$oidc = MediaWikiServices::getInstance()->getService( 'IsekaiOIDC.Service' );
$user = $oidc->findUserBySubject( $subject );
$subject = $oidc->getSubjectByUserId( $userId );
$subjects = $oidc->getSubjectsByUserIds( $userIds );
$status = $oidc->updateUserProfile( $user, [ 'email' => $email, 'realname' => $name ] );
$avatar = $oidc->getAvatarUrl( $user, 128 );
$avatars = $oidc->getAvatarUrls( $users, 128 );

Identity lookup returns null when there is no binding. Invalid subjects, ambiguous bindings, unavailable tables, and bindings to missing users throw Isekai\OIDC\Service\OidcIdentityException. Subject resolution reads the primary database. Identity methods do not retrieve access or refresh tokens.

Profile updates accept explicit email, realname, and phone fields. Missing, null, and empty fields preserve existing values. Phone supplies the existing synthetic email fallback and is not stored separately. Valid synchronized email addresses are confirmed, as in the authentication flow. Only trusted server-side callers should supply profile data. The result value indicates whether settings changed. Authentication session and token handling remain in the auth provider.

Avatar methods return this OIDC provider's URLs or null/missing entries when it cannot provide one. They do not invoke Isekai::GetUsersAvatar. For aggregate avatar selection, continue invoking that hook; its signature and provider merge behavior are preserved. ApiOIDCAvatar continues to use the hook.

Util/AccountMappingUtil.php contains internal migration, username allocation, and binding operations. Util/KeycloakWebhookUtil.php validates signatures and normalizes profile update events. Neither utility is registered as a public MediaWiki service. The previous static identity/profile helpers on IsekaiOIDCAuth have been replaced by the public service methods above.

IsekaiServiceBridge resolves OIDC identities through this service and translates OIDC exceptions into its existing API error codes. It returns oidc_unavailable when IsekaiOIDC is not loaded.

Verification

From the MediaWiki maintenance directory:

php run.php validateRegistrationFile ../extensions/IsekaiOIDC/extension.json
php run.php ../extensions/IsekaiOIDC/tests/ServiceIntegration.php --conf ../extensions/IsekaiOIDC/tests/LocalSettings.php

The test configuration loads the site's normal settings and enables OIDC only for the CLI run. Full tests use the existing ServiceBridge fixture file and roll back temporary database bindings. Profile tests use an in-memory persistence spy. Add --skip-db to run service wiring, profile, and webhook checks when the database is unavailable.