Field "email" is not populated during Airlock Import creation

[migldasilva]

Describe the bug

I'm working with a deployment of AzureTRE and have installed Airlock Notifier. I was reviewing the JSON data used as input for Airlock Notifier. I could check that the structure is populated the following way:

{
  "event_type": "status_changed",
  "recipient_emails_by_role": {
    "workspace_researcher": [
      "researcher_1@domain.com",
      "researcher_2@domain.com",
      ...
      "researcher_N@domain.com"
    ],
    "workspace_owner": [
      "owner_1@domain.com",
      "owner_2@domain.com",
      ...
      "owner_N@domain.com"
    ],
    "airlock_manager": [
      "manager_1@domain.com",
      "manager_2@domain.com",
      ...
      "manager_N@domain.com"
    ]
  },
  "request": {
    "id": "11111111-2222-3333-4444-555555555555",
    "created_when": 1684400625.173648,
    "created_by": {
      "name": "Miguel Dasilva",
      "email": ""
    },
    "updated_when": 1684400746.058016,
    "updated_by": {
      "name": "Airlock Admin User",
      "email": ""
    },
    "request_type": "import",
    "files": [
      {
        "name": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/random_text_file.txt",
        "size": 0
      }
    ],
    "status": "approved",
    "business_justification": "Testing import"
  },
  "workspace": {
    "id": "kkkkkkkk-2323-5454-7777-1234567890ab",
    "display_name": "My workspace name",
    "description": "My workspace description"
  }
}

Checking the JSON returned, is it not expected that the email fields in created_byand updated_by should store the emails of the given users. I supposed that this email (just like the real name) is stored and retrieved from AAD.

I have been reviewing the code for the Airlock Notifier, and Airlock Processor, but couldn't find the code responsible for generating the JSON data. I could verify that messages are correctly sent through the Service Bus' topics (theses messages are generated by the Airlock Notifier).

Are those fields supposed to be empty? Or should they really store email addresses?

Steps to reproduce

1. Create an import request
2. Check the workflow runs for the Logic App responsible for sending notifications

[tamirkamara]

Thanks for opening the issue.
Perhaps @LizaShak can help in identifying the right place in the code where we create the payload?

[LizaShak]

Hi @migldasilva, the email in the created_by/updated_by user info is taken from the token. If this field is empty that means the claim "email" wasn't present or empty for the creating/updating user. This screenshot shows how you can see if the email is set for the user in AAD-

But it doesn't affect the airlock notification recipients list. The recipients are taken from recipient_emails_by_role object.

[LizaShak]

@migldasilva I understood you are trying to use these fields for changing the method and sending the notification to the person who created/updated the request.
After looking a bit more into it, i saw that that even if the email is set we don't get it as a claim in the token, therefore it remains empty. We should look more deeply into it and understand the right way to fix that. CC: @tamirkamara .

[migldasilva]

Thanks @LizaShak for the support. I did the same tests as you. Even setting the email field in AAD, the field in the JSON is not populated. I have also tested Other emails AAD field, but had the same results.

[LizaShak]

@migldasilva yes I saw that too, as I mentioned in my second comment, we should look into it and fix that.

[migldasilva]

@LizaShak @tamirkamara Could you get more insights about this issue?