Merge pull request #261 from rh-amarin/audit-email-not-required

openshift-merge-bot[bot] · web-flow · commit 4fe21ec6bc64 · 2026-06-29T14:56:00.000Z
HYPERLFEET-1278 - feat: audit fields do not require email
diff --git a/go.mod b/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103
 	github.com/oapi-codegen/runtime v1.4.2
 	github.com/onsi/gomega v1.42.0
-	github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.24
+	github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.25
 	github.com/prometheus/client_golang v1.16.0
 	github.com/prometheus/client_model v0.3.0
 	github.com/spf13/cobra v1.10.2
diff --git a/go.sum b/go.sum
@@ -203,6 +203,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.24 h1:ACdI09b1TAqsTehVG0eNaAJhWfybMKt87nx/bZ1Dgwk=
 github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.24/go.mod h1:KITzIAd8HcMpH5lXdHFjgk45dvL6XLpP3wwz8iK+KCI=
+github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.25 h1:vqJeoo0Xr/ynX1rKOOKJxX2nC4wdSXw6mP730ETGRaE=
+github.com/openshift-hyperfleet/hyperfleet-api-spec v1.0.25/go.mod h1:KITzIAd8HcMpH5lXdHFjgk45dvL6XLpP3wwz8iK+KCI=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
diff --git a/hack/tools.go b/hack/tools.go
@@ -1,5 +1,3 @@
-//go:build tools
-
 package hack
 
 import _ "github.com/openshift-hyperfleet/hyperfleet-api-spec/schemas"
diff --git a/pkg/api/presenters/cluster.go b/pkg/api/presenters/cluster.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 
-	openapi_types "github.com/oapi-codegen/runtime/types"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api/openapi"
 )
@@ -43,20 +42,6 @@ func ConvertCluster(req *openapi.ClusterCreateRequest) (*api.Cluster, error) {
 	}, nil
 }
 
-// Helper to convert string to openapi_types.Email
-func toEmail(s string) openapi_types.Email {
-	return openapi_types.Email(s)
-}
-
-// Helper to convert *string to *openapi_types.Email (for optional email fields)
-func toEmailPtr(s *string) *openapi_types.Email {
-	if s == nil || *s == "" {
-		return nil
-	}
-	e := openapi_types.Email(*s)
-	return &e
-}
-
 // PresentCluster converts api.Cluster (GORM model) to openapi.Cluster
 func PresentCluster(cluster *api.Cluster) (openapi.Cluster, error) {
 	// Unmarshal Spec
@@ -105,9 +90,9 @@ func PresentCluster(cluster *api.Cluster) (openapi.Cluster, error) {
 	}
 
 	result := openapi.Cluster{
-		CreatedBy:   toEmail(cluster.CreatedBy),
+		CreatedBy:   cluster.CreatedBy,
 		CreatedTime: cluster.CreatedTime,
-		DeletedBy:   toEmailPtr(cluster.DeletedBy),
+		DeletedBy:   cluster.DeletedBy,
 		DeletedTime: cluster.DeletedTime,
 		Generation:  cluster.Generation,
 		Href:        &href,
@@ -119,7 +104,7 @@ func PresentCluster(cluster *api.Cluster) (openapi.Cluster, error) {
 		Status: openapi.ClusterStatus{
 			Conditions: openapiConditions,
 		},
-		UpdatedBy:   toEmail(cluster.UpdatedBy),
+		UpdatedBy:   cluster.UpdatedBy,
 		UpdatedTime: cluster.UpdatedTime,
 	}
 
diff --git a/pkg/api/presenters/cluster_test.go b/pkg/api/presenters/cluster_test.go
@@ -5,7 +5,6 @@ import (
 	"testing"
 	"time"
 
-	openapi_types "github.com/oapi-codegen/runtime/types"
 	. "github.com/onsi/gomega"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api/openapi"
@@ -206,8 +205,8 @@ func TestPresentCluster_Complete(t *testing.T) {
 	Expect(*result.Href).To(Equal("/api/hyperfleet/v1/clusters/cluster-abc123"))
 	Expect(result.Name).To(Equal("presented-cluster"))
 	Expect(result.Generation).To(Equal(int32(10)))
-	Expect(result.CreatedBy).To(Equal(openapi_types.Email("user123@example.com")))
-	Expect(result.UpdatedBy).To(Equal(openapi_types.Email("user456@example.com")))
+	Expect(result.CreatedBy).To(Equal("user123@example.com"))
+	Expect(result.UpdatedBy).To(Equal("user456@example.com"))
 
 	// Verify Spec unmarshaled correctly
 	Expect(result.Spec["region"]).To(Equal("us-west1"))
diff --git a/pkg/api/presenters/node_pool.go b/pkg/api/presenters/node_pool.go
@@ -97,9 +97,9 @@ func PresentNodePool(nodePool *api.NodePool) (openapi.NodePool, error) {
 	}
 
 	result := openapi.NodePool{
-		CreatedBy:   toEmail(nodePool.CreatedBy),
+		CreatedBy:   nodePool.CreatedBy,
 		CreatedTime: nodePool.CreatedTime,
-		DeletedBy:   toEmailPtr(nodePool.DeletedBy),
+		DeletedBy:   nodePool.DeletedBy,
 		DeletedTime: nodePool.DeletedTime,
 		Generation:  nodePool.Generation,
 		Href:        &href,
@@ -116,7 +116,7 @@ func PresentNodePool(nodePool *api.NodePool) (openapi.NodePool, error) {
 		Status: openapi.NodePoolStatus{
 			Conditions: openapiConditions,
 		},
-		UpdatedBy:   toEmail(nodePool.UpdatedBy),
+		UpdatedBy:   nodePool.UpdatedBy,
 		UpdatedTime: nodePool.UpdatedTime,
 	}
 
diff --git a/pkg/api/presenters/node_pool_test.go b/pkg/api/presenters/node_pool_test.go
@@ -5,7 +5,6 @@ import (
 	"testing"
 	"time"
 
-	openapi_types "github.com/oapi-codegen/runtime/types"
 	. "github.com/onsi/gomega"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api"
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api/openapi"
@@ -192,8 +191,8 @@ func TestPresentNodePool_Complete(t *testing.T) {
 	Expect(result.Kind).To(Equal("NodePool"))
 	Expect(*result.Href).To(Equal("/api/hyperfleet/v1/clusters/cluster-abc/nodepools/nodepool-xyz"))
 	Expect(result.Name).To(Equal("presented-nodepool"))
-	Expect(result.CreatedBy).To(Equal(openapi_types.Email("user123@example.com")))
-	Expect(result.UpdatedBy).To(Equal(openapi_types.Email("user456@example.com")))
+	Expect(result.CreatedBy).To(Equal("user123@example.com"))
+	Expect(result.UpdatedBy).To(Equal("user456@example.com"))
 
 	// Verify Spec unmarshaled correctly
 	Expect(result.Spec["replicas"]).To(BeNumerically("==", 5))
diff --git a/pkg/api/presenters/resource.go b/pkg/api/presenters/resource.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 
-	openapi_types "github.com/oapi-codegen/runtime/types"
 	"gorm.io/datatypes"
 
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/api"
@@ -67,17 +66,16 @@ func PresentResource(r *api.Resource) openapi.Resource {
 		Generation:  r.Generation,
 		CreatedTime: r.CreatedTime,
 		UpdatedTime: r.UpdatedTime,
-		CreatedBy:   openapi_types.Email(r.CreatedBy),
-		UpdatedBy:   openapi_types.Email(r.UpdatedBy),
+		CreatedBy:   r.CreatedBy,
+		UpdatedBy:   r.UpdatedBy,
 		DeletedTime: r.DeletedTime,
 		Status: openapi.ResourceStatus{
 			Conditions: []openapi.ResourceCondition{},
 		},
 	}
 
 	if r.DeletedBy != nil {
-		email := openapi_types.Email(*r.DeletedBy)
-		resp.DeletedBy = &email
+		resp.DeletedBy = r.DeletedBy
 	}
 
 	if r.OwnerID != nil && *r.OwnerID != "" {
@@ -103,8 +101,8 @@ func PresentResourceList(resources api.ResourceList, paging *api.PagingMeta) ope
 	}
 	return openapi.ResourceList{
 		Items: items,
-		Page:  int32(paging.Page),
-		Size:  int32(paging.Size),
+		Page:  int32(paging.Page), //nolint:gosec
+		Size:  int32(paging.Size), //nolint:gosec
 		Total: paging.Total,
 	}
 }
diff --git a/pkg/api/presenters/resource_test.go b/pkg/api/presenters/resource_test.go
@@ -88,7 +88,7 @@ func TestPresentResource(t *testing.T) {
 	Expect(resp.Spec).To(HaveKeyWithValue("is_default", true))
 	Expect(*resp.Labels).To(HaveKeyWithValue("env", "prod"))
 	Expect(resp.Generation).To(Equal(int32(1)))
-	Expect(string(resp.CreatedBy)).To(Equal("user@test.com"))
+	Expect(resp.CreatedBy).To(Equal("user@test.com"))
 	Expect(resp.OwnerReferences).To(BeNil())
 	Expect(resp.Status.Conditions).NotTo(BeNil())
 	Expect(resp.Status.Conditions).To(BeEmpty())
diff --git a/pkg/api/presenters/slice_filter.go b/pkg/api/presenters/slice_filter.go
@@ -33,9 +33,9 @@ func SliceFilter(fields2Store []string, model interface{}) (*ProjectionList, *er
 
 	// Initialize result structure
 	result := &ProjectionList{
-		Page:  int32(reflectValue.FieldByName("Page").Int()),
-		Size:  int32(reflectValue.FieldByName("Size").Int()),
-		Total: int32(reflectValue.FieldByName("Total").Int()),
+		Page:  int32(reflectValue.FieldByName("Page").Int()),  //nolint:gosec
+		Size:  int32(reflectValue.FieldByName("Size").Int()),  //nolint:gosec
+		Total: int32(reflectValue.FieldByName("Total").Int()), //nolint:gosec
 		Items: nil,
 	}
 
diff --git a/pkg/handlers/cluster_nodepools_test.go b/pkg/handlers/cluster_nodepools_test.go
@@ -305,7 +305,7 @@ func TestClusterNodePoolsHandler_SoftDelete(t *testing.T) {
 				Expect(err).NotTo(HaveOccurred())
 				Expect(*response.Id).To(Equal(nodePoolID))
 				Expect(response.DeletedTime).NotTo(BeNil())
-				Expect(string(*response.DeletedBy)).To(Equal(testSystemUser))
+				Expect(*response.DeletedBy).To(Equal(testSystemUser))
 			}
 		})
 	}
diff --git a/test/integration/caller_identity_test.go b/test/integration/caller_identity_test.go
@@ -41,6 +41,18 @@ func TestCallerIdentityCreate(t *testing.T) {
 			namePrefix: "ci-jwt",
 			email:      "jwt-only-user@example.com",
 		},
+		{
+			name:        "non-email identity header is accepted",
+			namePrefix:  "ci-non-email-hdr",
+			email:       "jwt-user@example.com",
+			setHeader:   true,
+			headerActor: "service-account:sentinel",
+		},
+		{
+			name:       "non-email JWT claim is accepted",
+			namePrefix: "ci-non-email-jwt",
+			email:      "service-account:sentinel",
+		},
 	}
 
 	for _, tc := range cases {
@@ -74,7 +86,7 @@ func TestCallerIdentityCreate(t *testing.T) {
 			Expect(err).NotTo(HaveOccurred())
 			Expect(resp.StatusCode()).To(Equal(http.StatusCreated))
 			Expect(resp.JSON201).NotTo(BeNil())
-			Expect(string(resp.JSON201.CreatedBy)).To(Equal(wantCreatedBy))
+			Expect(resp.JSON201.CreatedBy).To(Equal(wantCreatedBy))
 		})
 	}
 }
@@ -151,9 +163,9 @@ func TestCallerIdentityPatch(t *testing.T) {
 			Expect(err).NotTo(HaveOccurred())
 			Expect(patchResp.StatusCode()).To(Equal(http.StatusOK))
 			Expect(patchResp.JSON200).NotTo(BeNil())
-			Expect(string(patchResp.JSON200.UpdatedBy)).To(Equal(tc.wantUpdatedBy))
+			Expect(patchResp.JSON200.UpdatedBy).To(Equal(tc.wantUpdatedBy))
 			// created_by must remain unchanged.
-			Expect(string(patchResp.JSON200.CreatedBy)).To(Equal(tc.createEmail))
+			Expect(patchResp.JSON200.CreatedBy).To(Equal(tc.createEmail))
 		})
 	}
 }
@@ -179,8 +191,8 @@ func TestCallerIdentityMultiplePatches(t *testing.T) {
 	Expect(createResp.StatusCode()).To(Equal(http.StatusCreated))
 	clusterID := *createResp.JSON201.Id
 
-	Expect(string(createResp.JSON201.CreatedBy)).To(Equal("user-a@example.com"))
-	Expect(string(createResp.JSON201.UpdatedBy)).To(Equal("user-a@example.com"))
+	Expect(createResp.JSON201.CreatedBy).To(Equal("user-a@example.com"))
+	Expect(createResp.JSON201.UpdatedBy).To(Equal("user-a@example.com"))
 	Expect(createResp.JSON201.Generation).To(Equal(int32(1)))
 
 	// Patch 1: user-b via JWT.
@@ -196,8 +208,8 @@ func TestCallerIdentityMultiplePatches(t *testing.T) {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(patch1.StatusCode()).To(Equal(http.StatusOK))
 
-	Expect(string(patch1.JSON200.CreatedBy)).To(Equal("user-a@example.com"), "created_by must never change")
-	Expect(string(patch1.JSON200.UpdatedBy)).To(Equal("user-b@example.com"))
+	Expect(patch1.JSON200.CreatedBy).To(Equal("user-a@example.com"), "created_by must never change")
+	Expect(patch1.JSON200.UpdatedBy).To(Equal("user-b@example.com"))
 	Expect(patch1.JSON200.Generation).To(Equal(int32(2)))
 
 	// Patch 2: user-c via identity header.
@@ -211,16 +223,16 @@ func TestCallerIdentityMultiplePatches(t *testing.T) {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(patch2.StatusCode()).To(Equal(http.StatusOK))
 
-	Expect(string(patch2.JSON200.CreatedBy)).To(Equal("user-a@example.com"), "created_by must never change")
-	Expect(string(patch2.JSON200.UpdatedBy)).To(Equal("user-c@gateway.com"))
+	Expect(patch2.JSON200.CreatedBy).To(Equal("user-a@example.com"), "created_by must never change")
+	Expect(patch2.JSON200.UpdatedBy).To(Equal("user-c@gateway.com"))
 	Expect(patch2.JSON200.Generation).To(Equal(int32(3)))
 
 	// GET confirms persisted state.
 	getResp, err := client.GetClusterByIdWithResponse(ctxA, clusterID, nil, test.WithAuthToken(ctxA))
 	Expect(err).NotTo(HaveOccurred())
 	Expect(getResp.StatusCode()).To(Equal(http.StatusOK))
-	Expect(string(getResp.JSON200.CreatedBy)).To(Equal("user-a@example.com"))
-	Expect(string(getResp.JSON200.UpdatedBy)).To(Equal("user-c@gateway.com"))
+	Expect(getResp.JSON200.CreatedBy).To(Equal("user-a@example.com"))
+	Expect(getResp.JSON200.UpdatedBy).To(Equal("user-c@gateway.com"))
 	Expect(getResp.JSON200.Generation).To(Equal(int32(3)))
 }
 
@@ -246,7 +258,7 @@ func TestCallerIdentityDelete(t *testing.T) {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(createResp.StatusCode()).To(Equal(http.StatusCreated))
 	clusterID := *createResp.JSON201.Id
-	Expect(string(createResp.JSON201.CreatedBy)).To(Equal("header-creator@corp.com"))
+	Expect(createResp.JSON201.CreatedBy).To(Equal("header-creator@corp.com"))
 
 	// Soft-delete the cluster.
 	delResp, err := client.DeleteClusterByIdWithResponse(ctx, clusterID, test.WithAuthToken(ctx))
@@ -256,9 +268,9 @@ func TestCallerIdentityDelete(t *testing.T) {
 	Expect(delResp.JSON202.DeletedTime).NotTo(BeNil())
 	Expect(delResp.JSON202.DeletedBy).NotTo(BeNil())
 	// deleted_by reflects the caller identity.
-	Expect(string(*delResp.JSON202.DeletedBy)).To(Equal("creator@example.com"))
+	Expect(*delResp.JSON202.DeletedBy).To(Equal("creator@example.com"))
 	// created_by is preserved.
-	Expect(string(delResp.JSON202.CreatedBy)).To(Equal("header-creator@corp.com"))
+	Expect(delResp.JSON202.CreatedBy).To(Equal("header-creator@corp.com"))
 }
 
 func TestCallerIdentityEmptyHeaderFallback(t *testing.T) {
@@ -282,8 +294,8 @@ func TestCallerIdentityEmptyHeaderFallback(t *testing.T) {
 	)
 	Expect(err).NotTo(HaveOccurred())
 	Expect(resp.StatusCode()).To(Equal(http.StatusCreated))
-	Expect(string(resp.JSON201.CreatedBy)).To(Equal("jwt-fallback@example.com"))
-	Expect(string(resp.JSON201.UpdatedBy)).To(Equal("jwt-fallback@example.com"))
+	Expect(resp.JSON201.CreatedBy).To(Equal("jwt-fallback@example.com"))
+	Expect(resp.JSON201.UpdatedBy).To(Equal("jwt-fallback@example.com"))
 }
 
 func TestCallerIdentityOversizedHeader(t *testing.T) {
diff --git a/test/integration/clusters_test.go b/test/integration/clusters_test.go
@@ -961,7 +961,7 @@ func TestClusterSoftDelete(t *testing.T) {
 		Expect(*resp.JSON202.Id).To(Equal(cluster.ID))
 		Expect(resp.JSON202.DeletedTime).NotTo(BeNil())
 		Expect(resp.JSON202.DeletedBy).NotTo(BeNil())
-		Expect(string(*resp.JSON202.DeletedBy)).To(Equal(account.Email))
+		Expect(*resp.JSON202.DeletedBy).To(Equal(account.Email))
 	})
 
 	t.Run("given a cluster with child nodepools, when deleted, then nodepools are cascade soft-deleted in DB", func(t *testing.T) { //nolint:lll
@@ -989,7 +989,7 @@ func TestClusterSoftDelete(t *testing.T) {
 		Expect(err).NotTo(HaveOccurred())
 		Expect(delResp.StatusCode()).To(Equal(http.StatusAccepted))
 		Expect(delResp.JSON202.DeletedTime).NotTo(BeNil())
-		Expect(string(*delResp.JSON202.DeletedBy)).To(Equal(account.Email))
+		Expect(*delResp.JSON202.DeletedBy).To(Equal(account.Email))
 		// Verify cascade via direct DB query
 		dbSession := h.DBFactory.New(ctx)
 		var nodePool api.NodePool
diff --git a/test/integration/node_pools_test.go b/test/integration/node_pools_test.go
@@ -602,7 +602,7 @@ func TestNodePoolSoftDelete(t *testing.T) {
 		Expect(*resp.JSON202.Id).To(Equal(nodePoolID))
 		Expect(resp.JSON202.DeletedTime).NotTo(BeNil())
 		Expect(resp.JSON202.DeletedBy).NotTo(BeNil())
-		Expect(string(*resp.JSON202.DeletedBy)).To(Equal(account.Email))
+		Expect(*resp.JSON202.DeletedBy).To(Equal(account.Email))
 	})
 
 	t.Run("given a nodepool with Reconciled=True, when deleted, then generation increments and Reconciled becomes False", func(t *testing.T) { //nolint:lll
