BE-770: Use the Kratos user-ID lookup on the admin delete-user path by TimDiekmann · Pull Request #9256 · hashintel/hash

TimDiekmann · 2026-08-19T18:11:46Z

🌟 What is the purpose of this PR?

Deleting a user by email resolved the address through a JSONB scan over all entity editions, extracting every email property as an array. One entity carrying a scalar email — an org invitation, for example — could fail the whole query with cannot extract elements from a scalar, because Postgres does not guarantee predicate evaluation order even though the query joined user_actor.

Kratos already owns the email-to-identity mapping, and the Graph provisions each identity with its actor (graph_actor_id in metadata_public). The delete-user endpoint now resolves the email there, so the shape of stored email properties no longer matters for deletion.

🔗 Related links

BE-770 (internal)

🚫 Blocked by

BE-761: Authenticate Cloudflare Access JWTs in the Graph API #9235

🔍 What does this change?

KratosIdentityProvider gains find_user_by_email: the identity is looked up by credentials identifier and the actor is read from its metadata_public.graph_actor_id. Unlike the authentication resolver, an unverified address resolves — deletion must reach accounts that never completed verification.
An address held by several identities fails with an explicit error instead of picking one — that state means an account has claimed an address it may not own, so the operator falls back to deletion by user ID. An identity without a provisioned actor is reported as such rather than as a missing user.
The resolved Kratos identity ID travels into delete_user instead of being read back from the graph. Deletion order stays graph-then-Kratos, so the partial state a non-fatal Kratos failure leaves behind — entities purged, identity still alive — remains findable and deletable by email.
get_user_id_by_email and its JSONB scan are removed from AccountStore, the Postgres store, and the type-fetcher passthrough.
MetadataPublic is exported from the authentication crate, so the metadata contract keeps a single Rust definition.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

require changes to docs which are not made in this PR
- The Graph Admin API runbook's delete-user section: deleting by email now requires the identity to exist in Kratos and carry a provisioned actor, and an ambiguous address is rejected. Same page BE-761: Authenticate Cloudflare Access JWTs in the Graph API #9235 already flags for updating.

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

A user whose Kratos identity is already gone while their graph entities remain is deletable by user ID only; the email lookup no longer sees them.

🐾 Next steps

Update the Graph Admin API runbook once this lands.

🛡 What tests cover this?

New unit tests for the Kratos lookup against a fake admin API: resolution of a provisioned identity, unknown email, unprovisioned identity, and an address held by several identities.
The existing integration tests that delete users by email exercise the new path.

❓ How to test this?

Create a user and an org invitation (its email property is a single string).
POST /users/delete on the admin port with {"email": "<the user's email>"}.
Confirm the deletion succeeds — previously it failed with cannot extract elements from a scalar.

Deleting a user by email scanned `email` properties across all entity editions and extracted them as arrays. An entity carrying a scalar `email` — an org invitation, for example — could fail the whole query with "cannot extract elements from a scalar": predicate evaluation order is not guaranteed, so the extraction can run before the `user_actor` join filters the editions down to users. The lookup now asks Kratos. The identity is found by credentials identifier and the actor comes from the `graph_actor_id` it was provisioned with. Unlike authentication, an unverified address resolves — deletion must reach accounts that never completed verification — and an address held by several identities is rejected rather than guessed at. The resolved identity ID travels into the deletion instead of being read back from the graph, so a partially deleted user — entities purged, identity still alive because the Kratos step is non-fatal — stays deletable by email. The graph scan is removed.

vercel · 2026-08-19T18:11:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 19, 2026 6:51pm

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 19, 2026 6:51pm
petrinaut	Skipped		Aug 19, 2026 6:51pm
petrinaut-docs	Skipped		Aug 19, 2026 6:51pm

codecov · 2026-08-19T18:17:59Z

Codecov Report

❌ Patch coverage is 86.25954% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.24%. Comparing base (6af071c) to head (70ebd39).

Files with missing lines	Patch %	Lines
libs/@local/graph/api/src/rest/admin.rs	0.00%	12 Missing ⚠️
libs/@local/graph/api/src/identity_provider.rs	96.58%	3 Missing and 1 partial ⚠️
libs/@local/graph/store/src/user_deletion.rs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                                        Coverage Diff                                        @@
##           t/be-761-authenticate-cloudflare-access-jwts-in-the-graph-api    #9256      +/-   ##
=================================================================================================
+ Coverage                                                          60.17%   60.24%   +0.07%     
=================================================================================================
  Files                                                               1430     1429       -1     
  Lines                                                             140522   140535      +13     
  Branches                                                            6596     6598       +2     
=================================================================================================
+ Hits                                                               84557    84669     +112     
+ Misses                                                             54887    54787     -100     
- Partials                                                            1078     1079       +1

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.00% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`
rust.hash-graph-api	`13.97% <87.59%> (+2.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cursor · 2026-08-19T18:20:45Z

PR Summary

^{Cursor Bugbot is generating a summary for commit 0af153c. Configure here.}

Copilot

Pull request overview

Moves admin email-based user deletion from Graph JSONB lookup to Kratos identity resolution.

Changes:

Adds tested Kratos email lookup with ambiguity and provisioning checks.
Threads the resolved identity ID through deletion for partial-deletion recovery.
Removes obsolete Graph email lookup code.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`libs/@local/graph/type-fetcher/src/store.rs`	Removes email lookup passthrough.
`libs/@local/graph/store/src/user_deletion.rs`	Accepts a pre-resolved Kratos identity ID.
`libs/@local/graph/store/src/account/mod.rs`	Removes the obsolete store API.
`libs/@local/graph/postgres-store/src/store/postgres/mod.rs`	Removes the unsafe JSONB lookup.
`libs/@local/graph/authentication/src/kratos/mod.rs`	Exports shared Kratos metadata.
`libs/@local/graph/api/src/rest/admin.rs`	Resolves email through Kratos before deletion.
`libs/@local/graph/api/src/identity_provider.rs`	Implements and tests identity resolution.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The lookup and the deletion went through the router-wide client, which follows redirects, while the authentication resolver disables them for the same Kratos endpoint. The provider now builds its own client with redirects off, constructed once at router setup instead of per request. With redirects disabled a 3xx is no longer followed, and `error_for_status` only covers 4xx/5xx, so both paths reject a non-success status explicitly.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

github-actions · 2026-08-19T20:01:11Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$20.0 \mathrm{ms} \pm 151 \mathrm{μs}\left({\color{gray}2.85 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.72 \mathrm{ms} \pm 16.7 \mathrm{μs}\left({\color{gray}3.64 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$9.82 \mathrm{ms} \pm 78.3 \mathrm{μs}\left({\color{gray}3.38 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$33.9 \mathrm{ms} \pm 280 \mathrm{μs}\left({\color{gray}1.39 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$11.7 \mathrm{ms} \pm 86.8 \mathrm{μs}\left({\color{gray}4.98 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$18.9 \mathrm{ms} \pm 147 \mathrm{μs}\left({\color{gray}2.89 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$20.8 \mathrm{ms} \pm 134 \mathrm{μs}\left({\color{gray}3.26 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.94 \mathrm{ms} \pm 11.5 \mathrm{μs}\left({\color{gray}2.51 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$10.5 \mathrm{ms} \pm 80.3 \mathrm{μs}\left({\color{gray}1.85 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$2.93 \mathrm{ms} \pm 21.8 \mathrm{μs}\left({\color{gray}1.58 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.33 \mathrm{ms} \pm 11.4 \mathrm{μs}\left({\color{gray}1.95 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$2.61 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}0.565 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$3.97 \mathrm{ms} \pm 20.0 \mathrm{μs}\left({\color{gray}-0.259 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.73 \mathrm{ms} \pm 14.0 \mathrm{μs}\left({\color{gray}-0.051 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$3.18 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}-0.437 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$3.34 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-0.326 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.66 \mathrm{ms} \pm 11.1 \mathrm{μs}\left({\color{gray}-0.066 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.13 \mathrm{ms} \pm 17.8 \mathrm{μs}\left({\color{gray}0.369 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.01 \mathrm{ms} \pm 10.4 \mathrm{μs}\left({\color{gray}-2.660 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$1.93 \mathrm{ms} \pm 7.90 \mathrm{μs}\left({\color{gray}0.163 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.01 \mathrm{ms} \pm 10.9 \mathrm{μs}\left({\color{gray}-2.536 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.19 \mathrm{ms} \pm 11.2 \mathrm{μs}\left({\color{gray}-4.246 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.05 \mathrm{ms} \pm 11.8 \mathrm{μs}\left({\color{gray}-4.206 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.17 \mathrm{ms} \pm 12.9 \mathrm{μs}\left({\color{gray}-4.385 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.33 \mathrm{ms} \pm 11.8 \mathrm{μs}\left({\color{gray}-0.293 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.11 \mathrm{ms} \pm 10.7 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.30 \mathrm{ms} \pm 11.3 \mathrm{μs}\left({\color{gray}-1.044 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$2.65 \mathrm{ms} \pm 14.4 \mathrm{μs}\left({\color{gray}1.20 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.31 \mathrm{ms} \pm 10.2 \mathrm{μs}\left({\color{gray}-0.449 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$2.54 \mathrm{ms} \pm 13.4 \mathrm{μs}\left({\color{gray}-0.032 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$2.57 \mathrm{ms} \pm 11.2 \mathrm{μs}\left({\color{gray}0.015 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.29 \mathrm{ms} \pm 9.96 \mathrm{μs}\left({\color{gray}-0.009 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.55 \mathrm{ms} \pm 18.1 \mathrm{μs}\left({\color{gray}-0.308 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$32.5 \mathrm{ms} \pm 159 \mathrm{μs}\left({\color{gray}-0.696 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$25.8 \mathrm{ms} \pm 154 \mathrm{μs}\left({\color{gray}-0.648 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$27.5 \mathrm{ms} \pm 121 \mathrm{μs}\left({\color{gray}-0.632 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$24.9 \mathrm{ms} \pm 123 \mathrm{μs}\left({\color{gray}-0.313 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$33.0 \mathrm{ms} \pm 164 \mathrm{μs}\left({\color{gray}1.37 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$38.1 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}-0.193 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$31.1 \mathrm{ms} \pm 153 \mathrm{μs}\left({\color{gray}-0.925 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$65.9 \mathrm{ms} \pm 401 \mathrm{μs}\left({\color{lightgreen}-5.185 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$26.6 \mathrm{ms} \pm 131 \mathrm{μs}\left({\color{gray}0.295 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$214 \mathrm{ms} \pm 846 \mathrm{μs}\left({\color{lightgreen}-8.515 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$8.53 \mathrm{ms} \pm 63.8 \mathrm{μs}\left({\color{gray}1.22 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$8.60 \mathrm{ms} \pm 39.6 \mathrm{μs}\left({\color{gray}-0.140 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$8.72 \mathrm{ms} \pm 67.1 \mathrm{μs}\left({\color{gray}1.44 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$8.53 \mathrm{ms} \pm 51.2 \mathrm{μs}\left({\color{gray}-0.209 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$8.68 \mathrm{ms} \pm 58.9 \mathrm{μs}\left({\color{gray}2.26 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$8.52 \mathrm{ms} \pm 39.8 \mathrm{μs}\left({\color{gray}0.346 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$8.66 \mathrm{ms} \pm 48.6 \mathrm{μs}\left({\color{gray}-0.410 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$8.60 \mathrm{ms} \pm 40.4 \mathrm{μs}\left({\color{gray}-0.453 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$8.66 \mathrm{ms} \pm 44.1 \mathrm{μs}\left({\color{gray}-0.500 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$8.91 \mathrm{ms} \pm 51.8 \mathrm{μs}\left({\color{gray}0.425 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$8.85 \mathrm{ms} \pm 47.6 \mathrm{μs}\left({\color{gray}0.415 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$8.91 \mathrm{ms} \pm 45.5 \mathrm{μs}\left({\color{gray}0.480 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$8.92 \mathrm{ms} \pm 56.2 \mathrm{μs}\left({\color{gray}0.030 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$9.00 \mathrm{ms} \pm 41.9 \mathrm{μs}\left({\color{gray}2.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$8.90 \mathrm{ms} \pm 38.5 \mathrm{μs}\left({\color{gray}0.160 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$8.90 \mathrm{ms} \pm 44.6 \mathrm{μs}\left({\color{gray}1.33 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$8.89 \mathrm{ms} \pm 44.0 \mathrm{μs}\left({\color{gray}-0.208 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$8.89 \mathrm{ms} \pm 50.6 \mathrm{μs}\left({\color{gray}0.767 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$8.97 \mathrm{ms} \pm 53.5 \mathrm{μs}\left({\color{gray}-0.012 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$6.56 \mathrm{ms} \pm 33.7 \mathrm{μs}\left({\color{gray}-0.051 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$46.4 \mathrm{ms} \pm 249 \mathrm{μs}\left({\color{red}5.43 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$87.1 \mathrm{ms} \pm 506 \mathrm{μs}\left({\color{gray}2.84 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$52.0 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}3.89 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$59.7 \mathrm{ms} \pm 367 \mathrm{μs}\left({\color{gray}2.91 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$67.5 \mathrm{ms} \pm 469 \mathrm{μs}\left({\color{red}5.21 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$71.2 \mathrm{ms} \pm 431 \mathrm{μs}\left({\color{gray}3.01 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$33.8 \mathrm{ms} \pm 216 \mathrm{μs}\left({\color{gray}1.07 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$55.9 \mathrm{ms} \pm 390 \mathrm{μs}\left({\color{gray}0.183 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$38.6 \mathrm{ms} \pm 225 \mathrm{μs}\left({\color{gray}0.192 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$46.3 \mathrm{ms} \pm 201 \mathrm{μs}\left({\color{gray}0.410 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$47.6 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}-0.405 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$47.5 \mathrm{ms} \pm 217 \mathrm{μs}\left({\color{gray}-0.303 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$95.0 \mathrm{ms} \pm 380 \mathrm{μs}\left({\color{gray}3.20 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$104 \mathrm{ms} \pm 329 \mathrm{μs}\left({\color{gray}1.25 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$14.0 \mathrm{ms} \pm 87.3 \mathrm{μs}\left({\color{gray}-4.274 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$419 \mathrm{ms} \pm 650 \mathrm{μs}\left({\color{gray}-1.115 \mathrm{\%}}\right) $$	Flame Graph

vercel Bot temporarily deployed to Preview – petrinaut-docs August 19, 2026 18:11 Inactive

vercel Bot temporarily deployed to Preview – petrinaut August 19, 2026 18:11 Inactive

TimDiekmann self-assigned this Aug 19, 2026

github-actions Bot added area/libs Relates to first-party libraries/crates/packages (area) type/eng > backend Owned by the @backend team labels Aug 19, 2026

TimDiekmann deployed to pull-request August 19, 2026 18:12 — with GitHub Actions Active

TimDiekmann marked this pull request as ready for review August 19, 2026 18:20

Copilot AI balanced review requested due to automatic review settings August 19, 2026 18:20

Copilot started reviewing on behalf of TimDiekmann August 19, 2026 18:21 View session

vercel Bot deployed to Preview – hash August 19, 2026 18:23 View deployment

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Comment thread libs/@local/graph/api/src/identity_provider.rs

Copilot AI review requested due to automatic review settings August 19, 2026 18:39

vercel Bot temporarily deployed to Preview – petrinaut August 19, 2026 18:39 Inactive

vercel Bot temporarily deployed to Preview – petrinaut-docs August 19, 2026 18:39 Inactive

Copilot started reviewing on behalf of TimDiekmann August 19, 2026 18:40 View session

TimDiekmann deployed to pull-request August 19, 2026 18:40 — with GitHub Actions Active

Copilot AI reviewed Aug 19, 2026

View reviewed changes

TimDiekmann requested a review from a team August 19, 2026 18:45

vercel Bot deployed to Preview – hash August 19, 2026 18:51 View deployment

CiaranMn approved these changes Aug 19, 2026

View reviewed changes

Navigation Menu

Uh oh!

BE-770: Use the Kratos user-ID lookup on the admin delete-user path - #9256

BE-770: Use the Kratos user-ID lookup on the admin delete-user path#9256
TimDiekmann wants to merge 2 commits into
t/be-761-authenticate-cloudflare-access-jwts-in-the-graph-apifrom
t/be-770-use-the-kratos-user-id-lookup-on-the-admin-delete-user-path

TimDiekmann commented Aug 19, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 19, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

TimDiekmann commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cursor Bot commented Aug 19, 2026

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions Bot commented Aug 19, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

TimDiekmann commented Aug 19, 2026 •

edited

Loading

vercel Bot commented Aug 19, 2026 •

edited

Loading

codecov Bot commented Aug 19, 2026 •

edited

Loading