dashboard-api: Ory admin API calls fail silently in Hydra-only or CDN-proxied deployments

Summary

dashboard-api uses the Ory admin SDK (via ORY_PROJECT_API_TOKEN + ORY_SDK_URL) to fetch user profiles (email, name) and look up users by email. In two common self-hosted configurations this fails completely:

1. Hydra-only deployments (without Kratos) — Kratos identity admin endpoints (/admin/identities) do not exist
2. CDN-proxied Hydra — reverse proxies commonly block /admin/ paths (e.g. Nginx, Cloudflare), returning 403/404

Affected endpoints

Root cause

GetProfilesByUserID and FindProfilesByEmail in the userprofile package call Ory's admin API. There is no fallback when the admin API is unavailable, so the above handlers return errors or empty results even when the underlying data exists in PostgreSQL.

Environment

• Hydra v2.x (standalone, no Kratos)
• ORY_PROJECT_API_TOKEN set to a placeholder value (required by config validation, but admin API not reachable)
• CDN (volcengine ALB) proxies https://auth.example.com and blocks all /admin/* paths

Suggested fix

Add a DB-based fallback for email resolution when the Ory admin API call fails:

// In GetTeamsTeamIDMembers — after profiles, err := s.userProfiles.GetProfilesByUserID(...)
if err != nil {
    // Fallback: read email from each user's default team record in PostgreSQL
    emails, dbErr := s.authDB.GetUserEmailsByUserIDs(ctx, userIDs)
    if dbErr != nil {
        s.sendAPIStoreError(c, http.StatusInternalServerError, "Failed to get team member profiles")
        return
    }
    // build profiles map from emails
}

The email stored in public.teams.email (where users_teams.is_default = true) is the canonical login email written during bootstrap — it is a reliable fallback.

A similar fallback applies to PostTeamsTeamIDMembers when looking up a user by email.

This makes dashboard-api usable in Hydra-only and CDN-restricted self-hosted deployments without any change to the Ory/Hydra configuration.

Start with GetProfilesByUserID and FindProfilesByEmail in the userprofile package, then trace GetTeamsTeamIDMembers and PostTeamsTeamIDMembers. Inspect the authDB data for public.teams.email and users_teams.is_default, and verify both affected endpoints resolve emails when the Ory admin API is unavailable while bootstrap remains unchanged.