From b22325588a84a2d54ef7af94c4b99d9e836f2600 Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@sunet.se>
Date: Thu, 12 Feb 2026 14:56:10 +0100
Subject: [PATCH] feat: add proquint-based userid generation

---
 src/fastapi_oidc_op/userid.py | 11 +++++++++++
 tests/test_userid.py          | 20 ++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 src/fastapi_oidc_op/userid.py
 create mode 100644 tests/test_userid.py

diff --git a/src/fastapi_oidc_op/userid.py b/src/fastapi_oidc_op/userid.py
new file mode 100644
index 0000000..6f5b871
--- /dev/null
+++ b/src/fastapi_oidc_op/userid.py
@@ -0,0 +1,11 @@
+import secrets
+
+from proquint import uint2quint
+
+
+def generate_userid() -> str:
+    """Generate a unique user identifier in proquint format.
+
+    Returns a 32-bit proquint string like 'lusab-bansen'.
+    """
+    return uint2quint(secrets.randbits(32))
diff --git a/tests/test_userid.py b/tests/test_userid.py
new file mode 100644
index 0000000..f46aaa8
--- /dev/null
+++ b/tests/test_userid.py
@@ -0,0 +1,20 @@
+from fastapi_oidc_op.userid import generate_userid
+
+
+def test_generate_userid_format() -> None:
+    userid = generate_userid()
+    # 32-bit proquint format: xxxxx-xxxxx
+    parts = userid.split("-")
+    assert len(parts) == 2
+    for part in parts:
+        assert len(part) == 5
+
+
+def test_generate_userid_uniqueness() -> None:
+    ids = {generate_userid() for _ in range(100)}
+    assert len(ids) == 100  # All unique
+
+
+def test_generate_userid_is_lowercase() -> None:
+    userid = generate_userid()
+    assert userid == userid.lower()