fix(users): normalize username in user.deleted publish

Align event payload with username index normalization, document best-effort
publish tradeoff, add publishUserDeletedEvent test, and note x/crypto bump.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Andres Tobon <andrest2455@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: andrest50

cmd/lfx-v1-sync-helper/handlers_users.go

@@ -62,8 +62,12 @@ var publishUserDeletedEventFn = publishUserDeletedEvent
 // key segment safe for NATS KV. Order: TrimSpace → ToLower → NFC → RawURLEncoding.
 // NFC unifies decomposed/precomposed Unicode (e.g. n\u0303 ≡ ñ) without semantic
 // transposition. RawURLEncoding (no padding) keeps keys opaque and short.
+func normalizeKVSegment(s string) string {
+	return norm.NFC.String(strings.ToLower(strings.TrimSpace(s)))
+}
+
 func toKVKey(s string) string {
-	s = norm.NFC.String(strings.ToLower(strings.TrimSpace(s)))
+	s = normalizeKVSegment(s)
 	if s == "" {
 		return ""
 	}
@@ -151,8 +155,8 @@ func handleMergedUserDelete(ctx context.Context, key, userSfid string, v1Data ma
 	// handleAlternateEmailDelete cleans those up individually — but if the user is deleted
 	// without its alternate emails being deleted first, those entries will be orphaned.
 
-	if username != "" {
-		publishUserDeletedEventFn(ctx, key, username)
+	if normalizedUsername := normalizeKVSegment(username); normalizedUsername != "" {
+		publishUserDeletedEventFn(ctx, key, normalizedUsername)
 	}
 
 	return false
@@ -168,15 +172,21 @@ type userDeletedEvent struct {
 const v1SyncHelperUserDeletedSubject = "lfx.v1-sync-helper.user.deleted"
 
 // publishUserDeletedEvent publishes a user-deleted NATS event. Best-effort: publish
-// errors are logged and do not affect the delete handler's return value.
+// errors are logged and do not affect the delete handler's return value (the JetStream
+// KV delete is already ACKed). A failed publish can leave username PII in v2 settings
+// until a manual re-sync; scrub subscribers treat the event as idempotent.
+var natsPublishBytesFn = func(subject string, data []byte) error {
+	return natsConn.Publish(subject, data)
+}
+
 func publishUserDeletedEvent(ctx context.Context, key, username string) {
 	payload, err := json.Marshal(userDeletedEvent{Username: username})
 	if err != nil {
 		logger.With(errKey, err, "key", key).
 			ErrorContext(ctx, "failed to marshal user-deleted event; committee username scrub skipped")
 		return
 	}
-	if err := natsConn.Publish(v1SyncHelperUserDeletedSubject, payload); err != nil {
+	if err := natsPublishBytesFn(v1SyncHelperUserDeletedSubject, payload); err != nil {
 		logger.With(errKey, err, "key", key).
 			ErrorContext(ctx, "failed to publish user-deleted event; committee username scrub skipped")
 		return

cmd/lfx-v1-sync-helper/handlers_users_test.go

@@ -5,6 +5,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -345,6 +346,15 @@ func TestHandleMergedUserDeleteScrub(t *testing.T) {
 		wantPublished bool
 		wantUsername  string
 	}{
+		{
+			name: "username present → publish normalized event",
+			v1Data: map[string]any{
+				"sfid":        userSfid,
+				"username__c": " Alice ",
+			},
+			wantPublished: true,
+			wantUsername:  "alice",
+		},
 		{
 			name: "username present → publish event",
 			v1Data: map[string]any{
@@ -393,6 +403,44 @@ func TestHandleMergedUserDeleteScrub(t *testing.T) {
 	}
 }
 
+func TestPublishUserDeletedEvent(t *testing.T) {
+	origLogger := logger
+	origPublish := natsPublishBytesFn
+	t.Cleanup(func() {
+		logger = origLogger
+		natsPublishBytesFn = origPublish
+	})
+	logger = slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	t.Run("publishes normalized payload on subject", func(t *testing.T) {
+		var gotSubject string
+		var gotPayload userDeletedEvent
+		natsPublishBytesFn = func(subject string, data []byte) error {
+			gotSubject = subject
+			if err := json.Unmarshal(data, &gotPayload); err != nil {
+				t.Fatalf("unmarshal payload: %v", err)
+			}
+			return nil
+		}
+
+		publishUserDeletedEvent(context.Background(), "test-key", "alice")
+
+		if gotSubject != v1SyncHelperUserDeletedSubject {
+			t.Fatalf("subject = %q, want %q", gotSubject, v1SyncHelperUserDeletedSubject)
+		}
+		if gotPayload.Username != "alice" {
+			t.Fatalf("username = %q, want alice", gotPayload.Username)
+		}
+	})
+
+	t.Run("publish error is swallowed", func(_ *testing.T) {
+		natsPublishBytesFn = func(_ string, _ []byte) error {
+			return errors.New("nats unavailable")
+		}
+		publishUserDeletedEvent(context.Background(), "test-key", "alice")
+	})
+}
+
 // TestExtractEmailIndex covers the field extraction for the alternate_email reindex phase.
 func TestExtractEmailIndex(t *testing.T) {
 	tests := []struct {

go.mod

@@ -56,6 +56,6 @@ require (
 	github.com/segmentio/asm v1.2.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	go.devnw.com/structs v1.0.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect; go mod tidy — GO-2026-5932 has no upstream fix yet
 	golang.org/x/sys v0.47.0 // indirect
 )