Repository: microsoft/onefuzz
File: src/ApiService/ApiService/UserCredentials.cs (C#)

Code before:
            var token = new System.IdentityModel.Tokens.Jwt.JwtSecurityToken(authToken);
            var allowedTenants = await GetAllowedTenants();
            if (allowedTenants.IsOk) {
                if (allowedTenants.OkV is not null && allowedTenants.OkV.Contains(token.Issuer)) {
                    var userAuthInfo = new UserAuthInfo(new UserInfo(null, null, null), new List<string>());
                    var userInfo =
                        token.Payload.Claims.Aggregate(userAuthInfo, (acc, claim) => {
                            switch (claim.Type) {
                                case "oid":
                                    return acc with { UserInfo = acc.UserInfo with { ObjectId = Guid.Parse(claim.Value) } };
                                case "appid":
                                    return acc with { UserInfo = acc.UserInfo with { ApplicationId = Guid.Parse(claim.Value) } };
                                case "upn":
                                    return acc with { UserInfo = acc.UserInfo with { Upn = claim.Value } };
                                case "roles":
                                    acc.Roles.Add(claim.Value);
                                    return acc;
                                default:
                                    return acc;
                            }
                        });
                    return OneFuzzResult<UserAuthInfo>.Ok(userInfo);
                } else {
                    var tenantsStr = allowedTenants.OkV is null ? "null" : String.Join(';', allowedTenants.OkV!);
                    _log.Error($"issuer not from allowed tenant. issuer: {token.Issuer:Tag:Issuer} - tenants: {tenantsStr:Tag:Tenants}");
                    return OneFuzzResult<UserAuthInfo>.Error(ErrorCode.INVALID_REQUEST, new[] { "unauthorized AAD issuer. if multi-tenant auth is failing, make sure to include all tenant_ids in the `allowed_aad_tenants` list in the instance_config. to see the current instance_config, run `onefuzz instance_config get`. " });
                }
            } else {
                _log.Error($"Failed to get allowed tenants due to {allowedTenants.ErrorV:Tag:Error}");
                return OneFuzzResult<UserAuthInfo>.Error(allowedTenants.ErrorV);
            }
        }
    }
}


Review comment (bug):
```suggestion
                    return OneFuzzResult<UserAuthInfo>.Error(ErrorCode.INVALID_REQUEST, new[] { "unauthorized AAD issuer. If multi-tenant auth is failing, make sure to include all tenant_ids in the `allowed_aad_tenants` list in the instance_config. To see the current instance_config, run `onefuzz instance_config get`. " });
```

Code after:
            var token = new System.IdentityModel.Tokens.Jwt.JwtSecurityToken(authToken);
            var allowedTenants = await GetAllowedTenants();
            if (allowedTenants.IsOk) {
                if (allowedTenants.OkV is not null && allowedTenants.OkV.Contains(token.Issuer)) {
                    var userAuthInfo = new UserAuthInfo(new UserInfo(null, null, null), new List<string>());
                    var userInfo =
                        token.Payload.Claims.Aggregate(userAuthInfo, (acc, claim) => {
                            switch (claim.Type) {
                                case "oid":
                                    return acc with { UserInfo = acc.UserInfo with { ObjectId = Guid.Parse(claim.Value) } };
                                case "appid":
                                    return acc with { UserInfo = acc.UserInfo with { ApplicationId = Guid.Parse(claim.Value) } };
                                case "upn":
                                    return acc with { UserInfo = acc.UserInfo with { Upn = claim.Value } };
                                case "roles":
                                    acc.Roles.Add(claim.Value);
                                    return acc;
                                default:
                                    return acc;
                            }
                        });
                    return OneFuzzResult<UserAuthInfo>.Ok(userInfo);
                } else {
                    var tenantsStr = allowedTenants.OkV is null ? "null" : String.Join(';', allowedTenants.OkV!);
                    _log.Error($"issuer not from allowed tenant. issuer: {token.Issuer:Tag:Issuer} - tenants: {tenantsStr:Tag:Tenants}");
                    return OneFuzzResult<UserAuthInfo>.Error(ErrorCode.INVALID_REQUEST, new[] { "unauthorized AAD issuer. If multi-tenant auth is failing, make sure to include all tenant_ids in the `allowed_aad_tenants` list in the instance_config. To see the current instance_config, run `onefuzz instance_config get`. " });
                }
            } else {
                _log.Error($"Failed to get allowed tenants due to {allowedTenants.ErrorV:Tag:Error}");
                return OneFuzzResult<UserAuthInfo>.Error(allowedTenants.ErrorV);
            }
        }
    }
}