Repository: juspay/hyperswitch
File: crates/router/src/core/user.rs (Rust)

Code before:
        .store
        .insert_user_authentication_method(UserAuthenticationMethodNew {
            id: id.clone(),
            auth_id: auth_id.clone(),
            owner_id: req.owner_id.clone(),
            owner_type: req.owner_type,
            auth_type,
            private_config,
            public_config,
            allow_signup: req.allow_signup,
            created_at: now,
            last_modified_at: now,
            email_domain: email_domain.clone(),
        })
        .await
        .to_duplicate_response(UserErrors::UserAuthMethodAlreadyExists)?;

    Ok(ApplicationResponse::Json(
        user_api::CreateUserAuthenticationMethodResponse {
            id,
            auth_id,
            owner_id: req.owner_id,
            owner_type: req.owner_type,
            auth_type,
            email_domain: Some(email_domain),
            allow_signup: req.allow_signup,
        },
    ))
}

pub async fn update_user_authentication_method(
    state: SessionState,
    req: user_api::UpdateUserAuthenticationMethodRequest,
) -> UserResponse<()> {
    let user_auth_encryption_key = hex::decode(
        state
            .conf
            .user_auth_methods
            .get_inner()
            .encryption_key
            .clone()
            .expose(),
    )
    .change_context(UserErrors::InternalServerError)
    .attach_printable("Failed to decode DEK")?;

    match req {
        user_api::UpdateUserAuthenticationMethodRequest::AuthMethod {
            id,
            auth_config: auth_method,
        } => {

Review comment (security):
Use the values returned from the `insert_user_authentication_method` query instead of referencing `req`.
This ensures the response reflects any transformations applied (e.g., prefix/suffix added to `owner_id` in the future) during insertion or by any other function.

Once this is done, I guess you can remove the `clone` in the code above.

Code after:
            owner_id: req.owner_id,
            owner_type: req.owner_type,
            auth_type: (&req.auth_method).foreign_into(),
            private_config,
            public_config,
            allow_signup: req.allow_signup,
            created_at: now,
            last_modified_at: now,
            email_domain,
        })
        .await
        .to_duplicate_response(UserErrors::UserAuthMethodAlreadyExists)?;

    Ok(ApplicationResponse::Json(
        user_api::CreateUserAuthenticationMethodResponse {
            id: inserted_auth_method.id,
            auth_id: inserted_auth_method.auth_id,
            owner_id: inserted_auth_method.owner_id,
            owner_type: inserted_auth_method.owner_type,
            auth_type: inserted_auth_method.auth_type,
            email_domain: Some(inserted_auth_method.email_domain),
            allow_signup: inserted_auth_method.allow_signup,
        },
    ))
}

pub async fn update_user_authentication_method(
    state: SessionState,
    req: user_api::UpdateUserAuthenticationMethodRequest,
) -> UserResponse<()> {
    let user_auth_encryption_key = hex::decode(
        state
            .conf
            .user_auth_methods
            .get_inner()
            .encryption_key
            .clone()
            .expose(),
    )
    .change_context(UserErrors::InternalServerError)
    .attach_printable("Failed to decode DEK")?;

    match req {
        user_api::UpdateUserAuthenticationMethodRequest::AuthMethod {
            id,
            auth_config: auth_method,
        } => {
            let (private_config, public_config) =
                utils::user::construct_public_and_private_db_configs(
                    &state,
                    &auth_method,