fix(lti): use case-insensitive email lookup when trusting external LTI systems

[waterWang]

Description

Fixes #13522

When trustExternalLTISystems is enabled, authenticateLtiUser in LtiService uses findOneByEmailIgnoreCase for the guard check (case-insensitive) but findOneWithAuthoritiesByEmail (case-sensitive) for the actual user lookup. If the email in the database differs in case from the LTI-provided email, the lookup fails with NoSuchElementException.

Changes

1. UserRepository.java: Added findOneWithAuthoritiesByEmailIgnoreCase method with @EntityGraph for eager authority loading
2. LtiService.java: Changed authenticateLtiUser to use findOneWithAuthoritiesByEmailIgnoreCase instead of findOneWithAuthoritiesByEmail
3. LtiServiceTest.java: Added test authenticateLtiUser_caseInsensitiveEmailLookup verifying case-insensitive email authentication

Checklist

• Bug fix (non-breaking change which fixes an issue)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective

Summary by CodeRabbit

• Bug Fixes
  • LTI authentication now matches user email addresses without regard to capitalization.
  • Trusted external LTI sign-ins correctly authenticate existing users even when email casing differs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5749b9db-b520-4e21-9652-a6b99d1a3d72

📥 Commits

Reviewing files that changed from the base of the PR and between 7060228 and a7df746.

📒 Files selected for processing (1)

• src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java

Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review.

---

Walkthrough

Trusted external LTI authentication now matches user email addresses without case sensitivity. The repository lookup eagerly loads authorities, and a test verifies authentication with differently cased email values.

Changes

LTI email authentication

Layer / File(s)	Summary
Case-insensitive authority lookup src/main/java/de/tum/cit/aet/artemis/account/repository/UserRepository.java	Adds an entity-graph-backed repository method for case-insensitive email lookup with eagerly loaded authorities.
Trusted LTI authentication integration src/main/java/de/tum/cit/aet/artemis/lti/service/LtiService.java, src/test/java/de/tum/cit/aet/artemis/lti/LtiServiceTest.java	Uses the case-insensitive lookup during trusted external LTI authentication. The test covers differently cased email values and verifies the authenticated principal.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a7df7

This PR makes trusted external LTI email matching case-insensitive and adds coverage for the corrected behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• ls1intum/Artemis#12788: Both changes modify UserRepository and LtiService user lookups, but that PR changes role-loading behavior rather than email matching.
• ls1intum/Artemis#13379: Both changes use case-insensitive identity lookup before authentication, but this change covers LTI email lookup while that PR covers SAML username lookup.

Suggested reviewers: krusche

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR fulfills the directly linked issue's primary requirement by using a case-insensitive lookup with authorities for trusted LTI authentication [#13522].
Out of Scope Changes check	✅ Passed	All changes support the linked issue by updating the repository lookup, LTI authentication, and its regression test [#13522].
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: case-insensitive email lookup for trusted external LTI authentication.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}