BE-770: Use the Kratos user-ID lookup on the admin delete-user path by TimDiekmann · Pull Request #9256 · hashintel/hash

TimDiekmann · 2026-08-19T18:11:46Z

🌟 What is the purpose of this PR?

Deleting a user by email resolved the address through a JSONB scan over all entity editions, extracting every email property as an array. One entity carrying a scalar email — an org invitation, for example — could fail the whole query with cannot extract elements from a scalar, because Postgres does not guarantee predicate evaluation order even though the query joined user_actor.

Kratos already owns the email-to-identity mapping, and the Graph provisions each identity with its actor (graph_actor_id in metadata_public). The delete-user endpoint now resolves the email there, so the shape of stored email properties no longer matters for deletion.

🔗 Related links

BE-770 (internal)

🚫 Blocked by

BE-761: Authenticate Cloudflare Access JWTs in the Graph API #9235

🔍 What does this change?

KratosIdentityProvider gains find_user_by_email: the identity is looked up by credentials identifier and the actor is read from its metadata_public.graph_actor_id. Unlike the authentication resolver, an unverified address resolves — deletion must reach accounts that never completed verification.
An address held by several identities fails with an explicit error instead of picking one — that state means an account has claimed an address it may not own, so the operator falls back to deletion by user ID. An identity without a provisioned actor is reported as such rather than as a missing user.
The resolved Kratos identity ID travels into delete_user instead of being read back from the graph. Deletion order stays graph-then-Kratos, so the partial state a non-fatal Kratos failure leaves behind — entities purged, identity still alive — remains findable and deletable by email.
get_user_id_by_email and its JSONB scan are removed from AccountStore, the Postgres store, and the type-fetcher passthrough.
MetadataPublic is exported from the authentication crate, so the metadata contract keeps a single Rust definition.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

require changes to docs which are not made in this PR
- The Graph Admin API runbook's delete-user section: deleting by email now requires the identity to exist in Kratos and carry a provisioned actor, and an ambiguous address is rejected. Same page BE-761: Authenticate Cloudflare Access JWTs in the Graph API #9235 already flags for updating.

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

A user whose Kratos identity is already gone while their graph entities remain is deletable by user ID only; the email lookup no longer sees them.

🐾 Next steps

Update the Graph Admin API runbook once this lands.

🛡 What tests cover this?

New unit tests for the Kratos lookup against a fake admin API: resolution of a provisioned identity, unknown email, unprovisioned identity, and an address held by several identities.
A new integration test creates an org invitation — whose email property is a single string — through the real invite resolver and deletes a user by email against the admin server; this failed with cannot extract elements from a scalar before.
The existing integration tests that delete users by email exercise the new path.

❓ How to test this?

The new integration test in user.test.ts automates the scenario: an org invitation exists, and deleting a user by email through the admin server succeeds.

vercel · 2026-08-19T18:11:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 22, 2026 1:26am
petrinaut	Ready	Preview	Aug 22, 2026 1:26am
petrinaut-docs	Ready	Preview	Aug 22, 2026 1:26am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 22, 2026 1:26am

codecov · 2026-08-19T18:17:59Z

Codecov Report

❌ Patch coverage is 83.08824% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.27%. Comparing base (f3354cc) to head (e9a8073).

Files with missing lines	Patch %	Lines
libs/@local/graph/api/src/rest/admin.rs	0.00%	12 Missing ⚠️
libs/@local/graph/api/src/identity_provider.rs	92.62%	8 Missing and 1 partial ⚠️
libs/@local/graph/store/src/user_deletion.rs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                                        Coverage Diff                                        @@
##           t/be-761-authenticate-cloudflare-access-jwts-in-the-graph-api    #9256      +/-   ##
=================================================================================================
+ Coverage                                                          60.22%   60.27%   +0.04%     
=================================================================================================
  Files                                                               1430     1430              
  Lines                                                             140559   140644      +85     
  Branches                                                            6611     6613       +2     
=================================================================================================
+ Hits                                                               84657    84773     +116     
+ Misses                                                             54824    54792      -32     
- Partials                                                            1078     1079       +1

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.66% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`
rust.hash-graph-api	`13.96% <84.32%> (+1.88%)`	⬆️
rust.hash-graph-authentication	`96.39% <ø> (ø)`
rust.hash-graph-postgres-store	`29.39% <ø> (+0.05%)`	⬆️
rust.hash-graph-store	`46.76% <0.00%> (-0.02%)`	⬇️
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cursor · 2026-08-19T18:20:45Z

PR Summary

Medium Risk
Changes the admin user-deletion identity path (Kratos lookup, email source, and partial-deletion behavior). Wrong resolution could delete the wrong account or fail to delete; the endpoint remains operator-authenticated.

Overview
Admin delete-by-email no longer scans Graph entity email properties (which broke when a scalar email, e.g. an org invitation, existed). It now looks up the Kratos identity by credentials identifier and reads the provisioned actor from metadata_public.graph_actor_id.

KratosIdentityProvider owns that lookup (including unverified addresses), rejects ambiguous emails, and reads emails from Kratos for Mailchimp cleanup. The resolved identity ID is passed into delete_user so a partial deletion (graph gone, identity still present) remains deletable by email. Graph helpers get_user_id_by_email and get_user_emails are removed.

The Kratos HTTP client now disables redirects. Unit tests cover the lookup; an integration test deletes by email while a scalar-email invitation exists.

^{Reviewed by Cursor Bugbot for commit e9a8073. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Moves admin email-based user deletion from Graph JSONB lookup to Kratos identity resolution.

Changes:

Adds tested Kratos email lookup with ambiguity and provisioning checks.
Threads the resolved identity ID through deletion for partial-deletion recovery.
Removes obsolete Graph email lookup code.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`libs/@local/graph/type-fetcher/src/store.rs`	Removes email lookup passthrough.
`libs/@local/graph/store/src/user_deletion.rs`	Accepts a pre-resolved Kratos identity ID.
`libs/@local/graph/store/src/account/mod.rs`	Removes the obsolete store API.
`libs/@local/graph/postgres-store/src/store/postgres/mod.rs`	Removes the unsafe JSONB lookup.
`libs/@local/graph/authentication/src/kratos/mod.rs`	Exports shared Kratos metadata.
`libs/@local/graph/api/src/rest/admin.rs`	Resolves email through Kratos before deletion.
`libs/@local/graph/api/src/identity_provider.rs`	Implements and tests identity resolution.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Deleting a user by email scanned `email` properties across all entity editions and extracted them as arrays. An entity carrying a scalar `email` — an org invitation, for example — could fail the whole query with "cannot extract elements from a scalar": predicate evaluation order is not guaranteed, so the extraction can run before the `user_actor` join filters the editions down to users. The lookup now asks Kratos. The identity is found by credentials identifier and the actor comes from the `graph_actor_id` it was provisioned with. Unlike authentication, an unverified address resolves — deletion must reach accounts that never completed verification — and an address held by several identities is rejected rather than guessed at. The resolved identity ID travels into the deletion instead of being read back from the graph, so a partially deleted user — entities purged, identity still alive because the Kratos step is non-fatal — stays deletable by email. The graph scan is removed.

The lookup and the deletion went through the router-wide client, which follows redirects, while the authentication resolver disables them for the same Kratos endpoint. The provider now builds its own client with redirects off, constructed once at router setup instead of per request. With redirects disabled a 3xx is no longer followed, and `error_for_status` only covers 4xx/5xx, so both paths reject a non-success status explicitly.

An org invitation's `email` property is a single string, and its mere existence broke every later delete-by-email through the graph scan. The test creates one through the real invite resolver and deletes a user by email against the admin server. The context helpers mirror the ones the email-handling PR adds, so the branches merge cleanly.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e9a8073. Configure here.}

cursor · 2026-08-22T01:19:34Z

-    let emails = store
-        .get_user_emails(user_id)
+    let emails = identity_provider
+        .get_identity_emails(&kratos_identity_id)


Email fetch blocks entity purge

Medium Severity

get_identity_emails is fatal in step 1, but those addresses are only used later for non-fatal Mailchimp cleanup and the deletion report. Delete-by-ID used to read emails from the graph store, so a Kratos outage still allowed entity purge. A Kratos failure now aborts before any entities are removed, even when no subscription provider is configured.

^{Reviewed by Cursor Bugbot for commit e9a8073. Configure here.}

github-actions · 2026-08-22T02:41:28Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.2 \mathrm{ms} \pm 196 \mathrm{μs}\left({\color{gray}-2.038 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.67 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}0.922 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$14.2 \mathrm{ms} \pm 127 \mathrm{μs}\left({\color{gray}0.582 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$46.0 \mathrm{ms} \pm 429 \mathrm{μs}\left({\color{gray}-1.120 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$16.5 \mathrm{ms} \pm 160 \mathrm{μs}\left({\color{gray}3.99 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$25.7 \mathrm{ms} \pm 275 \mathrm{μs}\left({\color{gray}-1.102 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.4 \mathrm{ms} \pm 215 \mathrm{μs}\left({\color{gray}-2.352 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$4.07 \mathrm{ms} \pm 33.0 \mathrm{μs}\left({\color{gray}3.50 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$15.3 \mathrm{ms} \pm 124 \mathrm{μs}\left({\color{gray}-0.144 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.97 \mathrm{ms} \pm 40.0 \mathrm{μs}\left({\color{gray}0.187 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.10 \mathrm{ms} \pm 21.8 \mathrm{μs}\left({\color{gray}-0.108 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.49 \mathrm{ms} \pm 27.0 \mathrm{μs}\left({\color{gray}-1.070 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.41 \mathrm{ms} \pm 46.6 \mathrm{μs}\left({\color{gray}-1.739 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.69 \mathrm{ms} \pm 30.5 \mathrm{μs}\left({\color{gray}-0.603 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.30 \mathrm{ms} \pm 34.9 \mathrm{μs}\left({\color{gray}-1.277 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.60 \mathrm{ms} \pm 42.0 \mathrm{μs}\left({\color{gray}0.083 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.62 \mathrm{ms} \pm 31.3 \mathrm{μs}\left({\color{gray}0.580 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.29 \mathrm{ms} \pm 37.6 \mathrm{μs}\left({\color{gray}0.987 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.70 \mathrm{ms} \pm 21.2 \mathrm{μs}\left({\color{gray}-0.179 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.61 \mathrm{ms} \pm 19.3 \mathrm{μs}\left({\color{gray}0.527 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.70 \mathrm{ms} \pm 18.6 \mathrm{μs}\left({\color{gray}0.136 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.96 \mathrm{ms} \pm 22.2 \mathrm{μs}\left({\color{gray}-0.122 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.77 \mathrm{ms} \pm 22.5 \mathrm{μs}\left({\color{gray}1.56 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.92 \mathrm{ms} \pm 18.8 \mathrm{μs}\left({\color{gray}-1.661 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.18 \mathrm{ms} \pm 27.7 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.84 \mathrm{ms} \pm 17.9 \mathrm{μs}\left({\color{gray}-0.047 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.04 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}-0.585 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.58 \mathrm{ms} \pm 31.4 \mathrm{μs}\left({\color{gray}0.108 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.12 \mathrm{ms} \pm 26.1 \mathrm{μs}\left({\color{gray}1.06 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.36 \mathrm{ms} \pm 22.0 \mathrm{μs}\left({\color{gray}0.216 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.51 \mathrm{ms} \pm 30.0 \mathrm{μs}\left({\color{gray}-0.480 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.08 \mathrm{ms} \pm 24.0 \mathrm{μs}\left({\color{gray}0.055 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.37 \mathrm{ms} \pm 24.7 \mathrm{μs}\left({\color{gray}-1.461 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$44.6 \mathrm{ms} \pm 288 \mathrm{μs}\left({\color{gray}-1.701 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$35.4 \mathrm{ms} \pm 230 \mathrm{μs}\left({\color{gray}-1.351 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$38.2 \mathrm{ms} \pm 327 \mathrm{μs}\left({\color{gray}-0.398 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$34.1 \mathrm{ms} \pm 340 \mathrm{μs}\left({\color{gray}0.193 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$44.9 \mathrm{ms} \pm 307 \mathrm{μs}\left({\color{gray}-0.636 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$52.9 \mathrm{ms} \pm 362 \mathrm{μs}\left({\color{gray}-0.663 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$43.4 \mathrm{ms} \pm 283 \mathrm{μs}\left({\color{gray}-0.813 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$91.1 \mathrm{ms} \pm 588 \mathrm{μs}\left({\color{lightgreen}-5.055 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$36.3 \mathrm{ms} \pm 265 \mathrm{μs}\left({\color{gray}0.007 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$289 \mathrm{ms} \pm 1.23 \mathrm{ms}\left({\color{gray}-1.020 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.7 \mathrm{ms} \pm 95.3 \mathrm{μs}\left({\color{gray}-0.205 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$12.0 \mathrm{ms} \pm 74.1 \mathrm{μs}\left({\color{gray}-1.033 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.9 \mathrm{ms} \pm 84.5 \mathrm{μs}\left({\color{gray}-1.065 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.8 \mathrm{ms} \pm 68.9 \mathrm{μs}\left({\color{gray}0.056 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.9 \mathrm{ms} \pm 85.1 \mathrm{μs}\left({\color{gray}-1.550 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.8 \mathrm{ms} \pm 81.1 \mathrm{μs}\left({\color{gray}0.838 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$12.0 \mathrm{ms} \pm 129 \mathrm{μs}\left({\color{gray}0.869 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.9 \mathrm{ms} \pm 72.0 \mathrm{μs}\left({\color{gray}-0.597 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$12.1 \mathrm{ms} \pm 72.1 \mathrm{μs}\left({\color{gray}-2.503 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.4 \mathrm{ms} \pm 94.6 \mathrm{μs}\left({\color{gray}-2.091 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$12.5 \mathrm{ms} \pm 81.8 \mathrm{μs}\left({\color{gray}-1.045 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$12.5 \mathrm{ms} \pm 86.2 \mathrm{μs}\left({\color{gray}-0.578 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$12.4 \mathrm{ms} \pm 79.2 \mathrm{μs}\left({\color{gray}-0.885 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$12.4 \mathrm{ms} \pm 81.3 \mathrm{μs}\left({\color{gray}-0.913 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$12.3 \mathrm{ms} \pm 72.0 \mathrm{μs}\left({\color{gray}-3.113 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$12.5 \mathrm{ms} \pm 83.5 \mathrm{μs}\left({\color{gray}0.079 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$12.4 \mathrm{ms} \pm 82.9 \mathrm{μs}\left({\color{gray}-0.254 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$12.7 \mathrm{ms} \pm 99.5 \mathrm{μs}\left({\color{gray}1.67 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$12.5 \mathrm{ms} \pm 83.0 \mathrm{μs}\left({\color{gray}0.094 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$9.08 \mathrm{ms} \pm 52.2 \mathrm{μs}\left({\color{gray}-0.639 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$66.8 \mathrm{ms} \pm 538 \mathrm{μs}\left({\color{red}7.83 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$121 \mathrm{ms} \pm 556 \mathrm{μs}\left({\color{gray}4.24 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$74.2 \mathrm{ms} \pm 537 \mathrm{μs}\left({\color{red}6.80 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$84.6 \mathrm{ms} \pm 705 \mathrm{μs}\left({\color{red}6.98 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$93.8 \mathrm{ms} \pm 694 \mathrm{μs}\left({\color{red}5.18 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$99.7 \mathrm{ms} \pm 553 \mathrm{μs}\left({\color{red}5.17 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$48.7 \mathrm{ms} \pm 414 \mathrm{μs}\left({\color{gray}3.07 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$78.2 \mathrm{ms} \pm 643 \mathrm{μs}\left({\color{gray}2.21 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$54.5 \mathrm{ms} \pm 340 \mathrm{μs}\left({\color{gray}0.999 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$64.8 \mathrm{ms} \pm 486 \mathrm{μs}\left({\color{gray}3.40 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$66.5 \mathrm{ms} \pm 562 \mathrm{μs}\left({\color{gray}1.79 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$66.4 \mathrm{ms} \pm 453 \mathrm{μs}\left({\color{gray}0.006 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$125 \mathrm{ms} \pm 825 \mathrm{μs}\left({\color{gray}-2.568 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$137 \mathrm{ms} \pm 849 \mathrm{μs}\left({\color{gray}-0.355 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$26.1 \mathrm{ms} \pm 179 \mathrm{μs}\left({\color{gray}0.561 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$544 \mathrm{ms} \pm 1.34 \mathrm{ms}\left({\color{gray}-0.455 \mathrm{\%}}\right) $$	Flame Graph

vercel Bot temporarily deployed to Preview – petrinaut-docs August 19, 2026 18:11 Inactive

vercel Bot temporarily deployed to Preview – petrinaut August 19, 2026 18:11 Inactive

TimDiekmann self-assigned this Aug 19, 2026

github-actions Bot added area/libs Relates to first-party libraries/crates/packages (area) type/eng > backend Owned by the @backend team labels Aug 19, 2026

TimDiekmann deployed to pull-request August 19, 2026 18:12 — with GitHub Actions Active

TimDiekmann marked this pull request as ready for review August 19, 2026 18:20

Copilot AI balanced review requested due to automatic review settings August 19, 2026 18:20

Copilot started reviewing on behalf of TimDiekmann August 19, 2026 18:21 View session

vercel Bot deployed to Preview – hash August 19, 2026 18:23 View deployment

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Comment thread libs/@local/graph/api/src/identity_provider.rs

Copilot AI review requested due to automatic review settings August 19, 2026 18:39

vercel Bot temporarily deployed to Preview – petrinaut August 19, 2026 18:39 Inactive

vercel Bot temporarily deployed to Preview – petrinaut-docs August 19, 2026 18:39 Inactive

Copilot started reviewing on behalf of TimDiekmann August 19, 2026 18:40 View session

TimDiekmann deployed to pull-request August 19, 2026 18:40 — with GitHub Actions Active

Copilot AI reviewed Aug 19, 2026

View reviewed changes

TimDiekmann requested a review from a team August 19, 2026 18:45

vercel Bot deployed to Preview – hash August 19, 2026 18:51 View deployment

CiaranMn previously approved these changes Aug 19, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 20, 2026 12:22

vercel Bot temporarily deployed to Preview – petrinaut August 20, 2026 12:22 Inactive

vercel Bot temporarily deployed to Preview – petrinaut-docs August 20, 2026 12:22 Inactive

github-actions Bot added area/tests New or updated tests area/tests > integration New or updated integration tests labels Aug 20, 2026

vercel Bot deployed to Preview – hash August 21, 2026 13:00 View deployment

TimDiekmann force-pushed the t/be-770-use-the-kratos-user-id-lookup-on-the-admin-delete-user-path branch from 2524887 to 7ae0efe Compare August 21, 2026 13:05

vercel Bot temporarily deployed to Preview – petrinaut-docs August 21, 2026 13:05 Inactive

vercel Bot temporarily deployed to Preview – petrinaut August 21, 2026 13:05 Inactive

TimDiekmann deployed to pull-request August 21, 2026 13:06 — with GitHub Actions Active

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread libs/@local/graph/api/src/identity_provider.rs

vercel Bot deployed to Preview – hash August 21, 2026 13:19 View deployment

TimDiekmann force-pushed the t/be-770-use-the-kratos-user-id-lookup-on-the-admin-delete-user-path branch from 7ae0efe to 49053e1 Compare August 21, 2026 14:08

TimDiekmann deployed to pull-request August 21, 2026 14:09 — with GitHub Actions Active

vercel Bot deployed to Preview – petrinaut-docs August 21, 2026 14:12 View deployment

vercel Bot deployed to Preview – petrinaut August 21, 2026 14:12 View deployment

vercel Bot deployed to Preview – hash August 21, 2026 14:20 View deployment

TimDiekmann force-pushed the t/be-770-use-the-kratos-user-id-lookup-on-the-admin-delete-user-path branch from 49053e1 to 14c5cf1 Compare August 21, 2026 14:25

vercel Bot temporarily deployed to Preview – petrinaut August 21, 2026 14:25 Inactive

vercel Bot temporarily deployed to Preview – petrinaut-docs August 21, 2026 14:25 Inactive

TimDiekmann deployed to pull-request August 21, 2026 14:26 — with GitHub Actions Active

vercel Bot deployed to Preview – hash August 21, 2026 14:34 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread libs/@local/graph/store/src/user_deletion.rs

TimDiekmann added 4 commits August 22, 2026 03:15

BE-770: Read the user emails from the identity provider

e9a8073

cursor Bot reviewed Aug 22, 2026

View reviewed changes

Uh oh!

Conversation

TimDiekmann commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cursor Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 22, 2026

Choose a reason for hiding this comment

Email fetch blocks entity purge

Uh oh!

github-actions Bot commented Aug 22, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

TimDiekmann commented Aug 19, 2026 •

edited

Loading

vercel Bot commented Aug 19, 2026 •

edited

Loading

codecov Bot commented Aug 19, 2026 •

edited

Loading

cursor Bot commented Aug 19, 2026 •

edited

Loading