         string.Equals(
+                             profile?.EmployeeNumber,
+                             identity.NumericId,
+                             StringComparison.Ordinal)) ||
+                        (identity.Role == InstitutionalRole.Professor && profile is not null);
+                    if (mayEnrichStaffProfile)
                     {
-                        profile = await TryEnrichAdministrativeProfileAsync(
+                        profile = await TryEnrichStaffProfileAsync(
                             client,
                             profile!,
+                            identity.Role,
                             allowedHosts,
                             timeout.Token,
                             cancellationToken,
@@ -394,15 +398,16 @@ public sealed class NtlmCredentialValidator : INtlmCredentialValidator
         return null;
     }
 
-    private async Task<InstitutionalProfile> TryEnrichAdministrativeProfileAsync(
+    private async Task<InstitutionalProfile> TryEnrichStaffProfileAsync(
         HttpClient client,
-        InstitutionalProfile verifiedProfile,
+        InstitutionalProfile baseProfile,
+        InstitutionalRole role,
         HashSet<string> allowedHosts,
         CancellationToken timeoutToken,
         CancellationToken requestCancellationToken,
         Stopwatch elapsed)
     {
-        InstitutionalProfile profile = verifiedProfile;
+        InstitutionalProfile profile = baseProfile;
         (string Path, Func<string, InstitutionalProfile?> Parser)[] pages =
         [
             (options.AdministrativePersonalProfilePath, SguProfileParser.ParseAdministrativePersonal),
@@ -423,7 +428,8 @@ public sealed class NtlmCredentialValidator : INtlmCredentialValidator
             catch (OperationCanceledException) when (!requestCancellationToken.IsCancellationRequested)
             {
                 logger.LogWarning(
-                    "SGU administrative profile enrichment reached its total timeout after {ElapsedMilliseconds} ms; preserving fields already collected.",
+                    "SGU optional staff profile enrichment for role {Role} reached its total timeout after {ElapsedMilliseconds} ms; preserving fields already collected.",
+                    role,
                     elapsed.ElapsedMilliseconds);
                 break;
             }
@@ -431,7 +437,8 @@ public sealed class NtlmCredentialValidator : INtlmCredentialValidator
             {
                 logger.LogWarning(
                     exception,
-                    "An optional SGU administrative profile page failed after {ElapsedMilliseconds} ms; preserving fields already collected.",
+                    "An optional SGU staff profile page for role {Role} failed after {ElapsedMilliseconds} ms; preserving fields already collected.",
+                    role,
                     elapsed.ElapsedMilliseconds);
             }
         }