refactor: rename user.username to trinoUser

The field holds the Trino user we impersonate, not a login name. Rename the
column to trino_user in the initial migration; there is no release yet, so no
new migration is needed.

Author: Bohreromir

e2e/auth/auth.spec.ts

@@ -48,19 +48,22 @@ test.describe('Authentication', () => {
     await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
   });
 
-  test('username cannot be changed through the update-user endpoint', async ({ page, baseURL }) => {
+  test('trinoUser cannot be changed through the update-user endpoint', async ({
+    page,
+    baseURL
+  }) => {
     const res = await page.request.post('/api/auth/update-user', {
       headers: { origin: baseURL! },
-      data: { username: 'someone-else' }
+      data: { trinoUser: 'someone-else' }
     });
     expect(res.status()).toBe(403);
-    expect(await res.json()).toMatchObject({ message: 'username is not allowed to be set' });
+    expect(await res.json()).toMatchObject({ message: 'trinoUser is not allowed to be set' });
 
     const session = await (await page.request.get('/api/auth/get-session')).json();
-    expect(session.user.username).toMatch(/^testuser\d+$/);
+    expect(session.user.trinoUser).toMatch(/^testuser\d+$/);
   });
 
-  test('a later login refreshes the username from the OIDC claim', async ({ browser }) => {
+  test('a later login refreshes the Trino user from the OIDC claim', async ({ browser }) => {
     const context = await browser.newContext({ storageState: { cookies: [], origins: [] } });
     const page = await context.newPage();
     const sub = `relogin-${crypto.randomUUID()}`;
@@ -91,11 +94,11 @@ test.describe('Authentication', () => {
 
     try {
       const first = await loginAs(`${sub}-old`);
-      expect(first.username).toBe(`${sub}-old`);
+      expect(first.trinoUser).toBe(`${sub}-old`);
 
       const second = await loginAs(`${sub}-new`);
       expect(second.id).toBe(first.id);
-      expect(second.username).toBe(`${sub}-new`);
+      expect(second.trinoUser).toBe(`${sub}-new`);
     } finally {
       await context.close();
     }

e2e/support/mock-trino.ts

@@ -22,7 +22,7 @@ export function mockMarker(): string {
 }
 
 /** Statements containing `marker` that reached the mock, and their cancellations. */
-async function mockTrinoLog(marker: string): Promise<MockTrinoLogEntry[]> {
+export async function mockTrinoLog(marker: string): Promise<MockTrinoLogEntry[]> {
   const res = await fetch(`${MOCK_TRINO_URL}/__mock/log?marker=${encodeURIComponent(marker)}`);
   if (!res.ok) {
     throw new Error(`Mock Trino log request failed: ${res.status} ${res.statusText}`);

e2e/trino/query-api.spec.ts

@@ -87,10 +87,10 @@ test.describe('Trino API', () => {
       });
 
       const session = await (await page.request.get('/api/auth/get-session')).json();
-      expect(session.user.username).toMatch(/^testuser\d+$/);
+      expect(session.user.trinoUser).toMatch(/^testuser\d+$/);
       await expect
         .poll(async () => (await mockTrinoLog(marker)).map((e) => e.user))
-        .toEqual([session.user.username]);
+        .toEqual([session.user.trinoUser]);
     });
 
     // The marker goes into a name the endpoint puts in its SQL, so the mock log
@@ -105,8 +105,8 @@ test.describe('Trino API', () => {
         expect(res.status()).toBe(200);
 
         const session = await (await page.request.get('/api/auth/get-session')).json();
-        expect(session.user.username).toMatch(/^testuser\d+$/);
-        expect((await mockTrinoLog(marker)).map((e) => e.user)).toEqual([session.user.username]);
+        expect(session.user.trinoUser).toMatch(/^testuser\d+$/);
+        expect((await mockTrinoLog(marker)).map((e) => e.user)).toEqual([session.user.trinoUser]);
       });
     }
 

src/lib/server/auth-schema.ts

@@ -12,7 +12,7 @@ export const user = pgTable('user', {
     .defaultNow()
     .$onUpdate(() => /* @__PURE__ */ new Date())
     .notNull(),
-  username: text('username')
+  trinoUser: text('trino_user')
 });
 
 export const session = pgTable(

src/lib/server/auth-utils.test.ts

@@ -21,8 +21,8 @@ describe('getUserId', () => {
 describe('getTrinoUser', () => {
   const logger = { error: vi.fn() };
 
-  it('returns the username of the signed-in user', () => {
-    const locals = { user: { id: 'u1', username: 'alice' }, logger } as unknown as App.Locals;
+  it('returns the Trino user of the signed-in user', () => {
+    const locals = { user: { id: 'u1', trinoUser: 'alice' }, logger } as unknown as App.Locals;
     expect(getTrinoUser(locals)).toBe('alice');
   });
 
@@ -31,8 +31,8 @@ describe('getTrinoUser', () => {
     expect(getTrinoUser(locals)).toBe('anonymous');
   });
 
-  it('fails instead of falling back to "anonymous" when the username is missing', () => {
-    const locals = { user: { id: 'u1', username: null }, logger } as unknown as App.Locals;
+  it('fails instead of falling back to "anonymous" when the Trino user is missing', () => {
+    const locals = { user: { id: 'u1', trinoUser: null }, logger } as unknown as App.Locals;
     expect(() => getTrinoUser(locals)).toThrow(expect.objectContaining({ status: 500 }));
     expect(logger.error).toHaveBeenCalledWith({ user_id: 'u1' }, expect.any(String));
   });
@@ -41,8 +41,8 @@ describe('getTrinoUser', () => {
 describe('findTrinoUser', () => {
   const logger = { error: vi.fn() };
 
-  it('returns null instead of "anonymous" when the username is missing', () => {
-    const locals = { user: { id: 'u1', username: null }, logger } as unknown as App.Locals;
+  it('returns null instead of "anonymous" when the Trino user is missing', () => {
+    const locals = { user: { id: 'u1', trinoUser: null }, logger } as unknown as App.Locals;
     expect(findTrinoUser(locals)).toBeNull();
     expect(logger.error).toHaveBeenCalledWith({ user_id: 'u1' }, expect.any(String));
   });

src/lib/server/auth-utils.ts

@@ -6,17 +6,17 @@ export function getUserId(locals: App.Locals): string {
 
 /**
  * The user to impersonate in Trino. Without OIDC there is no signed-in user,
- * so queries run as 'anonymous'. A signed-in user without a username means
+ * so queries run as 'anonymous'. A signed-in user without a Trino user means
  * sign-up lost the OIDC claim; return null instead of falling back to 'anonymous'.
  */
 export function findTrinoUser(locals: App.Locals): string | null {
   if (!locals.user) return 'anonymous';
-  if (locals.user.username) return locals.user.username;
-  locals.logger.error({ user_id: locals.user.id }, 'Signed-in user has no Trino username');
+  if (locals.user.trinoUser) return locals.user.trinoUser;
+  locals.logger.error({ user_id: locals.user.id }, 'Signed-in user has no Trino user');
   return null;
 }
 
-/** Like {@link findTrinoUser}, but fails the request when there is no username. */
+/** Like {@link findTrinoUser}, but fails the request when there is no Trino user. */
 export function getTrinoUser(locals: App.Locals): string {
-  return findTrinoUser(locals) ?? error(500, 'User has no Trino username');
+  return findTrinoUser(locals) ?? error(500, 'User has no Trino user');
 }

src/lib/server/auth.test.ts

@@ -8,29 +8,29 @@ const create = (data: Record<string, unknown>, path: string) =>
 const update = (data: Record<string, unknown>, path: string) =>
   hooks.update!.before!(data as never, { path } as never);
 
-describe('user.additionalFields.username', () => {
+describe('user.additionalFields.trinoUser', () => {
   it('is taken from the OIDC provider profile', () => {
     expect(
-      parseAdditionalUserInputFromProviderProfile(auth.options, { username: 'alice' }, 'create')
-    ).toMatchObject({ username: 'alice' });
+      parseAdditionalUserInputFromProviderProfile(auth.options, { trinoUser: 'alice' }, 'create')
+    ).toMatchObject({ trinoUser: 'alice' });
   });
 
   it('may be written by the OIDC callback', async () => {
     await expect(
-      create({ email: 'alice@example.com', username: 'alice' }, '/oauth2/callback/:providerId')
+      create({ email: 'alice@example.com', trinoUser: 'alice' }, '/oauth2/callback/:providerId')
     ).resolves.toBeUndefined();
   });
 
   it('rejects a rewrite through the built-in update-user endpoint', async () => {
-    await expect(update({ username: 'someone-else' }, '/update-user')).rejects.toThrow(
-      /username is not allowed to be set/
+    await expect(update({ trinoUser: 'someone-else' }, '/update-user')).rejects.toThrow(
+      /trinoUser is not allowed to be set/
     );
   });
 
   it('rejects a rewrite smuggled in at sign-up', async () => {
     await expect(
-      create({ email: 'eve@example.com', username: 'someone-else' }, '/sign-up/email')
-    ).rejects.toThrow(/username is not allowed to be set/);
+      create({ email: 'eve@example.com', trinoUser: 'someone-else' }, '/sign-up/email')
+    ).rejects.toThrow(/trinoUser is not allowed to be set/);
   });
 
   it('leaves other user updates alone', async () => {

src/lib/server/auth.ts

@@ -16,16 +16,16 @@ const env = envModule?.env ?? (process.env as Record<string, string | undefined>
 const getRequestEvent = appServer?.getRequestEvent ?? (() => undefined as unknown as RequestEvent);
 const log = loggingModule?.logger.child({ module: 'auth' });
 
-// The username is the Trino user we impersonate, so only the OIDC callback may
+// trinoUser is the Trino user we impersonate, so only the OIDC callback may
 // write it. Marking the field `input: false` would also block that: better-auth
 // drops such fields from the provider profile on sign-up (see #371). Database
 // hooks see the endpoint's route template, not the request path.
-const usernameWritePath = '/oauth2/callback/:providerId';
+const trinoUserWritePath = '/oauth2/callback/:providerId';
 
-function guardUsernameWrite(data: Record<string, unknown>, context: { path?: string } | null) {
-  if (!('username' in data) || context?.path === usernameWritePath) return;
-  log?.warn({ path: context?.path }, 'Rejected username write outside the OIDC callback');
-  throw new APIError('FORBIDDEN', { message: 'username is not allowed to be set' });
+function guardTrinoUserWrite(data: Record<string, unknown>, context: { path?: string } | null) {
+  if (!('trinoUser' in data) || context?.path === trinoUserWritePath) return;
+  log?.warn({ path: context?.path }, 'Rejected trinoUser write outside the OIDC callback');
+  throw new APIError('FORBIDDEN', { message: 'trinoUser is not allowed to be set' });
 }
 
 const trinoUserClaim = env.STACKABLE_COCKPIT_TRINO_USER_CLAIM ?? 'preferred_username';
@@ -68,16 +68,16 @@ export const auth = betterAuth({
   },
   user: {
     additionalFields: {
-      username: {
+      trinoUser: {
         type: 'string',
         required: false
       }
     }
   },
   databaseHooks: {
     user: {
-      create: { before: async (user, context) => guardUsernameWrite(user, context) },
-      update: { before: async (user, context) => guardUsernameWrite(user, context) }
+      create: { before: async (user, context) => guardTrinoUserWrite(user, context) },
+      update: { before: async (user, context) => guardTrinoUserWrite(user, context) }
     }
   },
   plugins: [
@@ -101,8 +101,8 @@ export const auth = betterAuth({
                   const fullName = [profile.given_name, profile.family_name]
                     .filter(Boolean)
                     .join(' ');
-                  const trinoUser = profile[trinoUserClaim];
-                  if (trinoUser) {
+                  const claimedTrinoUser = profile[trinoUserClaim];
+                  if (claimedTrinoUser) {
                     log?.debug(
                       { trino_user_claim: trinoUserClaim },
                       'Resolved Trino user from OIDC claim'
@@ -119,8 +119,8 @@ export const auth = betterAuth({
                     emailVerified: profile.email_verified ?? false,
                     image: profile.picture || null,
                     // No `|| ''`: without an email better-auth rejects the sign-in before
-                    // creating the user, so this never stores an empty username.
-                    username: trinoUser || profile.preferred_username || profile.email
+                    // creating the user, so this never stores an empty Trino user.
+                    trinoUser: claimedTrinoUser || profile.preferred_username || profile.email
                   };
                 }
               }

src/lib/server/migrations/0000_initial_schema.sql

@@ -47,7 +47,7 @@ CREATE TABLE "user" (
 	"image" text,
 	"created_at" timestamp DEFAULT now() NOT NULL,
 	"updated_at" timestamp DEFAULT now() NOT NULL,
-	"username" text,
+	"trino_user" text,
 	CONSTRAINT "user_email_unique" UNIQUE("email")
 );
 --> statement-breakpoint

src/lib/server/migrations/meta/0000_snapshot.json

@@ -358,8 +358,8 @@
           "notNull": true,
           "default": "now()"
         },
-        "username": {
-          "name": "username",
+        "trino_user": {
+          "name": "trino_user",
           "type": "text",
           "primaryKey": false,
           "notNull": false