Handle wrong person following invitation link

If someone that already exists in greg follows an invite, we are kind enough to give the new role to the existing person. This introduced a security risk if the invitation was actually meant for someone else.

Because of this situation, we introduce a security mechanism where we disable the invitationlink if the name of the existing person is too different from the name used in the invitation.

Resolves: GREG-166

gregui/authentication/auth_backends.py

@@ -622,6 +622,13 @@ class GregOIDCBackend(ValidatingOIDCBackend):
                         not inv_person.registration_completed_date
                         and not name_diff_too_large(old_name, inv_name, 4)
                     ):
+                        logger.debug(
+                            "Invitation (%s) opened by existing person (%s)."
+                            " Giving role to them and deleting invited person (%s)",
+                            invitation_link.invitation.id,
+                            old_person.id,
+                            inv_person.id,
+                        )
                         # The name is close and the invited person has not completed
                         # registration. Give the role to the existing person, and
                         # delete the invited one.
@@ -632,6 +639,15 @@ class GregOIDCBackend(ValidatingOIDCBackend):
                     else:
                         # The logged in user has gotten someone else's invitation, and
                         # the invitation should be disabled.
+                        logger.warning(
+                            "Illegal person accessed invitation (%s). Invitation belongs to"
+                            " person id %s, but was access by person id %s. Expiring"
+                            " InvitationLink %s.",
+                            invitation_link.invitation.id,
+                            inv_person.id,
+                            old_person.id,
+                            invitation_link.id,
+                        )
                         invitation_link.expire = timezone.now()
                         invitation_link.save()
                 else: