feat(brand-claims): name the requester in the on-demand claims Slack alert (LLMO-7263)

[akshaymagapu]

What

Name the person who triggered an on-demand Brand Claims run in the Slack alert (LLMO-7263). The alert now reads:

:rocket: On-demand Brand Claims requested for *<site>* (<id>) by <Name> (<email>).

The requester is resolved from the caller's IMS profile, mirroring user-details.js:

• email: trial_email -> preferred_username -> email (the trial user's real address is trial_email; profile.email is an IMS user GUID, used only as a last resort).
• name: first_name/given_name + last_name/family_name when present.
• Falls back to just the email, or unknown.

Fail-safe

The requester lookup can never block the run:

1. The SQS trigger is enqueued before the Slack block, so the run is already in flight.
2. The Slack call is best-effort (try/catch, a failure only logs a warning).
3. getRequesterLabel itself is wrapped in try/catch returning unknown.

Testing

• test/controllers/llmo/brand-claims.test.js - asserts the alert names the requester (name+email), the preferred_username fallback, and unknown when no profile is present. Existing paths unchanged.
• Tests passing, eslint clean.

Notes

Split out from #3208 (prerequisite audits) to keep that PR standalone; both are LLMO-7263. No dependency between them.

🤖 Generated with Claude Code

Change Management

cm-assessment: v1
changeType: standard
impact: unnoticeable
risk: minor
changeApprovedBy: ["Dominique Jäggi"]
rationale: "Cosmetic Slack alert text addition wrapped in try/catch fail-safes that cannot block the underlying run; fully covered by tests."

[github-actions]

This PR will trigger a minor release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[MysticatBot]

Hey @akshaymagapu,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Request changes - two code paths in the new helper lack test coverage.
Complexity: MEDIUM - small diff; controllers/API-surface signal.
Changes: Adds requester identity (name and email from IMS profile) to the on-demand Brand Claims Slack alert (2 files).

Must fix before merge

1. [Important] Two untested code paths in getRequesterLabel (name-only return and catch-block fallback) match the 4 lines Codecov flagged - src/controllers/llmo/brand-claims.js:192-196 (details inline)

Non-blocking (3): minor issues and suggestions

• nit: JSDoc says "Returns 'unknown' when no profile is available" but the function returns null - stale doc fragment - src/controllers/llmo/brand-claims.js:178
• suggestion: Split the compound test into two it blocks (email-only fallback and missing-identity are independent scenarios; a failure in the first currently prevents the second from running) - test/controllers/llmo/brand-claims.test.js:414
• nit: IMS profile fields are interpolated into a mrkdwn-typed Slack block without sanitization; trial users can edit their own display name, which could inject Slack formatting. Low-likelihood defense-in-depth concern - src/controllers/llmo/brand-claims.js:284

[MysticatBot]

Hey @akshaymagapu,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Request changes - two code paths in the new helper lack test coverage.
Complexity: MEDIUM - small diff; controllers/API-surface signal.
Changes: Adds requester identity (name and email from IMS profile) to the on-demand Brand Claims Slack alert (2 files).

Must fix before merge

1. [Important] Two untested code paths in getRequesterLabel (name-only return and catch-block fallback) match the 4 lines Codecov flagged - src/controllers/llmo/brand-claims.js:192-196 (details inline)

Non-blocking (3): minor issues and suggestions

• nit: JSDoc says "Returns 'unknown' when no profile is available" but the function returns null - stale doc fragment - src/controllers/llmo/brand-claims.js:178
• suggestion: Split the compound test into two it blocks (email-only fallback and missing-identity are independent scenarios; a failure in the first currently prevents the second from running) - test/controllers/llmo/brand-claims.test.js:414
• nit: IMS profile fields are interpolated into a mrkdwn-typed Slack block without sanitization; trial users can edit their own display name, which could inject Slack formatting. Low-likelihood defense-in-depth concern - src/controllers/llmo/brand-claims.js:284

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 5m 45s | Cost: $4.78 | Commit: 3c3bfe2671911d147b34c54e2852ea0456a7641d
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[MysticatBot]

(Superseded - review body was malformed due to a file-path literal. See the subsequent review for the actual content.)

[MysticatBot]

Hey @akshaymagapu,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Approve - all prior findings addressed cleanly; no new blocking issues.
Complexity: MEDIUM - small diff; API-surface signal.
Changes: Adds requester identity (name and email from IMS profile) to the on-demand Brand Claims Slack alert, with mrkdwn sanitization and a three-layer fail-safe (2 files).

Non-blocking (2): minor issues and suggestions

• suggestion: The authInfo.profile object fallback path (when getProfile is not a function) is not exercised by any test - a one-liner context.attributes.authInfo = { profile: { trial_email: 'static@example.com' } } would close it - src/controllers/llmo/brand-claims.js:181
• suggestion: The given_name/family_name OIDC claim aliases are never exercised by tests (all tests use first_name/last_name) - worth a test to lock down the mapping - src/controllers/llmo/brand-claims.js:189

Previously flagged, now resolved

• Two untested code paths in getRequesterLabel (name-only return and catch-block fallback) now covered by dedicated tests
• Stale JSDoc ("Returns 'unknown'") corrected to document null return
• Compound test split into separate it blocks for independent failure reporting
• Slack mrkdwn control characters now stripped via regex with dedicated test coverage

[solaris007]

🎉 This PR is included in version 1.797.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀