Merged in feature/support-empty-email-jwt (pull request #209)

handle missing email in jwt

* handle missing email

api/queryAPI/eulaHandlers_test.go

@@ -244,22 +244,45 @@ func TestAgreeToEula(t *testing.T) {
 		assert.Equal(t, http.StatusUnauthorized, rec.Code)
 	})
 
-	t.Run("succeeds with username fallback when email claim is missing", func(t *testing.T) {
-		// Simulate a Cognito access token that has 'sub' and 'cognito:username'
-		// but no 'email' claim. This is the default for Cognito access tokens.
+	t.Run("succeeds with username fallback when email is missing (access token)", func(t *testing.T) {
+		// Simulate a real Cognito access token: has 'sub' and 'username' (not
+		// 'cognito:username') and no 'email'. This is the default for access tokens.
 		userSubject := "no-email-user-" + uuid.New().String()[:8]
 		ctx, rec := setupEulaTestContext(http.MethodPost, "/eula/agree", nil)
 		ctx.Request().RemoteAddr = "192.168.1.100:12345"
 
-		// Set claims with sub but without email (mimics access token)
-		ctx.Set("user_claims", map[string]interface{}{
-			"sub":              userSubject,
-			"cognito:username": "testuser",
-		})
-		ctx.Set("user_info", cognitoauth.UserInfo{
-			Username: "testuser",
-			Email:    "", // empty - no email in access token
-		})
+		// Mimic what the middleware produces from a real access token:
+		// ExtractUserInfo sees "username" (not "cognito:username") and no "email".
+		claims := map[string]interface{}{
+			"sub":       userSubject,
+			"username":  "accessuser",
+			"token_use": "access",
+		}
+		ctx.Set("user_claims", claims)
+		ctx.Set("user_info", cognitoauth.ExtractUserInfo(claims))
+
+		err := cons.AgreeToEula(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusCreated, rec.Code)
+
+		var response queryapi.EulaAgreementResponse
+		err = json.Unmarshal(rec.Body.Bytes(), &response)
+		require.NoError(t, err)
+		assert.Equal(t, versionStr, response.EulaVersion)
+	})
+
+	t.Run("succeeds with subject ID fallback when email and username are both missing", func(t *testing.T) {
+		// Edge case: token has sub but neither email nor any username claim.
+		userSubject := "bare-token-user-" + uuid.New().String()[:8]
+		ctx, rec := setupEulaTestContext(http.MethodPost, "/eula/agree", nil)
+		ctx.Request().RemoteAddr = "192.168.1.100:12345"
+
+		claims := map[string]interface{}{
+			"sub":       userSubject,
+			"token_use": "access",
+		}
+		ctx.Set("user_claims", claims)
+		ctx.Set("user_info", cognitoauth.ExtractUserInfo(claims))
 
 		err := cons.AgreeToEula(ctx)
 		require.NoError(t, err)