From a3fb9d3dca764261ed00b7ddc7d8741d131400bb Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 29 Jul 2026 18:42:01 +0000
Subject: [PATCH] Drop JSON blobs from log export CSV rows

Audit exports no longer emit a metadata JSON column. SCIM full
names come only from membership profiles, not request bodies.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
---
 pkg/iam/log_export_csv.go      | 55 ----------------------------------
 pkg/iam/log_export_csv_test.go | 16 ----------
 2 files changed, 71 deletions(-)

diff --git a/pkg/iam/log_export_csv.go b/pkg/iam/log_export_csv.go
index 5b30b1a62..cab74b290 100644
--- a/pkg/iam/log_export_csv.go
+++ b/pkg/iam/log_export_csv.go
@@ -23,7 +23,6 @@ package iam
 import (
 	"context"
 	"encoding/csv"
-	"encoding/json"
 	"fmt"
 	"strconv"
 	"strings"
@@ -60,7 +59,6 @@ var (
 		"action",
 		"resource_type",
 		"resource_id",
-		"metadata",
 	}
 
 	scimEventExportCSVHeader = []string{
@@ -213,11 +211,6 @@ func auditLogEntryCSVRow(
 	entry *coredata.AuditLogEntry,
 	actor auditLogActorExportInfo,
 ) []string {
-	metadata := ""
-	if len(entry.Metadata) > 0 {
-		metadata = string(entry.Metadata)
-	}
-
 	return []string{
 		organizationName,
 		entry.ID.String(),
@@ -229,7 +222,6 @@ func auditLogEntryCSVRow(
 		entry.Action,
 		entry.ResourceType,
 		entry.ResourceID.String(),
-		metadata,
 	}
 }
 
@@ -246,10 +238,6 @@ func scimEventCSVRow(
 		email = scimEmailFromUserName(event.UserName)
 	}
 
-	if fullName == "" {
-		fullName = scimFullNameFromBodies(event.RequestBody, event.ResponseBody)
-	}
-
 	return []string{
 		organizationName,
 		event.ID.String(),
@@ -399,49 +387,6 @@ func scimEmailFromUserName(userName string) string {
 	return ""
 }
 
-func scimFullNameFromBodies(requestBody *string, responseBody *string) string {
-	for _, body := range []*string{requestBody, responseBody} {
-		if body == nil || strings.TrimSpace(*body) == "" {
-			continue
-		}
-
-		if name := scimDisplayNameFromJSON(*body); name != "" {
-			return name
-		}
-	}
-
-	return ""
-}
-
-func scimDisplayNameFromJSON(body string) string {
-	var payload map[string]any
-	if err := json.Unmarshal([]byte(body), &payload); err != nil {
-		return ""
-	}
-
-	if displayName, ok := payload["displayName"].(string); ok && displayName != "" {
-		return displayName
-	}
-
-	nameValue, ok := payload["name"].(map[string]any)
-	if !ok {
-		return ""
-	}
-
-	if formatted, ok := nameValue["formatted"].(string); ok && formatted != "" {
-		return formatted
-	}
-
-	given, _ := nameValue["givenName"].(string)
-	family, _ := nameValue["familyName"].(string)
-	fullName := strings.TrimSpace(given + " " + family)
-	if fullName != "" {
-		return fullName
-	}
-
-	return ""
-}
-
 func profileFullName(profile *coredata.MembershipProfile) string {
 	if profile.FormattedName != nil && *profile.FormattedName != "" {
 		return *profile.FormattedName
diff --git a/pkg/iam/log_export_csv_test.go b/pkg/iam/log_export_csv_test.go
index bfe96ee67..52f70662c 100644
--- a/pkg/iam/log_export_csv_test.go
+++ b/pkg/iam/log_export_csv_test.go
@@ -24,7 +24,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestScimEmailFromUserName(t *testing.T) {
@@ -35,21 +34,6 @@ func TestScimEmailFromUserName(t *testing.T) {
 	assert.Equal(t, "", scimEmailFromUserName(""))
 }
 
-func TestScimDisplayNameFromJSON(t *testing.T) {
-	t.Parallel()
-
-	displayName := scimDisplayNameFromJSON(`{"displayName":"Jane Doe"}`)
-	require.Equal(t, "Jane Doe", displayName)
-
-	formatted := scimDisplayNameFromJSON(`{"name":{"formatted":"John Smith"}}`)
-	require.Equal(t, "John Smith", formatted)
-
-	givenFamily := scimDisplayNameFromJSON(`{"name":{"givenName":"John","familyName":"Smith"}}`)
-	require.Equal(t, "John Smith", givenFamily)
-
-	assert.Equal(t, "", scimDisplayNameFromJSON("not json"))
-}
-
 func TestUniqueNonEmptyStrings(t *testing.T) {
 	t.Parallel()