feat(sentry): add user attribution to all authenticated requests

[kilo-code-bot]

Summary

• Adds Sentry.setUser() in validateUserAuthorization() (src/lib/user.server.ts), which is the single success path for all authenticated requests (both tRPC and non-tRPC API routes).
• Sets user id, email (from google_user_email), and ip_address: '{{auto}}' (lets Sentry infer IP from the connection) on every successfully authenticated request's isolation scope.
• Previously, the only Sentry user-related attribution was a setTag('userId', ...) call in the tRPC context creator, which only covered tRPC routes and only set a tag rather than a first-class Sentry user.
• Adds a focused test suite (src/lib/getUserFromAuth.test.ts) that exercises getUserFromAuth end-to-end through mocked dependencies, proving setUser is called with the correct payload on success and is never called on any failure path.

Verification

• pnpm typecheck passes with no errors
• 6/6 tests pass in src/lib/getUserFromAuth.test.ts:
  • sets Sentry user on successful JWT authentication — asserts setUser({ id, email, ip_address: '{{auto}}' })
  • does not set Sentry user when authorization header is invalid
  • does not set Sentry user when user is blocked
  • does not set Sentry user when user is not found
  • does not set Sentry user when non-admin requests admin-only route
  • does not set Sentry user when no auth is present

Visual Changes

N/A

Reviewer Notes

• validateUserAuthorization is called by both auth paths in getUserFromAuth: the Authorization-header path (extension/API calls) and the NextAuth session/cookie path (browser). This is the narrowest choke point for setting user context on authenticated requests.
• google_user_email is a legacy column name — it stores the user's email regardless of auth provider.
• ip_address: '{{auto}}' is the Sentry convention for inferring IP from the inbound connection rather than storing it explicitly.
• The existing setTag('userId', user.id) in src/lib/trpc/init.ts:23 is now redundant (Sentry user id serves the same purpose), but left in place to avoid a behavior change in this PR.
• The test mocks @sentry/nextjs, next/headers, next-auth, auth providers, DB, tokens, and PostHog to isolate the getUserFromAuth → validateUserAuthorization → setUser path. This is the first test in the codebase that exercises the real getUserFromAuth function body rather than mocking it entirely.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• src/lib/getUserFromAuth.test.ts
• src/lib/user.server.ts

---

_{Reviewed by gpt-5.4-20260305 · 142,689 tokens}