fix(security): audit user = custom:idp_username, not the sub UUID (PR #318 #4)

authentication.getName() drives the ENTRY_/UPDATE_USERID VARCHAR2(30) audit columns on
every admin write. The converter returned the token with no name, so getName() defaulted
to the Cognito sub (~36-char UUID), which overflows the column (ORA-12899) in production.
Set the principal name to custom:idp_username (sized for it per the FAM identity contract),
falling back to the sub only if the claim is absent. App-wide fix (also code-tables / 24.1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gpascucci

backend/src/main/java/ca/bc/gov/nrs/ilcr/security/CognitoGroupsJwtAuthenticationConverter.java

@@ -37,7 +37,19 @@ public AbstractAuthenticationToken convert(Jwt jwt) {
         authorities.add(new SimpleGrantedAuthority(role.name()));
       }
     }
-    return new JwtAuthenticationToken(jwt, authorities);
+    return new JwtAuthenticationToken(jwt, authorities, auditUsername(jwt));
+  }
+
+  /**
+   * The principal name — i.e. {@code authentication.getName()}, which every admin write stamps into
+   * the {@code ENTRY_/UPDATE_USERID VARCHAR2(30)} audit columns. FAM's {@code custom:idp_username} is
+   * sized for that (per the identity contract); without this the token name defaults to the {@code sub}
+   * (a ~36-char Cognito UUID), which overflows the column (ORA-12899) on every write in production.
+   * Falls back to the {@code sub} only when the claim is absent (defensive; never expected with FAM).
+   */
+  private static String auditUsername(Jwt jwt) {
+    String username = jwt.getClaimAsString("custom:idp_username");
+    return (username != null && !username.isBlank()) ? username : jwt.getSubject();
   }
 
   private static List<String> extractGroups(Jwt jwt) {

backend/src/test/java/ca/bc/gov/nrs/ilcr/security/CognitoGroupsJwtAuthenticationConverterTest.java

@@ -81,4 +81,24 @@ void bothGroups_mapBothRoles() {
         Set.of("SUBMITTER", "ADMIN"),
         authorities(converter.convert(jwtWithGroups(List.of("ILCR_SUBMITTER", "ILCR_ADMIN")))));
   }
+
+  @Test
+  void principalName_isIdpUsername_notTheSubUuid() {
+    // The audit user (authentication.getName()) must be custom:idp_username, which fits
+    // UPDATE_USERID VARCHAR2(30) — not the ~36-char sub UUID that would overflow it.
+    Jwt jwt = Jwt.withTokenValue("token")
+        .header("alg", "none")
+        .issuedAt(Instant.now())
+        .expiresAt(Instant.now().plusSeconds(60))
+        .subject("11111111-2222-3333-4444-555555555555")
+        .claim("cognito:groups", List.of("ILCR_ADMIN"))
+        .claim("custom:idp_username", "GPASCUCCI")
+        .build();
+    assertEquals("GPASCUCCI", converter.convert(jwt).getName());
+  }
+
+  @Test
+  void principalName_fallsBackToSubjectWhenNoIdpUsername() {
+    assertEquals("user", converter.convert(jwtWithGroups(List.of("ILCR_ADMIN"))).getName());
+  }
 }