RBAC Improvements

Caching improvements
Maker-Checker Implementation

PostFundManagement.ConsoleUI/src/services/httpClient.ts

@@ -5,6 +5,55 @@ import { isUserSyncedInBrowser, isActivationPending, syncUserAccount } from './u
 
 export const BASE_API_URL = getApiBaseUrl();
 
+// ---------------------------------------------------------------------------
+// Mutation Versioning & Cache-Busting Management
+// ---------------------------------------------------------------------------
+// ASP.NET Core OutputCaching caches GET responses based on Method + URI + QueryString.
+// To ensure that mutations (create, update, approve, delete) immediately invalidate
+// backend OutputCache without serving stale data, ConsoleUI tracks a mutation epoch.
+// Every successful POST/PUT/PATCH/DELETE bumps this epoch, ensuring subsequent GET
+// requests partition to a fresh cache key on the server.
+// ---------------------------------------------------------------------------
+
+const MUTATION_EPOCH_STORAGE_KEY = 'pfm_mutation_epoch';
+
+let activeMutationEpoch: number = (() => {
+  if (typeof window !== 'undefined') {
+    try {
+      const stored = sessionStorage.getItem(MUTATION_EPOCH_STORAGE_KEY);
+      if (stored) {
+        const parsed = Number(stored);
+        if (!isNaN(parsed) && parsed > 0) return parsed;
+      }
+    } catch {}
+  }
+  return Date.now();
+})();
+
+/**
+ * Returns the current client mutation epoch timestamp.
+ * Appended as `_v` to internal API GET requests to partition backend OutputCache entries.
+ */
+export function getMutationEpoch(): number {
+  return activeMutationEpoch;
+}
+
+/**
+ * Bumps the mutation epoch to the current timestamp.
+ * Called automatically after any successful POST/PUT/PATCH/DELETE request,
+ * or manually when cache busting is required.
+ * Ensures subsequent GET requests bypass stale ASP.NET Core OutputCache entries.
+ */
+export function bumpMutationEpoch(): number {
+  activeMutationEpoch = Date.now();
+  if (typeof window !== 'undefined') {
+    try {
+      sessionStorage.setItem(MUTATION_EPOCH_STORAGE_KEY, String(activeMutationEpoch));
+    } catch {}
+  }
+  return activeMutationEpoch;
+}
+
 // Create Axios Instance
 export const apiClient = axios.create({
   baseURL: BASE_API_URL,
@@ -15,7 +64,7 @@ export const apiClient = axios.create({
   timeout: 15000,
 });
 
-// Request Interceptor to dynamically set baseURL and attach Bearer Token
+// Request Interceptor to dynamically set baseURL, attach Bearer Token, and apply cache-busting
 apiClient.interceptors.request.use(
   async (config: InternalAxiosRequestConfig) => {
     // Dynamically synchronize baseURL from runtime configuration
@@ -25,9 +74,46 @@ apiClient.interceptors.request.use(
       config.headers.Authorization = `Bearer ${token}`;
     }
 
+    const isLifecycleRequest = isUserSyncEndpoint(config.url) || isTenantEndpoint(config.url);
+    const isExternal =
+      config.url?.startsWith('http://') ||
+      config.url?.startsWith('https://') ||
+      config.url?.includes('amazonaws.com') ||
+      config.url?.includes('garage');
+
+    // Attach mutation epoch or explicit timestamp to GET requests for OutputCache management
+    if (config.method?.toUpperCase() === 'GET' && !isExternal) {
+      const headers = config.headers || {};
+      const hasNoCacheHeader =
+        headers['Cache-Control'] === 'no-cache' ||
+        headers['cache-control'] === 'no-cache' ||
+        headers['Pragma'] === 'no-cache';
+
+      if (hasNoCacheHeader) {
+        // Explicit freshness requested: attach fresh timestamp
+        if (config.params instanceof URLSearchParams) {
+          config.params.set('_t', String(Date.now()));
+        } else {
+          config.params = config.params || {};
+          config.params._t = Date.now();
+        }
+      } else {
+        // Standard GET: attach current mutation epoch
+        if (config.params instanceof URLSearchParams) {
+          if (!config.params.has('_v') && !config.params.has('_t')) {
+            config.params.set('_v', String(getMutationEpoch()));
+          }
+        } else {
+          config.params = config.params || {};
+          if (!config.params._v && !config.params._t) {
+            config.params._v = getMutationEpoch();
+          }
+        }
+      }
+    }
+
     // User Sync & Tenant Lifecycle Guard:
     // All API calls require an authenticated and enabled user in the backend system.
-    const isLifecycleRequest = isUserSyncEndpoint(config.url) || isTenantEndpoint(config.url);
     if (token && !isLifecycleRequest) {
       // If user account is flagged as pending administrator activation, block downstream API calls
       if (isActivationPending()) {
@@ -48,9 +134,17 @@ apiClient.interceptors.request.use(
   (error) => Promise.reject(error)
 );
 
-// Response Interceptor for global HTTP 401 detection
+// Response Interceptor for global HTTP 401 detection and mutation cache invalidation
 apiClient.interceptors.response.use(
-  (response) => response,
+  (response) => {
+    // If response was from a successful mutating HTTP method (POST, PUT, PATCH, DELETE),
+    // automatically bump the mutation epoch so subsequent refetches bypass stale OutputCache
+    const method = response.config?.method?.toLowerCase();
+    if (method && ['post', 'put', 'patch', 'delete'].includes(method)) {
+      bumpMutationEpoch();
+    }
+    return response;
+  },
   (error) => {
     if (error?.response?.status === 401) {
       const requestUrl = error.config?.url;

PostFundManagement.ConsoleUI/src/services/roleClaimsCache.ts

@@ -5,33 +5,64 @@ import { ROLE_CLAIM_DEFINITIONS } from '../auth/rbac';
 export const LOCAL_STORAGE_SYSTEM_ROLES_KEY = 'pfm_cache_system_roles';
 export const LOCAL_STORAGE_ROLE_CLAIMS_PREFIX = 'pfm_cache_role_claims_';
 export const LOCAL_STORAGE_SYSTEM_CLAIMS_KEY = 'pfm_cache_system_claims';
+export const LOCAL_STORAGE_RBAC_VERSION_KEY = 'pfm_rbac_cache_version';
+export const CURRENT_RBAC_CACHE_VERSION = 'v2.1';
+
+/**
+ * Invalidates and purges legacy cached claims if the schema version differs.
+ */
+export function ensureFreshRbacCache(): void {
+  if (typeof window === 'undefined') return;
+  try {
+    const version = localStorage.getItem(LOCAL_STORAGE_RBAC_VERSION_KEY);
+    if (version !== CURRENT_RBAC_CACHE_VERSION) {
+      // Clear legacy claims and caches
+      const keysToRemove: string[] = [];
+      for (let i = 0; i < localStorage.length; i++) {
+        const key = localStorage.key(i);
+        if (key && (key.startsWith(LOCAL_STORAGE_ROLE_CLAIMS_PREFIX) || key === 'pfm_user_claims')) {
+          keysToRemove.push(key);
+        }
+      }
+      keysToRemove.forEach((k) => localStorage.removeItem(k));
+      inMemoryRoleClaims.clear();
+      localStorage.setItem(LOCAL_STORAGE_RBAC_VERSION_KEY, CURRENT_RBAC_CACHE_VERSION);
+    }
+  } catch {}
+}
 
 // In-memory runtime caches
 let inMemorySystemRoles: Role[] | null = null;
 const inMemoryRoleClaims = new Map<string, Claim[]>();
 let inMemorySystemClaims: Claim[] | null = null;
+const inMemoryUserRoles = new Map<string, { roles: Role[]; timestamp: number }>();
+const inMemoryUserClaims = new Map<string, { claims: Claim[]; timestamp: number }>();
+const USER_RBAC_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+// Initial check on load
+ensureFreshRbacCache();
 
 // Standard role claim defaults matching PFM Identity Server specification
 export const DEFAULT_ROLE_CLAIMS: Record<string, Claim[]> = {
   contributor: [
-    { claimId: 30, claimType: 'projects_milestones', claimValue: 'view, edit, update' },
-    { claimId: 31, claimType: 'grant_financials', claimValue: 'view, edit, update' },
-    { claimId: 32, claimType: 'evidence_risks', claimValue: 'view, edit, update' },
-    { claimId: 33, claimType: 'beneficiaries', claimValue: 'view, edit, update' },
-    { claimId: 34, claimType: 'change_management', claimValue: 'view, edit, update' },
-    { claimId: 35, claimType: 'site_visits', claimValue: 'view, edit, update' },
-    { claimId: 36, claimType: 'settings_invites', claimValue: 'view, edit, update' },
+    { claimId: 30, claimType: 'projects_milestones', claimValue: 'view, add' },
+    { claimId: 31, claimType: 'grant_financials', claimValue: 'view, add' },
+    { claimId: 32, claimType: 'evidence_risks', claimValue: 'view, add' },
+    { claimId: 33, claimType: 'beneficiaries', claimValue: 'view, add' },
+    { claimId: 34, claimType: 'change_management', claimValue: 'view, add' },
+    { claimId: 35, claimType: 'site_visits', claimValue: 'view, add' },
+    { claimId: 36, claimType: 'settings_invites', claimValue: 'view, add' },
   ],
   supervisor: [
-    { claimId: 20, claimType: 'dashboard', claimValue: 'view, add, export' },
-    { claimId: 21, claimType: 'projects_milestones', claimValue: 'view, add, export' },
-    { claimId: 22, claimType: 'grant_financials', claimValue: 'view, add, export' },
-    { claimId: 23, claimType: 'evidence_risks', claimValue: 'view, add, export' },
-    { claimId: 24, claimType: 'beneficiaries', claimValue: 'view, add, export' },
-    { claimId: 25, claimType: 'change_management', claimValue: 'view, add, export' },
-    { claimId: 26, claimType: 'site_visits', claimValue: 'view, add, export' },
-    { claimId: 27, claimType: 'settings_invites', claimValue: 'view, add, export' },
-    { claimId: 28, claimType: 'settings_users', claimValue: 'view, add, export' },
+    { claimId: 20, claimType: 'dashboard', claimValue: 'view, export' },
+    { claimId: 21, claimType: 'projects_milestones', claimValue: 'view, add, update, export' },
+    { claimId: 22, claimType: 'grant_financials', claimValue: 'view, add, update, export' },
+    { claimId: 23, claimType: 'evidence_risks', claimValue: 'view, add, update, export' },
+    { claimId: 24, claimType: 'beneficiaries', claimValue: 'view, add, update, export' },
+    { claimId: 25, claimType: 'change_management', claimValue: 'view, add, update, export' },
+    { claimId: 26, claimType: 'site_visits', claimValue: 'view, add, update, export' },
+    { claimId: 27, claimType: 'settings_invites', claimValue: 'view, add, update, export' },
+    { claimId: 28, claimType: 'settings_users', claimValue: 'view, add, update, export' },
   ],
   manager: [
     { claimId: 10, claimType: 'dashboard', claimValue: 'all' },
@@ -154,8 +185,14 @@ export function setCachedRoleClaims(roleKey: string, claims: Claim[]): void {
 
 /**
  * Fetches system roles from backend API, caching the result in memory and localStorage.
+ * Checks cache first to avoid redundant network round trips.
  */
-export async function fetchAndCacheSystemRoles(): Promise<Role[]> {
+export async function fetchAndCacheSystemRoles(forceRefresh = false): Promise<Role[]> {
+  if (!forceRefresh) {
+    const cached = getCachedSystemRoles();
+    if (cached && cached.length > 0) return cached;
+  }
+
   try {
     const res = await apiClient.get<Role[]>('/v1/api/users/system/roles');
     if (res.data && Array.isArray(res.data) && res.data.length > 0) {
@@ -181,30 +218,69 @@ export async function fetchAndCacheSystemRoles(): Promise<Role[]> {
   return defaults;
 }
 
+const GUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
 /**
  * Fetches role claims for a role from the API, caching them under role ID and role name.
+ * Uses cache-first strategy to eliminate sequential network waterfalls on startup.
  */
-export async function fetchAndCacheRoleClaims(roleId: string, roleName?: string): Promise<Claim[]> {
+export async function fetchAndCacheRoleClaims(
+  roleId: string,
+  roleName?: string,
+  forceRefresh = false
+): Promise<Claim[]> {
   const roleIdKey = roleId.toLowerCase().trim();
   const roleNameKey = (roleName || '').toLowerCase().trim();
 
-  try {
-    const res = await apiClient.get<Claim[]>(`/v1/api/users/system/roles/${roleId}/claims`);
-    if (res.data && Array.isArray(res.data) && res.data.length > 0) {
-      const normalized = res.data.map(normalizeClaim);
-      setCachedRoleClaims(roleIdKey, normalized);
-      if (roleNameKey) setCachedRoleClaims(roleNameKey, normalized);
-      return normalized;
+  // 1. Check in-memory and localStorage cache first
+  if (!forceRefresh) {
+    const cachedById = getCachedRoleClaims(roleIdKey);
+    if (cachedById && cachedById.length > 0) return cachedById;
+
+    if (roleNameKey) {
+      const cachedByName = getCachedRoleClaims(roleNameKey);
+      if (cachedByName && cachedByName.length > 0) return cachedByName;
     }
-  } catch (err) {
-    // Network or server error, proceed to cache / defaults fallback
   }
 
-  // Check cache by role ID
+  // 2. Resolve actual GUID if roleId is not formatted as a GUID
+  let effectiveGuid = GUID_REGEX.test(roleId.trim()) ? roleId.trim() : null;
+  if (!effectiveGuid) {
+    const cachedRoles = getCachedSystemRoles();
+    if (cachedRoles && cachedRoles.length > 0) {
+      const match = cachedRoles.find(
+        (r) =>
+          (r.name && r.name.toLowerCase() === roleNameKey) ||
+          (r.name && r.name.toLowerCase() === roleIdKey) ||
+          String(r.id).toLowerCase() === roleIdKey
+      );
+      if (match && match.id && GUID_REGEX.test(String(match.id).trim())) {
+        effectiveGuid = String(match.id).trim();
+      }
+    }
+  }
+
+  if (effectiveGuid) {
+    try {
+      const res = await apiClient.get<Claim[]>(`/v1/api/users/system/roles/${effectiveGuid}/claims`);
+      if (res.data && Array.isArray(res.data) && res.data.length > 0) {
+        const normalized = res.data.map(normalizeClaim);
+        setCachedRoleClaims(roleIdKey, normalized);
+        if (roleNameKey) setCachedRoleClaims(roleNameKey, normalized);
+        if (effectiveGuid.toLowerCase() !== roleIdKey) {
+          setCachedRoleClaims(effectiveGuid.toLowerCase(), normalized);
+        }
+        return normalized;
+      }
+    } catch (err) {
+      // Network or server error, proceed to cache / defaults fallback
+    }
+  }
+
+  // Re-check cache by role ID or name
   const cachedById = getCachedRoleClaims(roleIdKey);
   if (cachedById && cachedById.length > 0) return cachedById;
 
-  // Check cache by role name
   if (roleNameKey) {
     const cachedByName = getCachedRoleClaims(roleNameKey);
     if (cachedByName && cachedByName.length > 0) return cachedByName;
@@ -218,30 +294,118 @@ export async function fetchAndCacheRoleClaims(roleId: string, roleName?: string)
   return normalized;
 }
 
-/**
- * Direct API calls for user roles and user claims
- */
-export async function getUserRolesFromApi(userId: string): Promise<Role[]> {
-  try {
-    const res = await apiClient.get<Role[]>(`/v1/api/users/${userId}/roles`);
-    return res.data || [];
-  } catch {
-    return [];
+export function clearCachedUserRbac(userId?: string): void {
+  if (userId) {
+    const key = userId.toLowerCase().trim();
+    inMemoryUserRoles.delete(key);
+    inMemoryUserClaims.delete(key);
+    if (typeof window !== 'undefined') {
+      try {
+        localStorage.removeItem(`pfm_cache_user_roles_${key}`);
+        localStorage.removeItem(`pfm_cache_user_claims_${key}`);
+      } catch {}
+    }
+  } else {
+    inMemoryUserRoles.clear();
+    inMemoryUserClaims.clear();
+    if (typeof window !== 'undefined') {
+      try {
+        const keysToRemove: string[] = [];
+        for (let i = 0; i < localStorage.length; i++) {
+          const k = localStorage.key(i);
+          if (k && (k.startsWith('pfm_cache_user_roles_') || k.startsWith('pfm_cache_user_claims_'))) {
+            keysToRemove.push(k);
+          }
+        }
+        keysToRemove.forEach((k) => localStorage.removeItem(k));
+      } catch {}
+    }
   }
 }
 
-export async function getUserClaimsFromApi(userId: string): Promise<Claim[]> {
+/**
+ * Direct API calls for user roles and user claims with session-level caching
+ */
+export async function getUserRolesFromApi(userId: string, forceRefresh = false): Promise<Role[]> {
+  const key = userId.toLowerCase().trim();
+  if (!forceRefresh) {
+    const cached = inMemoryUserRoles.get(key);
+    if (cached && Date.now() - cached.timestamp < USER_RBAC_CACHE_TTL_MS) {
+      return cached.roles;
+    }
+    if (typeof window !== 'undefined') {
+      try {
+        const raw = localStorage.getItem(`pfm_cache_user_roles_${key}`);
+        if (raw) {
+          const parsed = JSON.parse(raw);
+          if (Array.isArray(parsed) && parsed.length > 0) {
+            inMemoryUserRoles.set(key, { roles: parsed, timestamp: Date.now() });
+            return parsed;
+          }
+        }
+      } catch {}
+    }
+  }
+
+  try {
+    const res = await apiClient.get<Role[]>(`/v1/api/users/${userId}/roles`);
+    const roles = res.data || [];
+    if (roles.length > 0) {
+      inMemoryUserRoles.set(key, { roles, timestamp: Date.now() });
+      if (typeof window !== 'undefined') {
+        try {
+          localStorage.setItem(`pfm_cache_user_roles_${key}`, JSON.stringify(roles));
+        } catch {}
+      }
+    }
+    return roles;
+  } catch {
+    return inMemoryUserRoles.get(key)?.roles || [];
+  }
+}
+
+export async function getUserClaimsFromApi(userId: string, forceRefresh = false): Promise<Claim[]> {
+  const key = userId.toLowerCase().trim();
+  if (!forceRefresh) {
+    const cached = inMemoryUserClaims.get(key);
+    if (cached && Date.now() - cached.timestamp < USER_RBAC_CACHE_TTL_MS) {
+      return cached.claims;
+    }
+    if (typeof window !== 'undefined') {
+      try {
+        const raw = localStorage.getItem(`pfm_cache_user_claims_${key}`);
+        if (raw) {
+          const parsed = JSON.parse(raw);
+          if (Array.isArray(parsed) && parsed.length > 0) {
+            const normalized = parsed.map(normalizeClaim);
+            inMemoryUserClaims.set(key, { claims: normalized, timestamp: Date.now() });
+            return normalized;
+          }
+        }
+      } catch {}
+    }
+  }
+
   try {
     const res = await apiClient.get<Claim[]>(`/v1/api/users/${userId}/claims`);
-    return res.data || [];
+    const claims = (res.data || []).map(normalizeClaim);
+    if (claims.length > 0) {
+      inMemoryUserClaims.set(key, { claims, timestamp: Date.now() });
+      if (typeof window !== 'undefined') {
+        try {
+          localStorage.setItem(`pfm_cache_user_claims_${key}`, JSON.stringify(claims));
+        } catch {}
+      }
+    }
+    return claims;
   } catch {
-    return [];
+    return inMemoryUserClaims.get(key)?.claims || [];
   }
 }
 
 /**
  * Resolves user roles, role claims, and user claims (including tenant and tenant_id)
- * and caches system roles and role claims as a persistent reference.
+ * concurrently using Promise.allSettled and caches system roles and claims.
  */
 export async function resolveUserRolesAndClaims(
   userSub: string,
@@ -254,27 +418,30 @@ export async function resolveUserRolesAndClaims(
   tenant?: string;
   tenant_id?: number;
 }> {
+  ensureFreshRbacCache();
   const mergedClaims: Record<string, any> = { ...initialClaims };
   const resolvedRoles: string[] = [];
+  let userRoleObjects: Role[] = [];
   let primaryRole = currentProfile.role || (initialClaims.role as string) || '';
   let tenant = currentProfile.tenant || (initialClaims.tenant as string) || undefined;
   let tenant_id = currentProfile.tenant_id ?? (initialClaims.tenant_id ? Number(initialClaims.tenant_id) : undefined);
 
-  // 1. Get user's roles from backend API (Requirement 2)
-  if (userSub) {
-    try {
-      const userRoles = await getUserRolesFromApi(userSub);
-      if (Array.isArray(userRoles) && userRoles.length > 0) {
-        userRoles.forEach((r) => {
-          if (r.name && !resolvedRoles.includes(r.name)) {
-            resolvedRoles.push(r.name);
-          }
-        });
-        if (resolvedRoles.length > 0) {
-          primaryRole = resolvedRoles[0];
-        }
+  // 1. Concurrently fetch user's roles and user's claims in parallel
+  const [rolesResult, claimsResult] = await Promise.allSettled([
+    userSub ? getUserRolesFromApi(userSub) : Promise.resolve([]),
+    userSub ? getUserClaimsFromApi(userSub) : Promise.resolve([]),
+  ]);
+
+  if (rolesResult.status === 'fulfilled' && Array.isArray(rolesResult.value) && rolesResult.value.length > 0) {
+    userRoleObjects = rolesResult.value;
+    rolesResult.value.forEach((r) => {
+      if (r.name && !resolvedRoles.includes(r.name)) {
+        resolvedRoles.push(r.name);
       }
-    } catch {}
+    });
+    if (resolvedRoles.length > 0) {
+      primaryRole = resolvedRoles[0];
+    }
   }
 
   // Fallback to initial role if API returned empty
@@ -282,55 +449,57 @@ export async function resolveUserRolesAndClaims(
     resolvedRoles.push(primaryRole);
   }
 
-  // 2. For each role, retrieve role claims using the endpoint (Requirement 2 & 7)
+  // 2. Concurrently fetch role claims for all resolved roles in parallel
   const allRoleClaims: Claim[] = [];
-  for (const roleName of resolvedRoles) {
-    try {
-      const roleClaims = await fetchAndCacheRoleClaims(roleName, roleName);
-      if (Array.isArray(roleClaims)) {
-        roleClaims.forEach((rc) => {
-          const norm = normalizeClaim(rc);
-          allRoleClaims.push(norm);
-          if (norm.claimType) {
-            mergedClaims[norm.claimType] = norm.claimValue || 'all';
-          }
-        });
-      }
-    } catch {}
-  }
+  const roleClaimsPromises = resolvedRoles.map(async (roleName) => {
+    const matchedRoleObj = userRoleObjects.find(
+      (r) => r.name && r.name.toLowerCase() === roleName.toLowerCase()
+    );
+    const roleIdToPass = matchedRoleObj?.id ? String(matchedRoleObj.id) : roleName;
+    return fetchAndCacheRoleClaims(roleIdToPass, roleName);
+  });
+
+  const roleClaimsResults = await Promise.allSettled(roleClaimsPromises);
+  roleClaimsResults.forEach((res) => {
+    if (res.status === 'fulfilled' && Array.isArray(res.value)) {
+      res.value.forEach((rc) => {
+        const norm = normalizeClaim(rc);
+        allRoleClaims.push(norm);
+        if (norm.claimType) {
+          mergedClaims[norm.claimType] = norm.claimValue || 'all';
+        }
+      });
+    }
+  });
+
   if (allRoleClaims.length > 0) {
     mergedClaims.role_claims = allRoleClaims;
   }
 
-  // 3. Retrieve user claims from endpoint (Requirement 3)
-  if (userSub) {
-    try {
-      const userClaims = await getUserClaimsFromApi(userSub);
-      if (Array.isArray(userClaims) && userClaims.length > 0) {
-        userClaims.forEach((c) => {
-          const norm = normalizeClaim(c);
-          const type = (norm.claimType || '').toLowerCase().trim();
-          const val = norm.claimValue;
-          if (type === 'tenant' && val) {
-            tenant = String(val);
-            mergedClaims.tenant = String(val);
-          } else if ((type === 'tenant_id' || type === 'tenantid') && val !== undefined && val !== null) {
-            const parsed = Number(val);
-            if (!isNaN(parsed) && isFinite(parsed)) {
-              tenant_id = parsed;
-              mergedClaims.tenant_id = parsed;
-            }
-          }
-          if (norm.claimType) {
-            mergedClaims[norm.claimType] = norm.claimValue;
-          }
-        });
-        mergedClaims.user_claims = userClaims.map(normalizeClaim);
+  // 3. Process user claims
+  if (claimsResult.status === 'fulfilled' && Array.isArray(claimsResult.value) && claimsResult.value.length > 0) {
+    claimsResult.value.forEach((c) => {
+      const norm = normalizeClaim(c);
+      const type = (norm.claimType || '').toLowerCase().trim();
+      const val = norm.claimValue;
+      if (type === 'tenant' && val) {
+        tenant = String(val);
+        mergedClaims.tenant = String(val);
+      } else if ((type === 'tenant_id' || type === 'tenantid') && val !== undefined && val !== null) {
+        const parsed = Number(val);
+        if (!isNaN(parsed) && isFinite(parsed)) {
+          tenant_id = parsed;
+          mergedClaims.tenant_id = parsed;
+        }
       }
-    } catch {}
+      if (norm.claimType) {
+        mergedClaims[norm.claimType] = norm.claimValue;
+      }
+    });
+    mergedClaims.user_claims = claimsResult.value.map(normalizeClaim);
   }
 
-  // 4. Background preload all system roles & role claims for reference (Requirement 7)
+  // 4. Background preload all system roles & role claims for reference (non-blocking)
   preloadAndCacheAllRoleClaims().catch(() => {});
 
   return {
@@ -343,13 +512,13 @@ export async function resolveUserRolesAndClaims(
 }
 
 /**
- * Preloads and caches all system roles and their respective role claims.
+ * Preloads and caches all system roles and their respective role claims concurrently.
  */
 export async function preloadAndCacheAllRoleClaims(): Promise<void> {
   const roles = await fetchAndCacheSystemRoles();
-  for (const role of roles) {
-    await fetchAndCacheRoleClaims(role.id, role.name);
-  }
+  await Promise.allSettled(
+    roles.map((role) => fetchAndCacheRoleClaims(role.id, role.name))
+  );
 }
 
 /**

PostFundManagement.ConsoleUI/src/services/tenantLockoutService.ts

@@ -9,6 +9,18 @@ export interface TenantLockoutResult {
   statusCode?: number;
 }
 
+// In-memory cache for fast tenant status checks (avoids repeated API round trips during navigations)
+let cachedTenantLockout: {
+  key: string;
+  result: TenantLockoutResult;
+  timestamp: number;
+} | null = null;
+const LOCKOUT_CACHE_TTL_MS = 60 * 1000; // 60 seconds
+
+export function clearTenantLockoutCache(): void {
+  cachedTenantLockout = null;
+}
+
 /**
  * Checks whether a given status value corresponds to ActivityStatus.Active (1)
  */
@@ -63,7 +75,8 @@ export function getStatusLabel(status: any): string {
  */
 export async function verifyTenantLockout(
   tenantId?: number | string | null,
-  tenantClaim?: string | null
+  tenantClaim?: string | null,
+  forceRefresh = false
 ): Promise<TenantLockoutResult> {
   const primaryId =
     tenantId !== undefined && tenantId !== null && tenantId !== ''
@@ -83,6 +96,16 @@ export async function verifyTenantLockout(
     };
   }
 
+  const cacheKey = String(primaryId).trim().toLowerCase();
+  if (!forceRefresh && cachedTenantLockout && cachedTenantLockout.key === cacheKey) {
+    if (
+      cachedTenantLockout.result.isActive &&
+      Date.now() - cachedTenantLockout.timestamp < LOCKOUT_CACHE_TTL_MS
+    ) {
+      return cachedTenantLockout.result;
+    }
+  }
+
   let tenantRes: Tenant | null = null;
   let lastError: any = null;
 
@@ -147,8 +170,14 @@ export async function verifyTenantLockout(
   }
 
   // Success: Response object returned and Status is Active
-  return {
+  const successResult: TenantLockoutResult = {
     isActive: true,
     tenant: tenantObj,
   };
+  cachedTenantLockout = {
+    key: cacheKey,
+    result: successResult,
+    timestamp: Date.now(),
+  };
+  return successResult;
 }

PostFundManagement.ConsoleUI/src/services/userSyncService.ts

@@ -36,12 +36,22 @@ export interface UserSyncResult {
 
 let inFlightSyncPromise: Promise<UserSyncResult> | null = null;
 
+// In-memory cache to prevent synchronous localStorage parsing on every HTTP request
+let inMemorySyncRecord: UserSyncRecord | null = null;
+let inMemoryActivationPending: boolean | null = null;
+let inMemoryActivationReason: string | null = null;
+
 /**
  * Checks if the user is currently flagged in the browser as pending administrator activation / lockout.
  */
 export function isActivationPending(): boolean {
+  if (inMemoryActivationPending !== null) {
+    return inMemoryActivationPending;
+  }
   try {
-    return localStorage.getItem(LOCAL_STORAGE_ACTIVATION_PENDING_KEY) === 'true';
+    const val = localStorage.getItem(LOCAL_STORAGE_ACTIVATION_PENDING_KEY) === 'true';
+    inMemoryActivationPending = val;
+    return val;
   } catch {
     return false;
   }
@@ -51,8 +61,13 @@ export function isActivationPending(): boolean {
  * Gets the reason/error message recorded when activation check was last pending.
  */
 export function getActivationPendingReason(): string | null {
+  if (inMemoryActivationReason !== null) {
+    return inMemoryActivationReason;
+  }
   try {
-    return localStorage.getItem(LOCAL_STORAGE_ACTIVATION_REASON_KEY);
+    const reason = localStorage.getItem(LOCAL_STORAGE_ACTIVATION_REASON_KEY);
+    inMemoryActivationReason = reason;
+    return reason;
   } catch {
     return null;
   }
@@ -62,6 +77,8 @@ export function getActivationPendingReason(): string | null {
  * Sets or clears the pending activation flag in browser persistent storage.
  */
 export function setActivationPending(pending: boolean, reason?: string): void {
+  inMemoryActivationPending = pending;
+  inMemoryActivationReason = reason || null;
   try {
     if (pending) {
       localStorage.setItem(LOCAL_STORAGE_ACTIVATION_PENDING_KEY, 'true');
@@ -91,10 +108,15 @@ export function isUserSyncedInBrowser(currentSub?: string, currentToken?: string
       return false;
     }
 
-    const raw = localStorage.getItem(LOCAL_STORAGE_USER_SYNC_KEY);
-    if (!raw) return false;
+    if (!inMemorySyncRecord) {
+      const raw = localStorage.getItem(LOCAL_STORAGE_USER_SYNC_KEY);
+      if (!raw) return false;
+      const parsed: UserSyncRecord = JSON.parse(raw);
+      if (!parsed || parsed.status !== 'synced') return false;
+      inMemorySyncRecord = parsed;
+    }
 
-    const record: UserSyncRecord = JSON.parse(raw);
+    const record = inMemorySyncRecord;
     if (!record || record.status !== 'synced') return false;
 
     // Check if the stored sync matches the current user sub (if specified)
@@ -134,6 +156,7 @@ export function saveUserSyncInBrowser(
       status: 'synced',
       userData: userData || undefined,
     };
+    inMemorySyncRecord = record;
     localStorage.setItem(LOCAL_STORAGE_USER_SYNC_KEY, JSON.stringify(record));
   } catch (err) {
     console.warn('[UserSync] Failed to write sync record to localStorage:', err);
@@ -144,6 +167,9 @@ export function saveUserSyncInBrowser(
  * Clears the user sync record from browser storage (used on logout or when activation fails).
  */
 export function clearUserSyncInBrowser(): void {
+  inMemorySyncRecord = null;
+  inMemoryActivationPending = null;
+  inMemoryActivationReason = null;
   try {
     localStorage.removeItem(LOCAL_STORAGE_USER_SYNC_KEY);
     localStorage.removeItem(LOCAL_STORAGE_ACTIVATION_PENDING_KEY);
@@ -155,6 +181,7 @@ export function clearUserSyncInBrowser(): void {
  * Clears only the successful sync record, leaving activation pending intact.
  */
 export function clearSuccessfulSyncRecord(): void {
+  inMemorySyncRecord = null;
   try {
     localStorage.removeItem(LOCAL_STORAGE_USER_SYNC_KEY);
   } catch {}