fix(auth): JIT placeholder name no longer surfaces UUID fragments #121
No reviewers
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
psa-systems/mokosh-server!121
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/jit-fallback-name-not-uuid-fragments"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
When bunyip's
/oauth2/userinfofails or returns no email, mokosh-server'sensure_user_from_bunyipfalls back to{sub}@unresolved.invalidso the JIT row still satisfies the NOT NULL email column.synthetic_name_from_emailthen split the local-part on./_/-and produced first_name ="7fa2b249", last_name ="6132"from the UUID. The user saw those UUID fragments staring back at them on the profile page.Two layers of defence:
@unresolved.invaliddomain (mokosh-server's own placeholder shape) and return the clearly-placeholder pair("Mokosh", "User").Both fall through to
("Mokosh", "User")instead of("User", "")from before, so the rendered name is obviously a default and not "User ". The user is still expected to edit it from the profile page (which now exists, mokosh-apps PR #82).Tests pin: the JIT placeholder shape, a UUID-shaped local-part on a real domain (defence in depth), and three positive cases (dot-separated, single segment, underscore-separated) so the change doesn't regress normal-shape emails.
Existing rows with UUID-fragment names are not retroactively rewritten; affected users can fix theirs from the profile screen. The next user to JIT-provision lands on the placeholder pair instead.
When bunyip's `/oauth2/userinfo` fails or returns no email, mokosh-server's `ensure_user_from_bunyip` falls back to `{sub}@unresolved.invalid` so the JIT row still satisfies the NOT NULL email column. `synthetic_name_from_email` then split the local-part on `.`/`_`/`-` and produced first_name = `"7fa2b249"`, last_name = `"6132"` from the UUID. The user saw those UUID fragments staring back at them on the profile page. Two layers of defence: - Explicitly detect the `@unresolved.invalid` domain (mokosh-server's own placeholder shape) and return the clearly-placeholder pair `("Mokosh", "User")`. - Detect any local-part segment that is hex-only and at least 4 characters: that is the shape of every UUID segment, and a real name never reads as pure hex. Treat the whole local-part as opaque and fall through to the same placeholder pair. Both fall through to `("Mokosh", "User")` instead of `("User", "")` from before, so the rendered name is obviously a default and not "User <last-name-missing>". The user is still expected to edit it from the profile page (which now exists, mokosh-apps PR #82). Tests pin: the JIT placeholder shape, a UUID-shaped local-part on a real domain (defence in depth), and three positive cases (dot-separated, single segment, underscore-separated) so the change doesn't regress normal-shape emails. Existing rows with UUID-fragment names are not retroactively rewritten; affected users can fix theirs from the profile screen. The next user to JIT-provision lands on the placeholder pair instead.