RBAC Improvements

Caching improvements
Maker-Checker Implementation

PostFundManagement.ConsoleUI/src/auth/AuthProvider.tsx

@@ -581,62 +581,65 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
             } catch {}
           }
 
-          // Verify tenant lockout at the instance tenant and tenant_id claims are retrieved
-          const tenantLockoutResult = await verifyTenantLockout(
-            storedTenantId ?? tenantClaimValues.tenantId,
-            storedTenantClaim
-          );
-
-          if (!tenantLockoutResult.isActive) {
-            setIsPendingActivation(true);
-            setIsSynced(false);
-            setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
-            setIsLoading(false);
-            return;
-          }
-
-          if (tenantLockoutResult.tenant?.name) {
-            if (resolvedUser) {
-              resolvedUser.tenant = tenantLockoutResult.tenant.name;
-              setUser({ ...resolvedUser });
-              localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
-            }
-            setTenantName(tenantLockoutResult.tenant.name);
-          } else if (storedTenantClaim) {
+          if (storedTenantClaim) {
             setTenantName(storedTenantClaim);
           }
 
-          // Check if session is already marked pending activation or needs sync check
-          const wasPending = isActivationPending();
-          setIsPendingActivation(wasPending);
-          setActivationError(getActivationPendingReason());
+          // Initial fast unblock: valid persisted session found, unblock UI immediately
+          setIsLoading(false);
 
-          try {
-            // Verify sync with browser cache priority (hotspot prevention)
-            const syncResult = await syncUserAccount(
-              storedSub || '',
-              storedToken,
-              resolvedUser || undefined,
-              false
-            );
+          // Asynchronous background revalidation (Tenant Lockout, User Sync, Role Claims)
+          (async () => {
+            try {
+              const tenantLockoutResult = await verifyTenantLockout(
+                storedTenantId ?? tenantClaimValues.tenantId,
+                storedTenantClaim
+              );
 
-            if (syncResult.isUnauthorized) {
-              // HTTP 401: Normal process of routing user to landing page
-              await logout();
-              return;
-            }
+              if (!tenantLockoutResult.isActive) {
+                setIsPendingActivation(true);
+                setIsSynced(false);
+                setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
+                return;
+              }
 
-            if (syncResult.isActivationPending) {
-              setIsPendingActivation(true);
-              setIsSynced(false);
-              setActivationError(syncResult.errorMessage || null);
-            } else if (syncResult.success) {
-              setIsPendingActivation(false);
-              setIsSynced(true);
-              setActivationError(null);
+              if (tenantLockoutResult.tenant?.name) {
+                if (resolvedUser) {
+                  resolvedUser.tenant = tenantLockoutResult.tenant.name;
+                  setUser({ ...resolvedUser });
+                  localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
+                }
+                setTenantName(tenantLockoutResult.tenant.name);
+              }
+
+              const wasPending = isActivationPending();
+              setIsPendingActivation(wasPending);
+              setActivationError(getActivationPendingReason());
+
+              const syncResult = await syncUserAccount(
+                storedSub || '',
+                storedToken,
+                resolvedUser || undefined,
+                false
+              );
+
+              if (syncResult.isUnauthorized) {
+                await logout();
+                return;
+              }
+
+              if (syncResult.isActivationPending) {
+                setIsPendingActivation(true);
+                setIsSynced(false);
+                setActivationError(syncResult.errorMessage || null);
+                return;
+              }
+
+              if (syncResult.success) {
+                setIsPendingActivation(false);
+                setIsSynced(true);
+                setActivationError(null);
 
-              // Retrieve user roles, role claims, and user claims (Requirement 2 & 3 & 7)
-              try {
                 const resolved = await resolveUserRolesAndClaims(
                   storedSub || '',
                   parsedClaims,
@@ -657,17 +660,19 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                 }
                 setClaims({ ...resolved.claims });
                 localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
-              } catch {}
+              }
+            } catch (syncErr: any) {
+              if (syncErr?.response?.status === 401) {
+                await logout();
+                return;
+              }
+              setIsPendingActivation(true);
+              setIsSynced(false);
+              setActivationError(syncErr?.message || 'Account activation pending');
             }
-          } catch (syncErr: any) {
-            if (syncErr?.response?.status === 401) {
-              await logout();
-              return;
-            }
-            setIsPendingActivation(true);
-            setIsSynced(false);
-            setActivationError(syncErr?.message || 'Account activation pending');
-          }
+          })();
+
+          return;
         }
       } catch (err: unknown) {
         console.warn('OIDC initialization notice:', err);