fix(auth): logout via bunyip OptionalUser endpoint, Profile -> /settings, synthesize memberships locally #78
No reviewers
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
psa-systems/mokosh-apps!78
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/logout-profile-memberships-noise"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Three independent regressions on the calendar screenshot, all rooted in mokosh-clients' interaction with the Bunyip identity provider.
Profile link 404. The user menu pointed at
${hub}/settings/profile. bunyip-web has/settings(general account settings) but no/settings/profileroute, so the link 404'd on Bunyip. Pointed the menu item at/settingsuntil Bunyip ships a dedicated profile page.Logout no-op. The menu's logout navigated to bunyip-web
/logout, which proxies through bunyip-apiPOST /v1/auth/logout(requiresAuthenticatedUser). bunyip'sAuthenticatedUserextractor only validates legacy HS256 access tokens; users who arrived through OIDC may not satisfy that extractor cleanly, in which case bunyip-web's.unwrap_or_default()swallows the 401 and forwards to/loginwithout clearing cookies./login'sis_signed_in()then bounces them straight back to the dashboard. Switched the redirect target to bunyip-apiGET /v1/auth/logout?url=<bunyip-login>, which is backed byOptionalUser(always clears the .a8n.systems-scoped cookies viaSet-Cookie, regardless of token validation) and redirects to bunyip-web/login?redirect=...&checked=1. The user ends up on bunyip's login page, fully signed out.Memberships 401.
use_memberships_loadercalled bunyip'sGET /v1/auth/membershipswith the OIDC at+jwt the SPA holds. That extractor only validates HS256, so the EdDSA at+jwt fails and the call always 401s on OIDC-authenticated users. Until bunyip's auth extractors accept the at+jwt the issuer itself mints (tracked separately on bunyip), synthesize the same single-membership payload locally: default tenant id00000000-0000-0000-0000-000000000001, tenant_name = user email, role = owner, status = active. Identical shape to bunyip's stub, no network call, no console noise.Three independent regressions on the calendar screenshot, all rooted in mokosh-clients' interaction with the Bunyip identity provider. Profile link 404. The user menu pointed at `${hub}/settings/profile`. bunyip-web has `/settings` (general account settings) but no `/settings/profile` route, so the link 404'd on Bunyip. Pointed the menu item at `/settings` until Bunyip ships a dedicated profile page. Logout no-op. The menu's logout navigated to bunyip-web `/logout`, which proxies through bunyip-api `POST /v1/auth/logout` (requires `AuthenticatedUser`). bunyip's `AuthenticatedUser` extractor only validates legacy HS256 access tokens; users who arrived through OIDC may not satisfy that extractor cleanly, in which case bunyip-web's `.unwrap_or_default()` swallows the 401 and forwards to `/login` without clearing cookies. `/login`'s `is_signed_in()` then bounces them straight back to the dashboard. Switched the redirect target to bunyip-api `GET /v1/auth/logout?url=<bunyip-login>`, which is backed by `OptionalUser` (always clears the .a8n.systems-scoped cookies via `Set-Cookie`, regardless of token validation) and redirects to bunyip-web `/login?redirect=...&checked=1`. The user ends up on bunyip's login page, fully signed out. Memberships 401. `use_memberships_loader` called bunyip's `GET /v1/auth/memberships` with the OIDC at+jwt the SPA holds. That extractor only validates HS256, so the EdDSA at+jwt fails and the call always 401s on OIDC-authenticated users. Until bunyip's auth extractors accept the at+jwt the issuer itself mints (tracked separately on bunyip), synthesize the same single-membership payload locally: default tenant id `00000000-0000-0000-0000-000000000001`, tenant_name = user email, role = owner, status = active. Identical shape to bunyip's stub, no network call, no console noise.