[DT-4011] Map SamAzureB2CException to 409 on GET /api/user/me - #3032
Merged
Conversation
Sam rejects users whose azureB2cId cannot be updated (previously signed in with a different provider). GET /api/user/me answered 500 for these users, or 404 when they had no Consent row - both send the client down a dead end. - Register SamAzureB2CException in Resource.DISPATCH as a 409 Conflict. - Reuse the actionable "different authentication provider" message with the Terra support link on the combinedState path; both Sam paths now build it from one method. - Skip the async registration post when Sam reports the B2C conflict - it always answered 409 and only added log noise. - Probe Sam before answering 404 for an unregistered caller with no auth-filter status, so the conflict answers 409 instead of sending the user into a registration that cannot succeed. - Clean up two Sonar S3457 warnings in SamDAO.getErrorMessage and the S1141 nested try in UserResource.getUser. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request adjusts /api/user/me error handling so that Sam Azure B2C identity-conflict cases return 409 Conflict (with an actionable message) instead of falling back to 500 or being misrouted to 404 registration behavior. It does this by mapping SamAzureB2CException to 409 at the shared Resource.createExceptionResponse dispatch layer, and by probing Sam before returning 404 when the auth filter did not provide a Sam status.
Changes:
- Map
SamAzureB2CExceptionto 409 Conflict in the centralized exception dispatch (Resource.DISPATCH) and document the new 409 response in OpenAPI. - Consolidate the Azure B2C conflict message generation into
SamDAO.getAzureB2CErrorMessage(...)and reuse it across Sam error paths. - Update
/meflow and tests so unregistered users with a B2C identity conflict return 409 and do not trigger async registration posting.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/test/java/org/broadinstitute/consent/http/service/dao/SamDAOTest.java | Extends assertions to verify the B2C conflict message includes actionable guidance and the Terra support link. |
| src/test/java/org/broadinstitute/consent/http/resources/UserResourceTest.java | Adds coverage for 409-on-conflict behavior and verifies no registration post occurs; updates existing tests to expect 409 instead of 500. |
| src/main/resources/assets/api-docs.yaml | Documents the new 409 response for GET /api/user/me with ErrorResponse schema. |
| src/main/java/org/broadinstitute/consent/http/service/sam/SamService.java | Adjusts getCombinedUserStatusInfo to accept AuthUser, enabling /me probing without requiring a DUOS User. |
| src/main/java/org/broadinstitute/consent/http/resources/UserResource.java | Probes Sam to surface B2C conflicts as 409 for otherwise-unregistered callers; avoids async registration posting on conflict. |
| src/main/java/org/broadinstitute/consent/http/resources/Resource.java | Registers SamAzureB2CException in the exception-to-response dispatch map as 409 Conflict. |
| src/main/java/org/broadinstitute/consent/http/db/SamDAO.java | Reuses a single helper for the B2C conflict message and resolves format-string issues in getErrorMessage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
rushtong
marked this pull request as ready for review
August 24, 2026 17:46
rushtong
requested review from
fboulnois and
kevinmarete
and removed request for
a team
August 24, 2026 17:46
kevinmarete
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses
https://broadworkbench.atlassian.net/browse/DT-4011
Summary
Sam rejects users whose
azureB2cIdcannot be updated (they previously signed in with a different provider).GET /api/user/meresponded with 500 for these users, or 404 when they had no entry in Consent. Both answers send the client down a dead end: the 500 aborts sign-in with a generic message, and the 404 sends the user into a registration that cannot succeed.Changes
SamAzureB2CExceptioninResource.DISPATCHas a 409 Conflict instead of the fallback 500.SamDAO.getAzureB2CErrorMessage.SamDAO.getErrorMessage, and the S1141 nested try inUserResource.getUser./menow has three outcomes: 200 registered, 404 start registration, 409 provider conflict.Testing
/metests now assert 409; the SamDAO B2C test asserts the actionable message and support link.🤖 Generated with Claude Code