Fix Heimdall principal claims pattern for client IDs (LFXV2-922)

[emsearcy]

Description

This PR fixes the Heimdall principal claims pattern for client IDs to match the Auth0 convention.

Changes

• Constants: Renamed MachineUserPrefix to MachineUserSuffix and changed value from "clients@" to "@clients"
• Machine User Detection: Updated logic to use strings.HasSuffix instead of strings.HasPrefix
• Authentication Repository: Modified machine user detection in both main logic and helper method
• Tests: Updated test cases to use the correct suffix pattern ("test-machine@clients")
• Documentation: Updated README to reflect suffix-based machine user identification

Background

While working on the mock data loader and v1 meetings, it was discovered that the PoC implementation had reversed the {client_id}@clients pattern used by Auth0. This change corrects the pattern to align with Auth0's expected format across the indexer service.

Files Modified

• pkg/constants/auth.go - Updated constant name and value
• internal/infrastructure/auth/auth_repository.go - Updated detection logic
• internal/infrastructure/auth/auth_repository_test.go - Updated test cases
• README.md - Updated documentation

Testing

All existing tests continue to pass with the updated logic.

Related Issues

• Related to LFXV2-922: Review & fix local Heimdall principal claims

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b94e54ff-7388-44ad-b497-9fcf55d15db5

📥 Commits

Reviewing files that changed from the base of the PR and between 3989554 and 2075679.

📒 Files selected for processing (4)

• README.md
• internal/infrastructure/auth/auth_repository.go
• internal/infrastructure/auth/auth_repository_test.go
• pkg/constants/auth.go

✅ Files skipped from review due to trivial changes (1)

• README.md

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/constants/auth.go
• internal/infrastructure/auth/auth_repository.go

---

Walkthrough

Switches machine user detection from prefix-based (clients@) to suffix-based (@clients) by renaming the constant and updating authentication logic, logging, tests, and README to use the suffix pattern.

Changes

Cohort / File(s)	Summary
Constants Update pkg/constants/auth.go	Renamed MachineUserPrefix → MachineUserSuffix and changed value from "clients@" to "@clients".
Authentication Implementation internal/infrastructure/auth/auth_repository.go	Replaced prefix checks with suffix checks (strings.HasSuffix using MachineUserSuffix); updated logged field name from machine_user_prefix → machine_user_suffix; safePrincipalLog now returns full principal for machine users (unmasked).
Authentication Tests internal/infrastructure/auth/auth_repository_test.go	Updated tests to use suffix-based machine user principals ("test-machine" + constants.MachineUserSuffix) and assert safePrincipalLog returns the unredacted principal for machine users.
Documentation README.md	Updated machine user detection description from prefix-based (clients@) to suffix-based (@clients).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing the Heimdall principal claims pattern for client IDs to match Auth0 convention, which is the core objective of this pull request.
Description check	✅ Passed	The description comprehensively explains the changes, provides background context about the Auth0 pattern correction, lists all modified files, and references the related issue LFXV2-922.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR corrects the Heimdall principal claims pattern for machine users from a prefix-based approach (clients@{client_id}) to a suffix-based approach ({client_id}@clients) to align with Auth0's standard convention.

• Renamed constant from MachineUserPrefix to MachineUserSuffix with updated value "@clients"
• Updated detection logic throughout the codebase to use HasSuffix instead of HasPrefix
• Modified tests to reflect the corrected pattern

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pkg/constants/auth.go	Renamed constant and changed value from "clients@" to "@clients"
internal/infrastructure/auth/auth_repository.go	Updated machine user detection to use suffix-based pattern matching and updated log field names
internal/infrastructure/auth/auth_repository_test.go	Updated test case to use correct suffix pattern with the renamed constant
README.md	Updated documentation to reflect suffix-based machine user identification

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.