1.8.0: milestone batch (#644 #645 #646 #648 #649 #656 #663)

[ericfitz]

Seven milestone issues, each implemented as its own commit with a spec-and-quality review pass, plus the 1.8.0 version bump. Reviewed end to end by an Oracle DBA gate (2 blocking findings, fixed and re-approved), a whole-branch review (READY), and a security review (1 Medium, fixed).

Closes #644
Closes #645
Closes #646
Closes #648
Closes #649
Closes #656
Closes #663

What's in it

#648 — SAML login no longer corrupts stored profiles. updateSAMLUserOnLogin was overwriting the stored name on every login with no guard, and never updating email. A bare != "" check would not have fixed it: the attribute pipeline synthesizes <subject>@<provider>.saml.tmi and derives a name from that local-part, so the value is never empty — just garbage. saml.UserInfo now carries EmailSynthesized/NameSynthesized flags, and updates are tier-aware, mirroring the OAuth path. given_name/family_name become operator-mappable per provider via SAML_PROVIDERS_<ID>_GIVEN_NAME_ATTRIBUTE / _FAMILY_NAME_ATTRIBUTE.

#645 — paginated list sorts are stable. Every generated ORDER BY in the threat store, plus the fixed orderings in the asset/document/note/repository stores, now carries a unique id tiebreaker, so rows tied on the sort key can no longer shuffle between LIMIT/OFFSET windows (duplicated and dropped rows while paging). The status rank map now covers the real vocabulary, keeping legacy values at nearby ranks.

#649 — quota defaults agree with themselves. UserAPIQuota.MaxRequestsPerMinute GORM default 100 → 1000 and AddonInvocationQuota.MaxActiveInvocations 1 → 3, matching the app constants (the addon mismatch was found during the work, not in the issue). The three admin quota list responses now carry a required defaults block so clients stop transcribing Go constants.

#663 — bulk limits are pinned to the spec. A unit test loads the embedded OpenAPI document and asserts every constant in api/bulk_limits.go equals the maxItems of the operations it guards, bidirectionally for the per-entity metadata map. Both drift directions had already happened in this repo.

#644 — features.timmy_enabled on GET /config, true only when Timmy is both enabled and fully configured — the same two-stage gate the middleware enforces, so the flag never advertises an endpoint that would 503.

#656 — is_builtin on AdminGroup + a built_in filter. Derived from the fixed seeded-group UUID allowlist (validation.IsBuiltInGroup, the same predicate the GORM protection hooks use) rather than a persisted column or name matching, so it cannot drift or collide with admin-created groups — which share the tmi provider, the reason the client's name-matching workaround existed.

#646 — admin endpoints for a user's linked sign-in identities. GET /admin/users/{user_id}/identities and DELETE .../identities/{identity_id}. The primary identity lives on the user record and so is structurally not unlinkable; content-provider tokens are deliberately untouched (admins revoke those via the existing content_tokens endpoints); no admin link endpoint by design, since linking needs the target user's own consent.

Findings from the review gates

Oracle (BLOCKING, fixed): buildSemanticOrderExpr iterated its rank map with a bare range, so CASE WHEN clause order was random per call. With GORM's uncapped PrepareStmt cache and sorted queries bypassing the query cache, every status-sorted request on Oracle minted a fresh prepared statement and open cursor — ORA-01000 on a hot endpoint, invisible on PostgreSQL. Keys are now sorted before emission. Separately, threat_type was a documented sortable column but maps to CLOB on Oracle, which rejects ORDER BY on LOBs (ORA-00932 → an Oracle-only 500); it was removed from the whitelist and now degrades to the default order.

Security (Medium, fixed): a linked (secondary) SAML identity could rewrite the authoritative users.email. The OAuth path deliberately has no linked-identity update case — a linked identity's email is display cache only — so strongMatch now admits the provider-id tier alone.

Release notes

• sort=threat_type now falls back to the default order instead of sorting by threat type. It was only ever sortable on PostgreSQL and errored on Oracle; the parameter is a free-form string with no enum, so this is spec-legal, but a saved client query using it changes behavior silently.
• DELETE /admin/users/{user_id}/identities/{identity_id} is step-up gated (consistent with other user-credential-adjacent admin writes). An admin whose token is older than the step-up window gets a 401 with a WWW-Authenticate challenge; the client needs to handle that.

Verification

• make lint clean, make build-server prints 1.8.0, make test-unit 2487 passed / 0 failed / 10 skipped.
• make test-integration green, including a new TestSortPaginationStability_Integration. Getting there required tidying the test/integration nested module, which had drifted since chore(deps): bump the go-minor-patch group with 5 updates #676/chore(deps): bump dependencies #680 and left the workflow tests unbuildable — that drift had been masking two pre-existing webhook test failures, now filed as fix(test): TestWebhookDelivery shared-fixture race — subtests intermittently see prior subtest's delivery status #691.
• The PostgreSQL pagination test was mutation-tested and does not catch a reverted tiebreaker (PG's sort was stable on a fresh fixture), so its doc comment says so plainly; the property that is proven to catch it is the pinned ORDER BY text in TestBuildOrderBy/TestBuildSemanticOrderExpr, verified by reverting the fix and watching it fail.
• CATS campaign run against the dev cluster post-merge; it also verifies chore: isolate CATS "Not matching response schema" false-positive trigger and report upstream #637's example-completion fix.

Follow-ups filed

#682 (Oracle column-default backfill), #684 (PrepareStmtMaxSize cap — the Oracle SME asked for this first), #685 (ORA-00932/01000/04031 classification), #686 (id DESC + composite-index optimization), #687 (EmailVerified downgrade on token mint), #688 (narrow the Timmy settings read on public /config), #689 (compile gate for build-tagged test files), #690 (nested-module tidy automation), #691 (webhook test flake).

🤖 Generated with Claude Code

https://claude.ai/code/session_01PhifvpsfXEJcxhYS2No4pD