* fix(jwt): attribute spend to resolved DB user_id on email/sso fuzzy match
When user_id_upsert is enabled with JWT auth and a pre-migration user row
exists whose user_email matches the JWT email but whose user_id is a UUID,
get_user_object resolves the legacy row via fuzzy lookup, but the JWT-claim
user_id (the email) still flowed into team-membership lookup,
JWTAuthBuilderResult.user_id, UserAPIKeyAuth and the spend tables. Spend was
orphaned under a phantom email id; /user/info and the Usage page showed $0
for the legacy user (GH #26789).
Treat the resolved user_object as the source of truth: add
_canonical_user_id_from_db, rebind inside get_objects, and return
effective_user_id so auth_builder unpacks it without adding statements.
Fixes#26789
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(jwt): log user_id rebind at DEBUG to avoid email PII in INFO streams
Greptile review on #29217: rebinding often logs JWT email claims at INFO.
Co-authored-by: Cursor <cursoragent@cursor.com>
* test(jwt): update passthrough allowlist mock for 5-tuple get_objects
Staging #29256 added a test that still mocked get_objects with a
4-tuple; our PR expanded the return to 5 values (effective_user_id).
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
b7f47a3b52