update

backend/src/controllers/auth.controller.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import authentikService from '../services/authentik.service';
 import tokenService from '../services/token.service';
 import userService from '../services/user.service';
+import memberService from '../services/member.service';
 import logger from '../utils/logger';
 import auditService, { AuditAction, AuditResourceType } from '../services/audit.service';
 import { extractIp, extractUserAgent } from '../middleware/audit.middleware';
@@ -119,6 +120,7 @@ class AuthController {
         });
 
         await userService.updateGroups(user.id, groups);
+        await memberService.ensureProfileExists(user.id);
 
         // Audit: first-ever login (user record creation)
         auditService.logAudit({
@@ -142,6 +144,7 @@ class AuthController {
 
         await userService.updateLastLogin(user.id);
         await userService.updateGroups(user.id, groups);
+        await memberService.ensureProfileExists(user.id);
 
         const { given_name: updatedGivenName, family_name: updatedFamilyName } = extractNames(userInfo);
 

backend/src/services/member.service.ts

@@ -544,6 +544,24 @@ class MemberService {
     }
   }
 
+  /**
+   * Ensures a mitglieder_profile row exists for the given user.
+   * Safe to call on every login — idempotent via ON CONFLICT DO NOTHING.
+   * Errors are caught and logged without throwing.
+   */
+  async ensureProfileExists(userId: string): Promise<void> {
+    try {
+      await pool.query(
+        `INSERT INTO mitglieder_profile (user_id, status)
+         VALUES ($1, 'aktiv')
+         ON CONFLICT (user_id) DO NOTHING`,
+        [userId]
+      );
+    } catch (error) {
+      logger.warn('ensureProfileExists failed (non-fatal)', { error, userId });
+    }
+  }
+
   /**
    * Returns aggregate member counts, used by the dashboard KPI cards.
    * Optionally scoped to a single status value.