Finne ut av feil: Missing user ID claim for user token

Vi får veldig ofte denne feilen i loggene våre. Det påvirker trolig ikke funksjonalitet eller ytelse, men skaper mye støy.

`Altinn.App.Core.Features.Auth.Authenticated.NewUser` `Missing user ID claim for user token`

Kilde https://github.com/Altinn/altinn-studio/blob/2377bbe83fe3c11408b897a1745448cb6e019142/src/App/backend/src/Altinn.App.Core/Features/Auth/Authenticated.cs#L983

## Summary

`Altinn.App.Core.Features.Auth.AuthenticationContextException: "Missing user ID claim for user token"`

~6,370 occurrences/week in `digdir-prod-ai` — **73% of all exceptions** (806 of 1,102 in 24h).
**Benign:** thrown inside `TelemetryEnrichingMiddleware`, caught immediately, every request still
returns 200. Only the trace's auth tags are lost. Worth fixing because it buries real failures.

## Root cause

The apps validate raw **Maskinporten** tokens on their own bearer scheme
(`oed-events`: `EventsAuthenticationScheme` / `altinn:dd:internalevents`;
`oed`: `ApiRead` / `digdir:dd:probatedeclarations`). Altinn's default `JwtCookie` scheme tries the
token first and fails (`IDX10503`, expected), then `AuthorizationMiddleware` authenticates on the
custom scheme and sets `HttpContext.User`.

`TelemetryEnrichingMiddleware` then calls `IAuthenticationContext.Current` → `Authenticated.From()`,
which dispatches on claims: `authorization_details` → system user, `urn:altinn:org` → service owner,
`urn:altinn:orgNumber` → org. A plain Maskinporten token has none of these, so in **8.8.3** it falls
through to `NewUser()`, which requires `urn:altinn:userid` → throws.

Two per request because `InvokeAsync` reads `.Current` in two try/catch blocks and the throw happens
before `httpContext.Items[ItemsKey]` is cached (403 requests → 806 exceptions/24h).

**Volume history:** flat 320/day (`da-events`) until 2026-07-03, when the `freg-events` poller went
live and added 512/day. Nothing regressed — a second caller hit the same defect.

## Fix

Upgrade `Altinn.App.Api` + `Altinn.App.Core` from 8.8.3 → **8.12.8**.

Altinn/app-lib-dotnet#1588 (shipped in **8.9.0**) added the missing branch — an
authenticated-but-unrecognised token now returns `Authenticated.Unknown` instead of falling into
`NewUser()`. It only throws when the token carries an Altinn *instance* scope
(`altinn:instances.read/.write`, `altinn:serviceowner/...`); our scopes are not in that set.

Pinned at 8.8.3 in:
- `oed-events` — `App/App.csproj:10`
- `oed-declaration` — `App/App.csproj:14`
- `oed` — `Directory.Packages.props:15` (`AltinnAppLibVersion`)

## Re: "upgrading past 8.8.3 is breaking"

Checked — not a blocker for these repos:

- Only **one** release in 8.9.0–8.12.8 is flagged breaking: **8.12.1**, *"Cast null to 0 in
arithmetic expressions"*. No layout in `oed`/`oed-declaration` uses arithmetic expressions (0 of 22).
- Public API diff 8.8.3 → 8.12.8: 172 members removed/changed, 958 added. **None of the removed
members are referenced by any of the three repos.** Removals are mostly internal ctor signatures,
plus `IProcessTaskCleaner` and `ICorrespondenceNotificationBuilder.WithRecipientOverride` — unused here.
- `IDataClient` / `IInstanceClient` only *gained* overloads; 8.11.2 + 8.12.0 explicitly fixed their
binary compatibility.
- Both versions target `net8.0` and depend on `Altinn.ApiClients.Maskinporten 8.0.1`.

Two version traps — land on **8.12.7+**:
- 8.12.2 pulled in `Microsoft.OpenApi v2` (would break `oed-events`, which imports
`Microsoft.OpenApi.Models`) — reverted in 8.12.3.
- 8.12.0–8.12.6 carried Maskinporten client v10 — reverted in 8.12.7 over a config-binding regression.

Prior upgrade pain (`feature/update_altinn_applib`, the reverted `oed-declaration` bump) was the
**8.3.7 → 8.8.3** jump, not this one.

**Not ruled out statically:** `oed`'s vendored `App/react/altinn-app-frontend` (backend/frontend
coupling isn't visible in a package diff); transitive bumps `Altinn.Common.PEP` 4.1.2→4.2.3 and
`Altinn.Platform.Storage.Interface` 4.0.13→4.7.1; `WarningsAsErrors=NU1903;NU1904` means restore
fails on any new high/critical advisory.

**Suggested order:** `oed-events` first — smallest, no frontend, and source of 5,802 of the 6,370.

Full write-up with the trend chart: ⧉ https://claude.ai/code/artifact/f83f90d9-6d4a-46ab-ade1-5d8631356777 (private — share from the page's menu if you want to link it in the issue).

Start with App/App.csproj in oed-events, then check App/App.csproj in oed-declaration and Directory.Packages.props in oed for the pinned Altinn versions. Upgrade Altinn.App.Api and Altinn.App.Core to at least 8.12.7, beginning with oed-events as suggested, and verify restore, compatibility, and the reported exception volume. Confirm that the upgrade does not introduce the listed frontend, transitive dependency, or advisory issues.

Written by the indexing model from the issue text.