Exclude mapped body fields from user document

Author: ujibang

accounts/src/main/java/org/restheart/accounts/RegisterService.java

@@ -101,7 +101,10 @@
  * {@code required: [...]} mandates them.  Service-managed fields
  * ({@code _id}, {@code password}, {@code roles}, {@code profile.name},
  * {@code profile.surname}, {@code emailVerificationToken},
- * {@code emailVerificationCreatedAt}) are never overwritten by the body.
+ * {@code emailVerificationCreatedAt}) are never overwritten by the body, and the
+ * body fields of the mapping table above ({@code firstName}, {@code lastName},
+ * {@code email}, {@code teamName}) are not carried over either — they already
+ * reach the document, or the team, through that mapping.
  *
  * <p><strong>The document is validated as it is inserted, which is not its final shape.</strong>
  * {@code createInitialTeam} runs after the insert and adds {@code teams} and {@code team}
@@ -279,8 +282,8 @@ public void handle(JsonRequest req, JsonResponse res) throws Exception {
         // remaining body fields are carried into the document as-is; the schema
         // becomes the contract — additionalProperties:false rejects extensions,
         // required:[...] mandates them.
-        // Service-managed fields (_id, password, roles, profile.name, profile.surname,
-        // emailVerificationToken, emailVerificationCreatedAt) are never overwritten.
+        // Service-managed fields are never overwritten, and the mapped body fields
+        // (firstName, lastName, email, teamName) are not carried over as extras.
         if (db(req).hasSchema()) {
             mergeExtraBodyProperties(body, userDoc);
         }
@@ -357,12 +360,24 @@ private static String extractString(JsonObject obj, String key) {
     }
 
     /**
-     * Top-level fields managed by the registration service.  These are never
-     * overwritten by additional body properties.
+     * Body keys that must not be carried into the user document as additional
+     * properties.
+     *
+     * <p>Two groups: the document fields the service owns ({@code _id},
+     * {@code password}, {@code roles}, {@code profile},
+     * {@code emailVerificationToken}, {@code emailVerificationCreatedAt}), and the
+     * body fields the mapping table sends somewhere else ({@code firstName} and
+     * {@code lastName} to {@code profile.name}/{@code profile.surname},
+     * {@code email} to {@code _id}, {@code teamName} to the team document). Without
+     * the second group the stored document would duplicate its own mapped fields
+     * and carry the team name, and a schema with {@code additionalProperties: false}
+     * would reject every registration over properties the client never sent as
+     * extras.
      */
     private static final java.util.Set<String> SERVICE_MANAGED_FIELDS = java.util.Set.of(
             "_id", "password", "roles", "profile",
-            "emailVerificationToken", "emailVerificationCreatedAt");
+            "emailVerificationToken", "emailVerificationCreatedAt",
+            "firstName", "lastName", "email", "teamName");
 
     /**
      * Fields inside {@code profile} managed by the registration service.

core/src/test/java/karate/accounts/register-schema-validation.feature

@@ -342,6 +342,77 @@ Feature: Apply JSON Schema on user registration
     When method PATCH
     Then assert responseStatus == 200
 
+  # ---------------------------------------------------------------------------
+  Scenario: mapped body fields are not carried over as additional properties
+  # ---------------------------------------------------------------------------
+    # firstName/lastName/email/teamName already reach the document through the
+    # mapping table (profile.name, profile.surname, _id) or the team document, so
+    # they must not also land as top-level properties. additionalProperties:false
+    # is what makes this observable: the tenant declares the document it expects,
+    # and a leaked mapped field fails the registration it never asked for.
+    * header Authorization = adminAuth
+    Given path schemas
+    And request
+      """
+      {
+        "_id": "user-no-extras",
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["_id", "password", "roles", "profile"],
+        "properties": {
+          "_id":      { "type": "string" },
+          "_etag":    { "type": "object" },
+          "password": { "type": "string" },
+          "roles":    { "type": "array" },
+          "profile": {
+            "type": "object",
+            "properties": {
+              "name":    { "type": "string" },
+              "surname": { "type": "string" }
+            }
+          },
+          "consents": { "type": "object" },
+          "emailVerificationToken":     { "type": "string" },
+          "emailVerificationCreatedAt": { "type": "object" }
+        }
+      }
+      """
+    When method POST
+    Then assert responseStatus == 201 || responseStatus == 409
+
+    * header Authorization = adminAuth
+    Given path usersColl
+    And request { "jsonSchema": { "schemaId": "user-no-extras" } }
+    When method PATCH
+    Then assert responseStatus == 200
+
+    * def email = 'reg-no-extras-' + java.util.UUID.randomUUID() + '@example.com'
+
+    Given path '/auth/register'
+    And request { "firstName": "Schema", "lastName": "Test", "teamName": "ST Corp", "email": "#(email)", "password": "Password123!", "consents": { "terms": true } }
+    When method POST
+    Then status 201
+
+    * header Authorization = adminAuth
+    Given path usersColl + '/' + email
+    When method GET
+    Then status 200
+    # the mapped fields landed where the mapping table says, and nowhere else
+    And match response.profile.name == 'Schema'
+    And match response.profile.surname == 'Test'
+    And match response.consents.terms == true
+    And match response !contains { firstName: '#notnull' }
+    And match response !contains { lastName: '#notnull' }
+    And match response !contains { teamName: '#notnull' }
+    And match response !contains { email: '#notnull' }
+
+    * header Authorization = adminAuth
+    Given path usersColl
+    And request { "jsonSchema": null }
+    When method PATCH
+    Then assert responseStatus == 200
+
   # ---------------------------------------------------------------------------
   Scenario: extra body properties are dropped when no schema is configured
   # ---------------------------------------------------------------------------