fix(lti): use case-insensitive email lookup when trusting external LTI systems

[waterWang]

Description

Fixes #13522

When trustExternalLTISystems is enabled, authenticateLtiUser in LtiService uses findOneByEmailIgnoreCase for the guard check (case-insensitive) but findOneWithAuthoritiesByEmail (case-sensitive) for the actual user lookup. If the email in the database differs in case from the LTI-provided email, the lookup fails with NoSuchElementException.

Changes

1. UserRepository.java: Added findOneWithAuthoritiesByEmailIgnoreCase method with @EntityGraph for eager authority loading
2. LtiService.java: Changed authenticateLtiUser to use findOneWithAuthoritiesByEmailIgnoreCase instead of findOneWithAuthoritiesByEmail
3. LtiServiceTest.java: Added test authenticateLtiUser_caseInsensitiveEmailLookup verifying case-insensitive email authentication

Checklist

• Bug fix (non-breaking change which fixes an issue)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective

Summary by CodeRabbit

• Bug Fixes
  • LTI authentication now matches user email addresses without regard to capitalization.
  • Trusted external LTI sign-ins correctly authenticate existing users even when email casing differs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5749b9db-b520-4e21-9652-a6b99d1a3d72

📥 Commits

Reviewing files that changed from the base of the PR and between 7060228 and a7df746.

📒 Files selected for processing (1)

• src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java

Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review.

---

Walkthrough

Trusted external LTI authentication now matches user email addresses without case sensitivity. The repository lookup eagerly loads authorities, and a test verifies authentication with differently cased email values.

Changes

LTI email authentication

Layer / File(s)	Summary
Case-insensitive authority lookup src/main/java/de/tum/cit/aet/artemis/account/repository/UserRepository.java	Adds an entity-graph-backed repository method for case-insensitive email lookup with eagerly loaded authorities.
Trusted LTI authentication integration src/main/java/de/tum/cit/aet/artemis/lti/service/LtiService.java, src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java	Uses the case-insensitive lookup during trusted external LTI authentication. The test covers differently cased email values and verifies the authenticated principal.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a7df7

This PR makes trusted external LTI email matching case-insensitive and adds coverage for the corrected behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• ls1intum/Artemis#12788: Both changes modify UserRepository and LtiService user lookups, but that PR changes role-loading behavior rather than email matching.
• ls1intum/Artemis#13379: Both changes use case-insensitive identity lookup before authentication, but this change covers LTI email lookup while that PR covers SAML username lookup.

Suggested reviewers: krusche

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR fulfills the directly linked issue's primary requirement by using a case-insensitive lookup with authorities for trusted LTI authentication [#13522].
Out of Scope Changes check	✅ Passed	All changes support the linked issue by updating the repository lookup, LTI authentication, and its regression test [#13522].
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: case-insensitive email lookup for trusted external LTI authentication.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.