fix: cannot use direct crud user update method

[orhanrauf]

Summary by cubic

Fixes user activity timestamp updates during Auth0 login by adding a safe no-auth CRUD path and using it in the auth flow. Prevents errors when updating user data before a session exists.

• Bug Fixes
  • Added crud_user.update_user_no_auth to update a user without a current_user.
  • In _authenticate_auth0_user, stop using the regular CRUD update; set last_active_at and persist via the new method.
  • Ensures login succeeds and last_active_at is updated reliably.

[cubic-dev-ai]

3 issues found across 2 files

Prompt for AI agents (all 3 issues)

Understand the root cause of the following 3 issues and fix them.


<file name="backend/airweave/crud/crud_user.py">

<violation number="1" location="backend/airweave/crud/crud_user.py:54">
Rule violated: **Check for Cursor Rules Drift**

Documenting this unauthenticated update path is required: the new `update_user_no_auth` method bypasses the CRUD invariant that every operation requires an ApiContext, so `.cursor/rules/crud-layer.mdc` must be updated to describe this exception to keep Cursor guidance accurate.</violation>

<violation number="2" location="backend/airweave/crud/crud_user.py:66">
Calling self.get here omits the required current_user argument, so update_user_no_auth will raise a TypeError and never reach the commit/refresh.</violation>
</file>

<file name="backend/airweave/api/deps.py">

<violation number="1" location="backend/airweave/api/deps.py:55">
Passing the ORM user into update_user_no_auth will crash this auth path because the method expects a UserUpdate schema and calls model_dump() on it; authentication will fail here.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

Calling self.get here omits the required current_user argument, so update_user_no_auth will raise a TypeError and never reach the commit/refresh.

Prompt for AI agents

Address the following comment on backend/airweave/crud/crud_user.py at line 66:

<comment>Calling self.get here omits the required current_user argument, so update_user_no_auth will raise a TypeError and never reach the commit/refresh.</comment>

<file context>
@@ -51,6 +51,29 @@ async def get_by_email(self, db: AsyncSession, *, email: str) -&gt; Optional[User]:
+            id (UUID): The UUID of the user to update.
+            obj_in (UserUpdate): The updated user object.
+        &quot;&quot;&quot;
+        user = await self.get(db, id=id)
+        if not user:
+            raise NotFoundException(f&quot;User with ID {id} not found&quot;)
</file context>

[cubic-dev-ai]

Passing the ORM user into update_user_no_auth will crash this auth path because the method expects a UserUpdate schema and calls model_dump() on it; authentication will fail here.

Prompt for AI agents

Address the following comment on backend/airweave/api/deps.py at line 55:

<comment>Passing the ORM user into update_user_no_auth will crash this auth path because the method expects a UserUpdate schema and calls model_dump() on it; authentication will fail here.</comment>

<file context>
@@ -50,13 +50,9 @@ async def _authenticate_auth0_user(
-    )
+    # Update last active timestamp directly (can&#39;t use CRUD during auth flow)
+    user.last_active_at = datetime.utcnow()
+    user = await crud.user.update_user_no_auth(db, id=user.id, obj_in=user)
 
     user_context = schemas.User.model_validate(user)
</file context>

Suggested change

	user = await crud.user.update_user_no_auth(db, id=user.id, obj_in=user)
	user = await crud.user.update_user_no_auth(db, id=user.id, obj_in=schemas.UserUpdate(last_active_at=user.last_active_at))

[cubic-dev-ai]

Rule violated: Check for Cursor Rules Drift

Documenting this unauthenticated update path is required: the new update_user_no_auth method bypasses the CRUD invariant that every operation requires an ApiContext, so .cursor/rules/crud-layer.mdc must be updated to describe this exception to keep Cursor guidance accurate.

Prompt for AI agents

Address the following comment on backend/airweave/crud/crud_user.py at line 54:

<comment>Documenting this unauthenticated update path is required: the new `update_user_no_auth` method bypasses the CRUD invariant that every operation requires an ApiContext, so `.cursor/rules/crud-layer.mdc` must be updated to describe this exception to keep Cursor guidance accurate.</comment>

<file context>
@@ -51,6 +51,29 @@ async def get_by_email(self, db: AsyncSession, *, email: str) -&gt; Optional[User]:
             raise NotFoundException(f&quot;User with email {email} not found&quot;)
         return db_obj
 
+    async def update_user_no_auth(self, db: AsyncSession, *, id: UUID, obj_in: UserUpdate) -&gt; User:
+        &quot;&quot;&quot;Update a user without authentication.
+
</file context>