fix(users): publish FGA update_access after username scrub (LFXV2-2645)

Refresh OpenFGA tuples from scrubbed settings via buildFGAUpdateAccessMessage, matching normal settings writes while still omitting role-change notification emails.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Andres Tobon <andrest2455@gmail.com>

Author: andrest50

internal/service/project_subscriber.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	emailapi "github.com/linuxfoundation/lfx-v2-email-service/pkg/api"
+	fgaconstants "github.com/linuxfoundation/lfx-v2-fga-sync/pkg/constants"
 	indexerConstants "github.com/linuxfoundation/lfx-v2-indexer-service/pkg/constants"
 	indexerTypes "github.com/linuxfoundation/lfx-v2-indexer-service/pkg/types"
 	inviteapi "github.com/linuxfoundation/lfx-v2-invite-service/pkg/api"
@@ -657,15 +658,7 @@ func (s *ProjectsService) scrubUsernameFromProjectSettings(ctx context.Context,
 		if updateErr == nil {
 			slog.InfoContext(ctx, "project_subscriber: cleared username from project settings",
 				"project_uid", projectUID, "username", username)
-			indexMsg := indexerTypes.IndexerMessageEnvelope{
-				Action:         indexerConstants.ActionUpdated,
-				Data:           *settings,
-				IndexingConfig: settings.IndexingConfig(projectUID),
-			}
-			if indexErr := s.MessageBuilder.SendIndexerMessage(ctx, constants.IndexProjectSettingsSubject, indexMsg, false); indexErr != nil {
-				slog.WarnContext(ctx, "project_subscriber: failed to reindex project settings after username scrub",
-					constants.ErrKey, indexErr, "project_uid", projectUID)
-			}
+			s.publishProjectSettingsScrubSideEffects(ctx, projectUID, settings)
 			return
 		}
 		if !errors.Is(updateErr, domain.ErrRevisionMismatch) || attempt == maxRetries-1 {
@@ -678,6 +671,33 @@ func (s *ProjectsService) scrubUsernameFromProjectSettings(ctx context.Context,
 	}
 }
 
+// publishProjectSettingsScrubSideEffects reindexes scrubbed settings and refreshes OpenFGA
+// access tuples. Best-effort: failures are logged but do not fail the scrub handler.
+// ProjectSettingsUpdatedSubject is intentionally omitted to avoid role-change emails.
+func (s *ProjectsService) publishProjectSettingsScrubSideEffects(ctx context.Context, projectUID string, settings *models.ProjectSettings) {
+	indexMsg := indexerTypes.IndexerMessageEnvelope{
+		Action:         indexerConstants.ActionUpdated,
+		Data:           *settings,
+		IndexingConfig: settings.IndexingConfig(projectUID),
+	}
+	if indexErr := s.MessageBuilder.SendIndexerMessage(ctx, constants.IndexProjectSettingsSubject, indexMsg, false); indexErr != nil {
+		slog.WarnContext(ctx, "project_subscriber: failed to reindex project settings after username scrub",
+			constants.ErrKey, indexErr, "project_uid", projectUID)
+	}
+
+	projectBase, err := s.ProjectRepository.GetProjectBase(ctx, projectUID)
+	if err != nil {
+		slog.WarnContext(ctx, "project_subscriber: failed to load project for FGA refresh after username scrub",
+			constants.ErrKey, err, "project_uid", projectUID)
+		return
+	}
+	fgaMsg := buildFGAUpdateAccessMessage(projectBase, settings)
+	if accessErr := s.MessageBuilder.SendAccessMessage(ctx, fgaconstants.GenericUpdateAccessSubject, fgaMsg, false); accessErr != nil {
+		slog.WarnContext(ctx, "project_subscriber: failed to publish FGA update after username scrub",
+			constants.ErrKey, accessErr, "project_uid", projectUID)
+	}
+}
+
 // buildProjectURL constructs the deep-link URL for a project's overview page.
 func buildProjectURL(baseURL, slug string) string {
 	base := strings.TrimRight(baseURL, "/") + "/project/overview"

internal/service/project_subscriber_test.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	emailapi "github.com/linuxfoundation/lfx-v2-email-service/pkg/api"
+	fgaconstants "github.com/linuxfoundation/lfx-v2-fga-sync/pkg/constants"
 	indexerTypes "github.com/linuxfoundation/lfx-v2-indexer-service/pkg/types"
 	inviteapi "github.com/linuxfoundation/lfx-v2-invite-service/pkg/api"
 	"github.com/stretchr/testify/assert"
@@ -1185,9 +1186,11 @@ func TestHandleUserDeleted(t *testing.T) {
 				r.On("UpdateProjectSettings", mock.Anything, mock.MatchedBy(func(s *models.ProjectSettings) bool {
 					return len(s.Writers) == 1 && s.Writers[0].Username == "" && s.Writers[0].Email == "deleted@example.com"
 				}), uint64(1)).Return(nil)
+				r.On("GetProjectBase", mock.Anything, projectUID).Return(&models.ProjectBase{UID: projectUID}, nil)
 			},
 			setupMsg: func(m *domain.MockMessageBuilder) {
 				m.On("SendIndexerMessage", mock.Anything, constants.IndexProjectSettingsSubject, mock.Anything, false).Return(nil)
+				m.On("SendAccessMessage", mock.Anything, fgaconstants.GenericUpdateAccessSubject, mock.Anything, false).Return(nil)
 			},
 		},
 		{
@@ -1221,9 +1224,11 @@ func TestHandleUserDeleted(t *testing.T) {
 				r.On("UpdateProjectSettings", mock.Anything, mock.MatchedBy(func(s *models.ProjectSettings) bool {
 					return len(s.Auditors) == 1 && s.Auditors[0].Username == ""
 				}), uint64(2)).Return(nil).Once()
+				r.On("GetProjectBase", mock.Anything, projectUID).Return(&models.ProjectBase{UID: projectUID}, nil)
 			},
 			setupMsg: func(m *domain.MockMessageBuilder) {
 				m.On("SendIndexerMessage", mock.Anything, constants.IndexProjectSettingsSubject, mock.Anything, false).Return(nil)
+				m.On("SendAccessMessage", mock.Anything, fgaconstants.GenericUpdateAccessSubject, mock.Anything, false).Return(nil)
 			},
 		},
 		{
@@ -1248,9 +1253,11 @@ func TestHandleUserDeleted(t *testing.T) {
 					return len(s.MeetingCoordinators) == 1 && s.MeetingCoordinators[0].Username == "" &&
 						s.ExecutiveDirector != nil && s.ExecutiveDirector.Username == ""
 				}), uint64(1)).Return(nil)
+				r.On("GetProjectBase", mock.Anything, projectUID).Return(&models.ProjectBase{UID: projectUID}, nil)
 			},
 			setupMsg: func(m *domain.MockMessageBuilder) {
 				m.On("SendIndexerMessage", mock.Anything, constants.IndexProjectSettingsSubject, mock.Anything, false).Return(nil)
+				m.On("SendAccessMessage", mock.Anything, fgaconstants.GenericUpdateAccessSubject, mock.Anything, false).Return(nil)
 			},
 		},
 		{
@@ -1268,9 +1275,11 @@ func TestHandleUserDeleted(t *testing.T) {
 				r.On("ListAllProjectsSettings", mock.Anything).Return([]*models.ProjectSettings{match, other}, nil)
 				r.On("GetProjectSettingsWithRevision", mock.Anything, projectUID).Return(match, uint64(1), nil)
 				r.On("UpdateProjectSettings", mock.Anything, mock.Anything, uint64(1)).Return(nil)
+				r.On("GetProjectBase", mock.Anything, projectUID).Return(&models.ProjectBase{UID: projectUID}, nil)
 			},
 			setupMsg: func(m *domain.MockMessageBuilder) {
 				m.On("SendIndexerMessage", mock.Anything, constants.IndexProjectSettingsSubject, mock.Anything, false).Return(nil)
+				m.On("SendAccessMessage", mock.Anything, fgaconstants.GenericUpdateAccessSubject, mock.Anything, false).Return(nil)
 			},
 		},
 	}