Entra ID: Graph group-overage lookup silently swallows errors

Provider

Microsoft Entra ID (providers/ms_entra_id.go)

What happens

When a user hits AAD group overage (>200 groups), EnrichSession calls addGraphGroupsToSession to read the real group list from Microsoft Graph. If that Graph request fails, the error is logged and then dropped:

if err != nil {
    logger.Errorf("invalid response from microsoft graph, no groups added to session: %v", err)
    return nil
}

addGraphGroupsToSession returns error, and the caller already handles it:

if err = p.addGraphGroupsToSession(ctx, session); err != nil {
    return fmt.Errorf("unable to enrich session: %v", err)
}

Because the function returns nil on failure, that caller branch is dead. So on a transient Graph outage the login still succeeds, but the session is populated with the overage placeholder instead of the user's actual groups — a silent, inconsistent authorization state rather than a clear failure. Every other error path in the file propagates with fmt.Errorf, and mockGraphAPI(true) (returns 401) already exists in the test file but nothing uses it, which reads like the failure path was meant to be exercised.

What I'd expect

The Graph error should propagate so the caller's existing error handling runs and the login fails cleanly instead of continuing with wrong groups.

Happy to send a small PR for this (propagate the error + a regression test using the existing 401 mock). If you'd rather keep log-and-continue behaviour here, let me know and I'll close it.