Users with user_data cannot connect to app endpoints

[lynshi]

Describe the bug
A user added to the sample JS app cannot connect to the application endpoint if the user was added with any user data.

{
  "error": {
    "code": "InternalError",
    "message": "Failed to get data for caller cc709cb5bcd8f456a0ab1bf64ccb54ab0032448473ab6a97157d338365a65a21"
  }
}

To Reproduce

1. Start a CCF app with sandbox.sh using the sample JS app.
2. In the created workspace/sandbox_common directory, create the set_user proposal using the generated user0 (note this has already been added to the network by sandbox.sh, and the user initially works).

{
  "actions": [
    {
      "args": {
        "cert": "-----BEGIN CERTIFICATE-----\nMIIBsTCCATigAwIBAgIUZEseIqxujb/7+KIlo62qDL3q/sUwCgYIKoZIzj0EAwMw\nEDEOMAwGA1UEAwwFdXNlcjAwHhcNMjIwOTEzMTk0NjA5WhcNMjMwOTEzMTk0NjA5\nWjAQMQ4wDAYDVQQDDAV1c2VyMDB2MBAGByqGSM49AgEGBSuBBAAiA2IABGkKQ3DI\n/9OgEWvr0kRTnG8jrhX0e11yZhFUFCn+VNXtFAMvn9Iv+6eDWHL5wCZ2q8qY9NYS\nCjKEFUKOfg17sJWoKRBU/dUh2UU2U2owAUhk7eTqLusn9wDsUTfz7X4AqKNTMFEw\nHQYDVR0OBBYEFOo9dqM++7RTCFb8+bJDE2Astv6MMB8GA1UdIwQYMBaAFOo9dqM+\n+7RTCFb8+bJDE2Astv6MMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwMDZwAw\nZAIwZB99OtrzuS8wXIHDMDoWlYk2P8M3rBuUIM1GBDq5XN3JdAnGYRFZvXTiQbWa\n4YEFAjA+lfv0VHDeDtatDWmHN3pOIkRN8GSVcvp4RW+vtD1EOrxhZxa7wzhCNuOt\ntSUrSPg=\n-----END CERTIFICATE-----\n",
        "user_data": {
          "hello": "world"
        }
      },
      "name": "set_user"
    }
  ]
}

3. Submit the proposal: /opt/ccf/bin/scurl.sh https://127.0.0.1:8000/gov/proposals --cacert service_cert.pem --signing-key member0_privk.pem --signing-cert member0_cert.pem --data-binary @set_user.json -H "content-type: application/json"
4. Try to use the app: curl https://127.0.0.1:8000/app/compute2/add/3/5 -k --silent --cert user0_cert.pem --key user0_privk.pem | jq. The error above is returned.

Expected behavior
The added user should be able to successfully connect as before.

Environment information
CCF 2.0.4 (I didn't notice I was on an earlier version until too late, but this isn't mentioned in release notes so I would guess it's not been addressed yet)

Additional context
I printed the proposal submitted by sandbox.sh to add the user (the cert doesn't match exactly because it is a different run) and the only difference is that there is no user data provided.

{
  "actions": [
    {
      "args": {
        "cert": "-----BEGIN CERTIFICATE-----\nMIIBsjCCATigAwIBAgIUe4dCpj85UsGZZuNbfZrrN32EGA8wCgYIKoZIzj0EAwMw\nEDEOMAwGA1UEAwwFdXNlcjAwHhcNMjIwOTEzMjAxMDM0WhcNMjMwOTEzMjAxMDM0\nWjAQMQ4wDAYDVQQDDAV1c2VyMDB2MBAGByqGSM49AgEGBSuBBAAiA2IABH4j52FW\nfvytgX4s9M/8j17mWZMo1J19lYhVFR7y4SY8elimwKRIKyrfHMgygT9+gZwn+rHj\nVSPA9wjmQbnzal+rqDuvSjhYuzhBDvn8mTUnrMvPbKhfrcYtZgOG6Jh8O6NTMFEw\nHQYDVR0OBBYEFAjUdCJ3gkbEcn4UWnlI+tx5quFcMB8GA1UdIwQYMBaAFAjUdCJ3\ngkbEcn4UWnlI+tx5quFcMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwMDaAAw\nZQIxAJRAY8J2vfUfilmgkkQ+Ishg93Kz0q2FUFrqXipljov06caaLE37Wqa4+vKR\n8zy3aAIwF7GfosvRLvn/pSpuXzKJCkurqhYlgYJeAP/RlSAUJxvmMmZsRQLSGJj1\n9NbyG6Vx\n-----END CERTIFICATE-----\n"
      },
      "name": "set_user"
    }
  ]
}

[eddyashton]

@lynshi Thanks for raising, and the precise repro steps. I have a fix pending in #4231.

As a workaround until that is released, you can make the same small change to the set_user action in your constitution, or use set_user_data directly (though that results in 2 proposals to add a user with user_data). Note that to fix this in existing services, you'll need to update their constitutions to correct the implementation of set_user.

[achamayou]

@lynshi this is now released https://github.com/microsoft/CCF/releases/tag/ccf-3.0.0-dev4