fix: skip linking email identity that matches primary account's email - #136
Open
emsearcy wants to merge 2 commits into
Open
fix: skip linking email identity that matches primary account's email#136emsearcy wants to merge 2 commits into
emsearcy wants to merge 2 commits into
Conversation
linkEmailIdentity previously only checked for existing secondary 'email' identities before creating/linking a new one, but never compared the candidate email against the primary account's own top-level email. This let the backfill and live sync paths link a redundant secondary identity duplicating the account's own primary email. Add a guard that skips linking (idempotent no-op) whenever the candidate email case-insensitively matches the primary account's own email, logging a warning since this indicates upstream data misalignment worth investigating. Assisted-by: github-copilot:claude-sonnet-5 Signed-off-by: Eric Searcy <eric@linuxfoundation.org>
Contributor
There was a problem hiding this comment.
Pull request overview
Prevents redundant Auth0 secondary identities when an alternate email matches the account’s primary email.
Changes:
- Adds a case-insensitive primary-email guard.
- Adds exact-case and mixed-case regression tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
cmd/lfx-v1-sync-helper/auth0_mgmt.go |
Skips redundant identity linking. |
cmd/lfx-v1-sync-helper/auth0_identity_test.go |
Tests primary-email matching behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Blocked Auth0 accounts are treated as inactive/deprovisioned. Both syncProfileToAuth0 and linkEmailIdentity now check the primary account's Blocked flag right after reading it and no-op (log a warning, return nil) instead of pushing profile updates or linking new secondary email identities to a blocked account. This covers the ALIGNED/BLOCKED (and similar BLOCKED-drilldown) buckets from the LFXV2-2662 alignment analysis: accounts flagged as blocked in Auth0 should not receive further writes from the v1 sync paths (live handlers and backfill), since they are effectively deprovisioned. Assisted-by: github-copilot:claude-sonnet-5 Signed-off-by: Eric Searcy <eric@linuxfoundation.org>
Comment on lines
+178
to
+181
| if existing.GetBlocked() { | ||
| logger.With("auth0_user_id", auth0UserID). | ||
| WarnContext(ctx, "Auth0 user is blocked, skipping profile sync") | ||
| return nil |
Comment on lines
+239
to
+242
| if primaryUser.GetBlocked() { | ||
| logger.With("auth0_user_id", primaryAuth0ID, "email", email). | ||
| WarnContext(ctx, "Auth0 user is blocked, skipping email link") | ||
| return nil |
Comment on lines
+249
to
+252
| if strings.EqualFold(primaryUser.GetEmail(), email) { | ||
| logger.With("auth0_user_id", primaryAuth0ID, "email", email). | ||
| WarnContext(ctx, "email matches primary account's own email, skipping link") | ||
| return nil |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related fixes for Auth0 email/profile sync edge cases found during the LFXV2-2662 alignment analysis:
linkEmailIdentitychecked for existing secondary "email" identities before creating/linking a new one, but never compared the candidate email against the primary account's own top-level email. This let the backfill and live sync paths link a redundant secondary identity duplicating the account's own primary email. Adds a guard that skips linking (idempotent no-op, logged as a warning) whenever the candidate email case-insensitively matches the primary account's own email.Neither
syncProfileToAuth0norlinkEmailIdentitychecked whether the Auth0 account was blocked before writing to it. Blocked accounts are effectively deprovisioned, so pushing new profile data or linking new secondary email identities to them is unwanted. This addresses theALIGNED / BLOCKED(and similar*_BLOCKEDdrilldown) buckets identified in the LFXV2-2662 alignment analysis: both functions now no-op (log a warning, return nil) when the primary Auth0 account is blocked.Jira
LFXV2-2662
Testing
go build ./...go test ./cmd/lfx-v1-sync-helper/... -run 'TestLinkEmailIdentity|TestSyncProfileToAuth0Blocked|TestSyncMergedUserProfile' -vmake check🤖 Generated with GitHub Copilot (via OpenCode)