[LFXV2-587] User metadata READ - Auth0#6
Merged
mauriciozanettisalomao merged 7 commits intolinuxfoundation:mainfrom Sep 29, 2025
Conversation
- Introduced a new message handler method to retrieve user metadata based on input strategy. - Updated message handler and user reader interfaces to support the new user metadata retrieval feature. - Enhanced error handling and logging in various components. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Generated with [Cursor](https://cursor.com/) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
- Added detailed sections for user metadata retrieval, including lookup strategies and request/response formats. - Introduced a new README file for Auth0 integration, outlining user management operations and lookup strategies. - Updated mock user data to include 'sub' fields and adjusted user retrieval logic to support multiple identifiers. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Generated with [Cursor](https://cursor.com/) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
- Introduced new tests for the PrepareForMetadataLookup method, covering various input scenarios including canonical and search lookups, whitespace handling, and idempotency. - Enhanced the message handler tests to validate user metadata retrieval based on different lookup strategies, ensuring correct preparation of user fields and error handling for edge cases. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Generated with [Cursor](https://cursor.com/) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
…' package - Updated the user.go file to replace all instances of the 'errs' package with the 'errors' package for consistency in error handling. - Ensured that all error messages remain intact while improving code clarity and maintainability. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdds a NATS-backed "user metadata retrieval" flow (subject Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Client
participant NATS as NATS\n`lfx.auth-service.user_metadata.read`
participant MH as MessageHandler\nOrchestrator
participant Reader as UserReader\n(Mock or Auth0)
participant IdP as IdentityProvider/API
Client->>NATS: Publish { input }
NATS->>MH: Deliver message
MH->>MH: PrepareForMetadataLookup(input)
alt Canonical (input contains "|")
MH->>Reader: GetUser(by sub/user_id)
else Search (no "|")
MH->>Reader: SearchUser(by username/email)
end
Reader->>IdP: Fetch user data
IdP-->>Reader: User or NotFound/Error
alt Success
Reader-->>MH: User { UserMetadata }
MH-->>NATS: Reply { data: UserMetadata }
else NotFound / Error
Reader-->>MH: Error
MH-->>NATS: Reply { error }
end
NATS-->>Client: Response
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches🧪 Generate unit tests
Comment |
There was a problem hiding this comment.
Pull Request Overview
Implements the lfx.auth-service.user_metadata.read NATS endpoint to fetch user metadata from Auth0 with hybrid user identification, supporting both canonical (sub) lookup and username-based convenience lookup.
Key changes:
- Added hybrid lookup logic with canonical
sublookup for identifiers containing|and username lookup for simple strings - Implemented comprehensive error handling for non-existent users and Auth0 API failures
- Enhanced mock infrastructure to support the new lookup strategies with proper Auth0-style user IDs
Reviewed Changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/service/message_handler.go | Core implementation of GetUserMetadata with hybrid lookup strategy |
| internal/domain/model/user.go | Added PrepareForMetadataLookup method and Sub field for canonical lookups |
| internal/infrastructure/auth0/user.go | Enhanced Auth0 integration with improved error handling and search logic |
| internal/infrastructure/mock/user.go | Updated mock implementation to support multiple lookup keys and proper error responses |
| pkg/constants/subjects.go | Added UserMetadataReadSubject constant |
| cmd/server/service/providers.go | Registered new NATS subject subscription |
| internal/service/message_handler_test.go | Comprehensive test suite for GetUserMetadata functionality |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
internal/domain/model/auth0.go (1)
68-73: Populate the canonicalsubon domain users
Auth0User.user_idis the canonical Auth0 subject. We now exposeUser.Subprecisely so callers of the new metadata read flow can return that identifier, yetToUser()leaves it empty. This breaks the PR requirement that every response include the canonical sub. Please propagateuser_idintoUser.Subwhen building the domain object.return &User{ - UserID: u.UserID, + UserID: u.UserID, + Sub: u.UserID, Username: u.Username, PrimaryEmail: u.Email, UserMetadata: meta, }pkg/httpclient/request.go (1)
124-140: Preserve response body in returned errorSwitching to
errors.NewUnexpectedis fine, but we now strip the response body from the returned error. Callers currently rely on the body to surface Auth0 details (e.g.,{"error":"not_found","message":"The user does not exist."}) for diagnostics and user-facing messaging; losing it collapses every 4xx/5xx into “API returned error / status code: XYZ”. Please keep the body in the wrapped error (while still usingNewUnexpected) so downstream handlers retain actionable context.- return response.StatusCode, errors.NewUnexpected("API returned error", fmt.Errorf("status code: %d", response.StatusCode)) + return response.StatusCode, errors.NewUnexpected( + "API returned error", + fmt.Errorf("status code: %d", response.StatusCode), + fmt.Errorf("body: %s", string(response.Body)), + )internal/infrastructure/mock/user.go (1)
126-199: Keep mock user aliases in sync after updates
Because Line 174 only reindexes the entry keyed by the identifier used in the update, every other alias (user_id, sub, username, primary email) still points to the pre-update struct. Updating via the canonical sub and then reading via username will therefore return stale metadata. Please re-index the user under all aliases both when inserting and when patching so the mock matches real Auth0 behavior.func loadUsersFromYAML(ctx context.Context) ([]*model.User, error) { @@ } +func collectUserAliases(user *model.User) []string { + return []string{ + user.UserID, + user.Sub, + user.Username, + user.PrimaryEmail, + } +} + func (u *userWriter) GetUser(ctx context.Context, user *model.User) (*model.User, error) { @@ if !exists { - // If user doesn't exist, create a new one with the provided data - u.users[key] = user + // If user doesn't exist, index the provided data under all known identifiers + for _, alias := range collectUserAliases(user) { + if alias != "" { + u.users[alias] = user + } + } slog.InfoContext(ctx, "mock: new user created in storage", "key", key) return user, nil } @@ - // Store the updated user back to storage - u.users[key] = &updatedUser + // Store the updated user back to storage under every alias so subsequent lookups stay in sync + for _, alias := range collectUserAliases(&updatedUser) { + if alias != "" { + u.users[alias] = &updatedUser + } + }
🧹 Nitpick comments (1)
README.md (1)
95-204: Fix markdown heading order and specify fenced languagesHeading level jumps from
###to###/#####, and several fenced blocks lack language hints. markdownlint flags this (MD001, MD040). Please adjust heading levels incrementally (e.g., drop#####to####) and add languages likebash/json/textto the fences to keep lint clean and docs consistent.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (17)
README.md(1 hunks)charts/lfx-v2-auth-service/Chart.yaml(1 hunks)cmd/server/service/message_handler.go(1 hunks)cmd/server/service/providers.go(1 hunks)internal/domain/model/auth0.go(1 hunks)internal/domain/model/user.go(3 hunks)internal/domain/model/user_test.go(1 hunks)internal/domain/port/message_handler.go(1 hunks)internal/infrastructure/auth0/README.md(1 hunks)internal/infrastructure/auth0/user.go(5 hunks)internal/infrastructure/mock/README.md(1 hunks)internal/infrastructure/mock/user.go(5 hunks)internal/infrastructure/mock/users.yaml(3 hunks)internal/service/message_handler.go(1 hunks)internal/service/message_handler_test.go(1 hunks)pkg/constants/subjects.go(1 hunks)pkg/httpclient/request.go(2 hunks)
🧰 Additional context used
🧠 Learnings (9)
📓 Common learnings
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/domain/model/auth0.go:37-53
Timestamp: 2025-09-25T23:40:05.652Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to expand the Auth0UserMetadata struct with additional attributes in upcoming PRs to preserve all supported metadata fields during Auth0User to User conversion, addressing the current subset limitation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#2
File: internal/infrastructure/auth0/user.go:16-21
Timestamp: 2025-09-19T17:04:25.227Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to redact sensitive user information (tokens, emails, metadata) from logs and use appropriate log levels during the actual Auth0 and Authelia implementation, rather than in the current stub/placeholder code.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:25-27
Timestamp: 2025-09-22T14:09:28.381Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has explicitly chosen to only allow the "update:current_user_metadata" scope for user metadata updates, rejecting the suggestion to also allow "create:current_user_metadata" scope. This is an intentional design decision to be more restrictive with scope permissions.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:31-36
Timestamp: 2025-09-25T23:40:48.086Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has deferred updating the username search pattern from `users?q=identities.user_id:%s&search_engine=v3` to `users?q=username:%s&search_engine=v3` to upcoming PRs, as the username search functionality is not currently being used.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:201-209
Timestamp: 2025-09-22T14:40:04.765Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has chosen to defer implementing response body redaction for Auth0 Management API error logging to upcoming PRs, acknowledging the security concern but prioritizing it for later implementation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: pkg/httpclient/request.go:135-142
Timestamp: 2025-09-25T21:21:02.370Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has confirmed that Auth0 API error responses do not contain sensitive data, so full response body logging in error cases is acceptable without truncation or redaction.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:157-163
Timestamp: 2025-09-22T14:40:52.872Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has chosen to defer implementing PII redaction for request body logging in the Auth0 Management API calls to upcoming PRs, acknowledging the security concern but prioritizing it for later implementation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:186-0
Timestamp: 2025-09-25T22:18:16.674Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to avoid implementing email search fallbacks when the primary users-by-email endpoint returns zero results. The service should return "user not found" directly rather than attempting secondary search queries, prioritizing implementation simplicity over handling Auth0 eventual consistency edge cases.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:164-0
Timestamp: 2025-09-25T22:24:27.863Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to keep the SearchUser method implementation without domain validation checks, even though GetUser and UpdateUser methods include such validation. The maintainer is satisfied with the current simpler approach for the SearchUser method.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:45-115
Timestamp: 2025-09-22T14:10:36.430Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to defer implementing full JWT signature validation using JWKS for future improvements, keeping the current ParseUnverified approach for now.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#2
File: cmd/server/service/providers.go:82-87
Timestamp: 2025-09-19T17:03:39.074Z
Learning: In the LFX v2 Auth Service, the default USER_REPOSITORY_TYPE will be changed from mock to auth0 in upcoming PRs for production safety.
📚 Learning: 2025-09-19T17:05:21.230Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#2
File: internal/infrastructure/mock/user.go:47-69
Timestamp: 2025-09-19T17:05:21.230Z
Learning: The mock user implementation in internal/infrastructure/mock/user.go uses fantasy/fake user data (like "zephyr.stormwind", "aurora.moonbeam") for development and testing purposes, so logging full user objects is acceptable in this context.
Applied to files:
internal/domain/model/user_test.gointernal/infrastructure/mock/README.mdinternal/infrastructure/mock/user.gointernal/infrastructure/mock/users.yamlinternal/service/message_handler_test.go
📚 Learning: 2025-09-25T21:12:31.852Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: charts/lfx-v2-auth-service/values.yaml:38-43
Timestamp: 2025-09-25T21:12:31.852Z
Learning: In the LFX v2 Auth Service Helm chart, mauriciozanettisalomao uses a development vs production security approach: AUTH0_PRIVATE_BASE64_KEY is stored as inline env values for local development convenience, but production environments will use `valueFrom.secretKeyRef` to properly manage the Auth0 private key via Kubernetes Secrets.
Applied to files:
charts/lfx-v2-auth-service/Chart.yaml
📚 Learning: 2025-09-25T23:40:05.652Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/domain/model/auth0.go:37-53
Timestamp: 2025-09-25T23:40:05.652Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to expand the Auth0UserMetadata struct with additional attributes in upcoming PRs to preserve all supported metadata fields during Auth0User to User conversion, addressing the current subset limitation.
Applied to files:
internal/infrastructure/mock/users.yamlinternal/infrastructure/auth0/README.mdinternal/domain/model/auth0.goREADME.md
📚 Learning: 2025-09-19T17:03:39.074Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#2
File: cmd/server/service/providers.go:82-87
Timestamp: 2025-09-19T17:03:39.074Z
Learning: In the LFX v2 Auth Service, the default USER_REPOSITORY_TYPE will be changed from mock to auth0 in upcoming PRs for production safety.
Applied to files:
internal/infrastructure/auth0/README.md
📚 Learning: 2025-09-25T22:18:16.674Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:186-0
Timestamp: 2025-09-25T22:18:16.674Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to avoid implementing email search fallbacks when the primary users-by-email endpoint returns zero results. The service should return "user not found" directly rather than attempting secondary search queries, prioritizing implementation simplicity over handling Auth0 eventual consistency edge cases.
Applied to files:
internal/infrastructure/auth0/README.md
📚 Learning: 2025-09-25T21:21:02.370Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: pkg/httpclient/request.go:135-142
Timestamp: 2025-09-25T21:21:02.370Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has confirmed that Auth0 API error responses do not contain sensitive data, so full response body logging in error cases is acceptable without truncation or redaction.
Applied to files:
internal/infrastructure/auth0/README.md
📚 Learning: 2025-09-25T22:24:27.863Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:164-0
Timestamp: 2025-09-25T22:24:27.863Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to keep the SearchUser method implementation without domain validation checks, even though GetUser and UpdateUser methods include such validation. The maintainer is satisfied with the current simpler approach for the SearchUser method.
Applied to files:
internal/infrastructure/auth0/README.md
📚 Learning: 2025-09-22T14:09:28.381Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:25-27
Timestamp: 2025-09-22T14:09:28.381Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has explicitly chosen to only allow the "update:current_user_metadata" scope for user metadata updates, rejecting the suggestion to also allow "create:current_user_metadata" scope. This is an intentional design decision to be more restrictive with scope permissions.
Applied to files:
README.md
🧬 Code graph analysis (10)
internal/domain/model/user_test.go (1)
internal/domain/model/user.go (2)
User(14-21)UserMetadata(24-39)
internal/domain/port/message_handler.go (1)
internal/domain/port/transport_messenger.go (1)
TransportMessenger(7-11)
internal/service/message_handler.go (4)
internal/domain/port/transport_messenger.go (1)
TransportMessenger(7-11)pkg/redaction/redaction.go (1)
Redact(22-42)internal/domain/model/user.go (2)
User(14-21)UserMetadata(24-39)pkg/constants/user.go (1)
CriteriaTypeUsername(10-10)
pkg/httpclient/request.go (1)
pkg/errors/server.go (1)
NewUnexpected(19-26)
cmd/server/service/providers.go (1)
pkg/constants/subjects.go (1)
UserMetadataReadSubject(21-21)
cmd/server/service/message_handler.go (1)
pkg/constants/subjects.go (1)
UserMetadataReadSubject(21-21)
internal/infrastructure/mock/user.go (1)
internal/domain/model/user.go (1)
User(14-21)
internal/domain/model/auth0.go (1)
internal/domain/model/user.go (2)
User(14-21)UserMetadata(24-39)
internal/service/message_handler_test.go (4)
internal/domain/model/user.go (2)
User(14-21)UserMetadata(24-39)pkg/converters/pointers.go (1)
StringPtr(7-9)pkg/constants/user.go (1)
CriteriaTypeUsername(10-10)internal/service/message_handler.go (1)
UserDataResponse(19-23)
internal/infrastructure/auth0/user.go (6)
pkg/constants/user.go (2)
CriteriaTypeEmail(8-8)CriteriaTypeUsername(10-10)pkg/redaction/redaction.go (2)
RedactEmail(54-72)Redact(22-42)pkg/errors/client.go (1)
NewNotFound(39-46)internal/domain/model/user.go (1)
User(14-21)pkg/errors/server.go (1)
NewUnexpected(19-26)internal/domain/model/auth0.go (1)
Auth0User(7-16)
🪛 markdownlint-cli2 (0.18.1)
internal/infrastructure/auth0/README.md
25-25: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
47-47: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
README.md
104-104: Heading levels should only increment by one level at a time
Expected: h4; Actual: h5
(MD001, heading-increment)
132-132: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
137-137: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: MegaLinter
- Enhanced the README to specify HTTP request formatting for Auth0 Management API calls. - Clarified comments in user.go regarding the behavior of identity searches, emphasizing the use of an IN clause instead of AND. - Updated error handling in request.go to properly return status codes for retryable errors. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Reviewed with [GitHub Copilot](https://github.com/features/copilot) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
- Removed the now unnecessary stringPtr helper function to streamline the code. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
- Changed the description of the canonical lookup from "authoritative identifier" to "subject identifier" for better clarity. - Updated example command in README to reflect the new terminology. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-587 Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
README.md(1 hunks)
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/domain/model/auth0.go:37-53
Timestamp: 2025-09-25T23:40:05.652Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to expand the Auth0UserMetadata struct with additional attributes in upcoming PRs to preserve all supported metadata fields during Auth0User to User conversion, addressing the current subset limitation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#2
File: internal/infrastructure/auth0/user.go:16-21
Timestamp: 2025-09-19T17:04:25.227Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to redact sensitive user information (tokens, emails, metadata) from logs and use appropriate log levels during the actual Auth0 and Authelia implementation, rather than in the current stub/placeholder code.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:25-27
Timestamp: 2025-09-22T14:09:28.381Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has explicitly chosen to only allow the "update:current_user_metadata" scope for user metadata updates, rejecting the suggestion to also allow "create:current_user_metadata" scope. This is an intentional design decision to be more restrictive with scope permissions.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:31-36
Timestamp: 2025-09-25T23:40:48.086Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has deferred updating the username search pattern from `users?q=identities.user_id:%s&search_engine=v3` to `users?q=username:%s&search_engine=v3` to upcoming PRs, as the username search functionality is not currently being used.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:201-209
Timestamp: 2025-09-22T14:40:04.765Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has chosen to defer implementing response body redaction for Auth0 Management API error logging to upcoming PRs, acknowledging the security concern but prioritizing it for later implementation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: pkg/httpclient/request.go:135-142
Timestamp: 2025-09-25T21:21:02.370Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has confirmed that Auth0 API error responses do not contain sensitive data, so full response body logging in error cases is acceptable without truncation or redaction.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:157-163
Timestamp: 2025-09-22T14:40:52.872Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has chosen to defer implementing PII redaction for request body logging in the Auth0 Management API calls to upcoming PRs, acknowledging the security concern but prioritizing it for later implementation.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:164-0
Timestamp: 2025-09-25T22:24:27.863Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to keep the SearchUser method implementation without domain validation checks, even though GetUser and UpdateUser methods include such validation. The maintainer is satisfied with the current simpler approach for the SearchUser method.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/infrastructure/auth0/user.go:186-0
Timestamp: 2025-09-25T22:18:16.674Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao prefers to avoid implementing email search fallbacks when the primary users-by-email endpoint returns zero results. The service should return "user not found" directly rather than attempting secondary search queries, prioritizing implementation simplicity over handling Auth0 eventual consistency edge cases.
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/service/message_handler.go:27-0
Timestamp: 2025-09-25T22:21:42.535Z
Learning: In the LFX v2 Auth Service message handler implementation, mauriciozanettisalomao prefers the current EmailToUsername implementation without nil guards for the userReader field, trusting that the dependency injection setup ensures proper configuration before method calls.
📚 Learning: 2025-09-25T23:40:05.652Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#5
File: internal/domain/model/auth0.go:37-53
Timestamp: 2025-09-25T23:40:05.652Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao plans to expand the Auth0UserMetadata struct with additional attributes in upcoming PRs to preserve all supported metadata fields during Auth0User to User conversion, addressing the current subset limitation.
Applied to files:
README.md
📚 Learning: 2025-09-22T14:09:28.381Z
Learnt from: mauriciozanettisalomao
PR: linuxfoundation/lfx-v2-auth-service#3
File: internal/infrastructure/auth0/user.go:25-27
Timestamp: 2025-09-22T14:09:28.381Z
Learning: In the LFX v2 Auth Service Auth0 implementation, mauriciozanettisalomao has explicitly chosen to only allow the "update:current_user_metadata" scope for user metadata updates, rejecting the suggestion to also allow "create:current_user_metadata" scope. This is an intentional design decision to be more restrictive with scope permissions.
Applied to files:
README.md
🪛 markdownlint-cli2 (0.18.1)
README.md
104-104: Heading levels should only increment by one level at a time
Expected: h4; Actual: h5
(MD001, heading-increment)
132-132: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
137-137: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: MegaLinter
Comment on lines
+104
to
+110
| ##### Input Format and Strategy Selection | ||
|
|
||
| The service automatically determines the lookup strategy based on the input format: | ||
|
|
||
| - **Canonical Lookup** (contains `|`): `<connection>|<provider_user_id>` - Subject identifier | ||
| - **Search Lookup** (no `|`): `<username>` - Convenience lookup | ||
|
|
There was a problem hiding this comment.
Fix heading level to satisfy Markdown lint
##### Input Format and Strategy Selection skips from the preceding H3 straight to H5, which violates our Markdown heading increment rule and triggers markdownlint (MD001). Please drop it to H4 so the hierarchy stays consistent.
As flagged by markdownlint-cli2 (MD001).
-##### Input Format and Strategy Selection
+#### Input Format and Strategy Selection📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| ##### Input Format and Strategy Selection | |
| The service automatically determines the lookup strategy based on the input format: | |
| - **Canonical Lookup** (contains `|`): `<connection>|<provider_user_id>` - Subject identifier | |
| - **Search Lookup** (no `|`): `<username>` - Convenience lookup | |
| #### Input Format and Strategy Selection | |
| The service automatically determines the lookup strategy based on the input format: | |
| - **Canonical Lookup** (contains `|`): `<connection>|<provider_user_id>` - Subject identifier | |
| - **Search Lookup** (no `|`): `<username>` - Convenience lookup | |
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
104-104: Heading levels should only increment by one level at a time
Expected: h4; Actual: h5
(MD001, heading-increment)
🤖 Prompt for AI Agents
In README.md around lines 104 to 110, the heading "##### Input Format and
Strategy Selection" uses H5 after a preceding H3 which violates the markdown
heading increment rule (MD001); change the heading level from H5 to H4 (i.e.,
use four # instead of five) so the document hierarchy is consistent and the
markdown lint error is resolved.
Comment on lines
+132
to
+139
| ``` | ||
| auth0|123456789 | ||
| ``` | ||
|
|
||
| **Search Lookup:** | ||
| ``` | ||
| john.doe | ||
| ``` |
There was a problem hiding this comment.
Add language hints to fenced code blocks
The plain-text identifier examples are fenced without a language tag, tripping markdownlint (MD040). Annotate them (text works) to keep the formatter quiet.
As flagged by markdownlint-cli2 (MD040).
-```
+```text
auth0|123456789- +text
john.doe
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
132-132: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
137-137: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In README.md around lines 132 to 139 the fenced code blocks are missing language
hints which triggers markdownlint MD040; update both fenced blocks to use a
plain text language tag by changing the opening fences from ``` to ```text for
the auth0|123456789 block and the john.doe block so each fence becomes ```text
(no other content changes).
This was referenced Oct 3, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Implement
lfx.auth-service.user_metadata.readNATS endpoint to fetch user metadata from Auth0 with hybrid user identification.Key Points
Hybrid Lookup Logic
sub) lookup: If identifier contains|, call/api/v2/users/{sub}|, queryidentities.user_id:{input}scoped toUsername-Password-AuthenticationAlways return canonical
subin responseReturn:
user_metadata(profile attributes + canonicalsub)Error handling: non-existent users, Auth0 API failures, invalid formats
Test Evidence - User Metadata Read Service
Overview
This document provides test evidence for the
lfx.auth-service.user_metadata.readNATS endpoint implementation. The service supports reading user metadata from Auth0 using either the full Auth0 user ID (withauth0|prefix) or just the username portion.Test Environment
nats://lfx-platform-nats.lfx.svc.cluster.local:4222lfx.auth-service.user_metadata.readmauriciozanetti(Auth0 ID:auth0|mauriciozanetti)Test Cases
✅ Test Case 1: Valid User with Full Auth0 ID
Command:
nats req --server nats://lfx-platform-nats.lfx.svc.cluster.local:4222 lfx.auth-service.user_metadata.read "auth0|mauriciozanetti"Result:
Status: ✅ PASSED
✅ Test Case 2: Valid User with Username Only
Command:
Result:
Status: ✅ PASSED
✅ Test Case 3: Invalid User with Username Only
Command:
Result:
Status: ✅ PASSED
✅ Test Case 4: Invalid User with Full Auth0 ID
Command:
nats req --server nats://lfx-platform-nats.lfx.svc.cluster.local:4222 lfx.auth-service.user_metadata.read "auth0|mauriciozanetti1"Result:
Status: ✅ PASSED
Summary
✅ All Test Cases Passed
Key Features Validated
auth0|username) and username-only formatspicturenamegiven_namefamily_namejob_titleorganizationcountrycityphone_numberResponse Format
The service returns consistent JSON responses with:
{"success": true, "data": {...}}{"success": false, "error": "error message"}