Skip to main content

Manage referenced user attributes

This is Console-only. Open Authentication → User Attributes → Referenced User Attributes. Review the destination attribute key for a schema conflict against the user attribute schema before creating a mapping.

Choose a mapping type​

Select Add Mapping, then choose how the value is found:

  • Foreign-Key lists your app's data tables that have a foreign key to the site-user record. Select App, Table, Column, Attribute Key, the relationship type, and any Populate (optional) fields. A one-to-one mapping resolves to null or one object and fails when multiple rows match. A one-to-many mapping always resolves to a list.
  • Query runs one saved read query for the target user. It resolves to null for no rows and to a list for one or more rows; it does not expose a one-to-one selector in the Console.

The destination Attribute Key must not collide with a stored property in the user-attribute schema or with another active mapping.

Write a safe query mapping​

A query template may use only these parameterized identity variables:

  • %(user_id)s
  • %(user_email)s
  • %(username)s

Use at least one of them to scope the query to the target user. Templates are limited to 5,000 characters and a single SELECT statement. A semicolon outside a string literal is rejected to prevent a multistatement query. Tenant and schema security validation rejects system-catalog access, the public schema, cross-tenant schema references, and schema-changing statements.

Saving performs a rolled-back dry run by wrapping the query with LIMIT 0 and a 5-second timeout. This checks parsing, referenced tables and columns, and the that the query stays within the current site, without saving any results.

TaruviBase re-validates every saved query template against the current static security rules immediately before runtime execution. When that check fails, or when execution raises an error, resolution suppresses the mapping failure and keeps its default value instead of failing the entire user read. For a query mapping, zero rows yields null; one or more rows yields a list. A failed query can also leave the expected mapped attribute absent or null.

Preview and create the mapping​

  1. Enter Attribute Key and the query template.
  2. In Test Query, use the query-only preview. Identify the user with at least one of user_id, user_email, or username, then select Run. Supplying the exact target identity avoids testing one user while reasoning about another.
  3. The preview uses a 5-second timeout, returns 50 rows by default, and caps the requested limit at 200. A preview is raw query output; it does not prove the mapping's production cardinality or every user's result.
  4. An invalid query cannot be saved. Correct any validation or execution error, recheck the destination key, then select Create.
  5. Read a non-production site user and verify the resolved attribute has the expected null, object, or list shape for the chosen mapping type.

If an expected mapped attribute is absent or null, run Test Query for the same identity, correct the saved mapping, and re-read the site user. Contact TaruviBase support if the attribute remains absent or null; include the mapping key, selected site, redacted test result, and user-read result without including personal data or query credentials.

Switch a mapping type safely​

  1. Create a backup of the current mapping definition and redacted verification result before selecting the other mapping type.
  2. Switch the type and review every field. Moving to Query clears the Foreign-Key App, Table, Column, relationship, and Populate values; moving to Foreign-Key clears the query template.
  3. Save, then verify the new definition with Test Query when applicable and a non-production user read.
  4. If the shape or value is wrong, restore the backed-up mapping type and its complete fields, then repeat the verification.

Bulk resolution excludes query mappings by default. Query mappings are limited to the query test result and do not prove every record outcome.

Confirm deletion
  • Affected resource and cascade: Identify records that depend on the mapping.
  • Reversibility: Deleting a mapping removes its resolution rule.
  • Authorization: Confirm the target site and that you are allowed to make this change.
  • Backup or export: Copy the mapping's settings and a test result.
  • Confirmation: Confirm the exact mapping.
  • Success response and postcondition: Verify the mapping is absent and affected records no longer expose the resolved attribute.
  • Recovery: Recreate the mapping and run Test Query again.

Use Delete Mapping only after these checks. Mappings can be managed only in the Console.

For unresolved mapping failures, see troubleshooting.