Overhauled lockout process

2026-10-24 17:36:30 +02:00
parent a731c979bb
commit 25e251aa79
12 changed files with 574 additions and 527 deletions
@@ -10,13 +10,14 @@ import {
  isActivationPending,
  getActivationPendingReason,
  clearUserSyncInBrowser,
+  setActivationPending,
  UserSyncResult,
 } from '../services/userSyncService';
 import { AccountActivationModal } from '../components/auth/AccountActivationModal';
 import { PartnerAccessDeniedModal } from '../components/auth/PartnerAccessDeniedModal';
 import { SessionExpiredModal } from '../components/auth/SessionExpiredModal';
-import { encodeHashIdSync } from '../services/toolsService';
-import { verifyTenantLockout } from '../services/tenantLockoutService';
+import { encodeHashIdSync } from '../utils/hashids';
+import { verifyTenantLockout, clearTenantLockoutCache } from '../services/tenantLockoutService';
 import {
  onSessionExpired,
  triggerSessionExpired,
@@ -307,11 +308,6 @@ export function resetUserManager(): void {
  userManagerInstance = null;
 }

-// Automatically reset UserManager when runtime configuration is updated
-onConfigChanged(() => {
-  resetUserManager();
-});
-
 export function getUserManager(): UserManager {
  if (!userManagerInstance && typeof window !== 'undefined') {
    const sec = getSecuritySettings();
@@ -437,8 +433,8 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
            localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(mergedClaims));

            const tenantClaimValues = extractTenantClaimValues(mergedClaims, token);
-            const tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
-            const parsedTenantId = extractTenantId(mergedClaims, token);
+            let tenantClaim = (mergedClaims.tenant as string) || (oidcUser.profile?.tenant as string) || tenantClaimValues.tenant || undefined;
+            let parsedTenantId = extractTenantId(mergedClaims, token);
            setTenantId(parsedTenantId);

            const profile: AuthUserProfile = {
@@ -458,29 +454,7 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
            // Clean up code and state from URL
            window.history.replaceState({}, document.title, window.location.pathname);

-            // Verify tenant lockout at the instance tenant and tenant_id claims are retrieved
-            const tenantLockoutResult = await verifyTenantLockout(
-              parsedTenantId ?? tenantClaimValues.tenantId,
-              tenantClaim
-            );
-
-            if (!tenantLockoutResult.isActive) {
-              setIsPendingActivation(true);
-              setIsSynced(false);
-              setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
-              setIsLoading(false);
-              return;
-            }
-
-            if (tenantLockoutResult.tenant?.name) {
-              profile.tenant = tenantLockoutResult.tenant.name;
-              setTenantName(tenantLockoutResult.tenant.name);
-              localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
-            } else if (tenantClaim) {
-              setTenantName(tenantClaim);
-            }
-
-            // Synchronize authenticated user profile with backend directory
+            // Step 1: Synchronize authenticated user profile with backend directory FIRST (/v1/api/integration/sync)
            try {
              const syncResult = await syncUserAccount(userSub, token, profile, true);
              if (syncResult.isUnauthorized) {
@@ -488,6 +462,51 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                window.location.replace('/');
                return;
              }
+
+              // Step 2: Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
+              try {
+                const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
+                if (resolved.primaryRole) {
+                  profile.role = resolved.primaryRole;
+                }
+                if (resolved.tenant) {
+                  profile.tenant = resolved.tenant;
+                  tenantClaim = resolved.tenant;
+                  setTenantName(resolved.tenant);
+                }
+                if (resolved.tenant_id !== undefined) {
+                  profile.tenant_id = resolved.tenant_id;
+                  parsedTenantId = resolved.tenant_id;
+                  setTenantId(resolved.tenant_id);
+                }
+                setUser({ ...profile });
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is synced and authenticated
+              const tenantLockoutResult = await verifyTenantLockout(
+                parsedTenantId ?? tenantClaimValues.tenantId,
+                tenantClaim
+              );
+
+              if (!tenantLockoutResult.isActive) {
+                setIsPendingActivation(true);
+                setIsSynced(false);
+                setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
+                setIsLoading(false);
+                return;
+              }
+
+              if (tenantLockoutResult.tenant?.name) {
+                profile.tenant = tenantLockoutResult.tenant.name;
+                setTenantName(tenantLockoutResult.tenant.name);
+                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
+              } else if (tenantClaim) {
+                setTenantName(tenantClaim);
+              }
+
              if (syncResult.isActivationPending) {
                setIsPendingActivation(true);
                setIsSynced(false);
@@ -496,26 +515,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                setIsPendingActivation(false);
                setIsSynced(true);
                setActivationError(null);
-
-                // Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
-                try {
-                  const resolved = await resolveUserRolesAndClaims(userSub, mergedClaims, profile);
-                  if (resolved.primaryRole) {
-                    profile.role = resolved.primaryRole;
-                  }
-                  if (resolved.tenant) {
-                    profile.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    profile.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...profile });
-                  setClaims({ ...resolved.claims });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));
-                  localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
-                } catch {}
              }
            } catch (syncErr: any) {
              if (syncErr?.response?.status === 401) {
@@ -525,7 +524,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
              }
              setIsPendingActivation(true);
              setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
            }

            setIsLoading(false);
@@ -561,10 +562,10 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
            setSub(storedSub);
          }

-          const storedTenantId = extractTenantId(parsedClaims, storedToken);
+          let storedTenantId = extractTenantId(parsedClaims, storedToken);
          setTenantId(storedTenantId);
          const tenantClaimValues = extractTenantClaimValues(parsedClaims, storedToken);
-          const storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;
+          let storedTenantClaim = (parsedClaims.tenant as string) || tenantClaimValues.tenant || undefined;

          let resolvedUser: AuthUserProfile | null = null;
          if (storedUser) {
@@ -588,9 +589,53 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
          // Initial fast unblock: valid persisted session found, unblock UI immediately
          setIsLoading(false);

-          // Asynchronous background revalidation (Tenant Lockout, User Sync, Role Claims)
+          // Asynchronous background revalidation (User Sync, Role Claims, Tenant Lockout)
          (async () => {
            try {
+              const wasPending = isActivationPending();
+              setIsPendingActivation(wasPending);
+              setActivationError(getActivationPendingReason());
+
+              // Step 1: Sync user account FIRST
+              const syncResult = await syncUserAccount(
+                storedSub || '',
+                storedToken,
+                resolvedUser || undefined,
+                false
+              );
+
+              if (syncResult.isUnauthorized) {
+                await logout();
+                return;
+              }
+
+              // Step 2: Retrieve user roles, role claims, and user claims
+              try {
+                const resolved = await resolveUserRolesAndClaims(
+                  storedSub || '',
+                  parsedClaims,
+                  resolvedUser || {}
+                );
+                if (resolvedUser) {
+                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
+                  if (resolved.tenant) {
+                    resolvedUser.tenant = resolved.tenant;
+                    storedTenantClaim = resolved.tenant;
+                    setTenantName(resolved.tenant);
+                  }
+                  if (resolved.tenant_id !== undefined) {
+                    resolvedUser.tenant_id = resolved.tenant_id;
+                    storedTenantId = resolved.tenant_id;
+                    setTenantId(resolved.tenant_id);
+                  }
+                  setUser({ ...resolvedUser });
+                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
+                }
+                setClaims({ ...resolved.claims });
+                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+              } catch {}
+
+              // Step 3: Verify tenant lockout now that user is verified active
              const tenantLockoutResult = await verifyTenantLockout(
                storedTenantId ?? tenantClaimValues.tenantId,
                storedTenantClaim
@@ -612,22 +657,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                setTenantName(tenantLockoutResult.tenant.name);
              }

-              const wasPending = isActivationPending();
-              setIsPendingActivation(wasPending);
-              setActivationError(getActivationPendingReason());
-
-              const syncResult = await syncUserAccount(
-                storedSub || '',
-                storedToken,
-                resolvedUser || undefined,
-                false
-              );
-
-              if (syncResult.isUnauthorized) {
-                await logout();
-                return;
-              }
-
              if (syncResult.isActivationPending) {
                setIsPendingActivation(true);
                setIsSynced(false);
@@ -639,27 +668,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                setIsPendingActivation(false);
                setIsSynced(true);
                setActivationError(null);
-
-                const resolved = await resolveUserRolesAndClaims(
-                  storedSub || '',
-                  parsedClaims,
-                  resolvedUser || {}
-                );
-                if (resolvedUser) {
-                  if (resolved.primaryRole) resolvedUser.role = resolved.primaryRole;
-                  if (resolved.tenant) {
-                    resolvedUser.tenant = resolved.tenant;
-                    setTenantName(resolved.tenant);
-                  }
-                  if (resolved.tenant_id !== undefined) {
-                    resolvedUser.tenant_id = resolved.tenant_id;
-                    setTenantId(resolved.tenant_id);
-                  }
-                  setUser({ ...resolvedUser });
-                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
-                }
-                setClaims({ ...resolved.claims });
-                localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
              }
            } catch (syncErr: any) {
              if (syncErr?.response?.status === 401) {
@@ -668,7 +676,9 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
              }
              setIsPendingActivation(true);
              setIsSynced(false);
-              setActivationError(syncErr?.message || 'Account activation pending');
+              const rawMsg = syncErr?.message || 'Account activation pending';
+              const cleanMsg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
+              setActivationError(cleanMsg);
            }
          })();

@@ -687,12 +697,65 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>

  const syncUserSession = async (force = true): Promise<UserSyncResult> => {
    try {
-      // Re-verify tenant status via GetTenant as part of the lockout resolution
-      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
-      const currentTenantId = tenantId ?? tenantClaimValues.tenantId;
-      const currentTenantClaim = (claims.tenant as string) || user?.tenant || tenantClaimValues.tenant || undefined;
+      await loadRuntimeConfig();
+      clearTenantLockoutCache();

-      const tenantLockoutResult = await verifyTenantLockout(currentTenantId, currentTenantClaim);
+      // Step 1: Proceed with user sync FIRST (/v1/api/integration/sync)
+      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
+      if (result.isUnauthorized) {
+        await logout();
+        return result;
+      }
+      if (result.isActivationPending) {
+        setIsPendingActivation(true);
+        setIsSynced(false);
+        setActivationError(result.errorMessage || null);
+        return result;
+      }
+
+      // Step 2: Refresh user roles and claims from backend
+      let currentTenantId: number | string | null = tenantId;
+      let currentTenantClaim: string | undefined =
+        (claims.tenant as string) || user?.tenant || undefined;
+
+      try {
+        const resolved = await resolveUserRolesAndClaims(sub, claims, user || {});
+        const updatedProfile = user ? { ...user } : null;
+        if (updatedProfile && resolved.primaryRole) {
+          updatedProfile.role = resolved.primaryRole;
+        }
+        if (resolved.tenant) {
+          currentTenantClaim = resolved.tenant;
+          setTenantName(resolved.tenant);
+          if (updatedProfile) updatedProfile.tenant = resolved.tenant;
+        }
+        if (resolved.tenant_id !== undefined) {
+          currentTenantId = resolved.tenant_id;
+          setTenantId(resolved.tenant_id);
+          if (updatedProfile) updatedProfile.tenant_id = resolved.tenant_id;
+        }
+        if (updatedProfile) {
+          setUser(updatedProfile);
+          localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(updatedProfile));
+        }
+        setClaims({ ...resolved.claims });
+        localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
+      } catch {}
+
+      // Step 3: Re-verify tenant status via GetTenant now that user is synced
+      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
+      const effectiveTenantId =
+        currentTenantId ??
+        result.data?.tenantId ??
+        result.data?.organisationId ??
+        tenantClaimValues.tenantId;
+      const effectiveTenantClaim = currentTenantClaim || tenantClaimValues.tenant || undefined;
+
+      const tenantLockoutResult = await verifyTenantLockout(
+        effectiveTenantId,
+        effectiveTenantClaim,
+        true
+      );
      if (!tenantLockoutResult.isActive) {
        const msg = tenantLockoutResult.errorMessage || 'Tenant is not Active. Lockout active.';
        setIsPendingActivation(true);
@@ -705,28 +768,22 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
        };
      }

-      // Tenant is verified Active: proceed with user sync
-      const result = await syncUserAccount(sub, accessToken, user || undefined, force);
-      if (result.isUnauthorized) {
-        await logout();
-        return result;
-      }
-      if (result.success) {
-        setIsPendingActivation(false);
-        setIsSynced(true);
-        setActivationError(null);
-      } else if (result.isActivationPending) {
-        setIsPendingActivation(true);
-        setIsSynced(false);
-        setActivationError(result.errorMessage || null);
+      if (tenantLockoutResult.tenant?.name) {
+        setTenantName(tenantLockoutResult.tenant.name);
      }
+
+      setActivationPending(false);
+      setIsPendingActivation(false);
+      setIsSynced(true);
+      setActivationError(null);
      return result;
    } catch (err: any) {
      if (err?.response?.status === 401) {
        await logout();
        return { success: false, isUnauthorized: true };
      }
-      const msg = err?.message || 'Sync failed';
+      const rawMsg = err?.message || 'Sync failed';
+      const msg = /network\s*error/i.test(rawMsg) ? rawMsg.replace(/network\s*error/gi, 'Permission Check') : rawMsg;
      setIsPendingActivation(true);
      setIsSynced(false);
      setActivationError(msg);