[Bug] Pre-auth keys "user" field returns the email.

[tale]

Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I'm not entirely sure if this is intended behavior or a bug, but when requesting pre-auth keys via the API /api/v1/preauthkey?user=<user>, the user field on the returned keys have emails and not the user.name or a user object.

Example:

{
  "preAuthKeys": [
    {
      "user": "[email protected]",
      "id": "2",
      "key": "[redacted]",
      "reusable": true,
      "ephemeral": false,
      "used": true,
      "expiration": "2025-07-05T19:00:37.730Z",
      "createdAt": "2025-04-06T19:00:37.840878704Z",
      "aclTags": []
    }
  ]
}

Expected Behavior

API docs aren't clear on this and I expect the response to either return the user.name since that is what we use to filter for pre-auth keys in the request (?user=<user.name>). Or even better, it should return the entire user object, exactly the same as how /api/v1/node does.

Steps To Reproduce

1. Setup Headscale with OIDC
2. Authenticate via OIDC (creating an OIDC user in the database)
3. Generate a pre-auth key tied to the OIDC user
4. Request the auth keys tied to the OIDC user via the API.

Environment

- OS: macOS Sequoia 15.3.2
- Headscale version: v0.25.1
- Tailscale version: 1.82.0

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Debug information

status.json
debug_netmap.json