psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(auth): seed first_name/last_name defaults on bunyip JIT user upsert #60

Merged
YousifShkara merged 1 commit from feat/jit-user-name-defaults into main 2026-06-04 08:36:23 +02:00
Conversation 0 Commits 1 Files changed 1 +50 -3
YousifShkara commented 2026-06-04 08:36:19 +02:00
Owner
Copy link

ensure_user_from_bunyip JIT-inserts a row into public.users on first
sight of a new sub. upsert_user_from_oidc built that INSERT without
first_name or last_name; the schema marks both NOT NULL, so every
JIT insert errored with 23502, ensure_user_from_bunyip returned None,
auth_middleware fell through to legacy verifiers (which reject
bunyip's EdDSA at+jwt as InvalidAlgorithm) and returned 401.

Symptom in the wild: every authenticated /api/v1/* endpoint 401s for
any bunyip-OP-authed user who hadn't already been inserted into
mokosh-server's users table by some other path (the legacy SSO flow,
a previous direct-mokosh login, etc). The mokosh-apps tickets and
contacts pages were both running on the seeded-demo-rows fallback;
deleting the fallback in feat/crm-ops surfaced the bug for the first
time on the contacts page, but it was breaking every authed call.

Fix: derive synthetic first_name/last_name from the email local-part
when inserting. yousif@niceguyit.biz becomes ('Yousif', ''), and
firstname.lastname@... becomes ('Firstname', 'Lastname'). The
@unresolved.invalid placeholder used when /oauth2/userinfo can't
resolve email falls back to ('User', ''). Users can overwrite their
name from Settings; a future userinfo refresh path can also overwrite
this default with the real name claim if bunyip ever ships one.

The synthetic_name_from_email helper is gated behind
#[cfg(feature = "server")] to match the existing module-level
helpers around it.

ensure_user_from_bunyip JIT-inserts a row into public.users on first sight of a new sub. upsert_user_from_oidc built that INSERT without first_name or last_name; the schema marks both NOT NULL, so every JIT insert errored with 23502, ensure_user_from_bunyip returned None, auth_middleware fell through to legacy verifiers (which reject bunyip's EdDSA at+jwt as InvalidAlgorithm) and returned 401. Symptom in the wild: every authenticated /api/v1/* endpoint 401s for any bunyip-OP-authed user who hadn't already been inserted into mokosh-server's users table by some other path (the legacy SSO flow, a previous direct-mokosh login, etc). The mokosh-apps tickets and contacts pages were both running on the seeded-demo-rows fallback; deleting the fallback in feat/crm-ops surfaced the bug for the first time on the contacts page, but it was breaking every authed call. Fix: derive synthetic first_name/last_name from the email local-part when inserting. yousif@niceguyit.biz becomes ('Yousif', ''), and firstname.lastname@... becomes ('Firstname', 'Lastname'). The @unresolved.invalid placeholder used when /oauth2/userinfo can't resolve email falls back to ('User', ''). Users can overwrite their name from Settings; a future userinfo refresh path can also overwrite this default with the real name claim if bunyip ever ships one. The synthetic_name_from_email helper is gated behind #[cfg(feature = "server")] to match the existing module-level helpers around it.
fix(auth): seed first_name/last_name defaults on bunyip JIT user upsert
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 54s
Details
Build OCI container / Build and push mokosh-api image (push) Successful in 3m4s
Details
7dceaf6c01 
ensure_user_from_bunyip JIT-inserts a row into public.users on first
sight of a new sub. upsert_user_from_oidc built that INSERT without
first_name or last_name; the schema marks both NOT NULL, so every
JIT insert errored with 23502, ensure_user_from_bunyip returned None,
auth_middleware fell through to legacy verifiers (which reject
bunyip's EdDSA at+jwt as InvalidAlgorithm) and returned 401.

Symptom in the wild: every authenticated /api/v1/* endpoint 401s for
any bunyip-OP-authed user who hadn't already been inserted into
mokosh-server's users table by some other path (the legacy SSO flow,
a previous direct-mokosh login, etc). The mokosh-apps tickets and
contacts pages were both running on the seeded-demo-rows fallback;
deleting the fallback in feat/crm-ops surfaced the bug for the first
time on the contacts page, but it was breaking every authed call.

Fix: derive synthetic first_name/last_name from the email local-part
when inserting. yousif@niceguyit.biz becomes ('Yousif', ''), and
firstname.lastname@... becomes ('Firstname', 'Lastname'). The
@unresolved.invalid placeholder used when /oauth2/userinfo can't
resolve email falls back to ('User', ''). Users can overwrite their
name from Settings; a future userinfo refresh path can also overwrite
this default with the real name claim if bunyip ever ships one.

The synthetic_name_from_email helper is gated behind
#[cfg(feature = "server")] to match the existing module-level
helpers around it.
YousifShkara deleted branch feat/jit-user-name-defaults 2026-06-04 08:36:23 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!60
No description provided.