From 2c5f21c086fb58f128ee6eaa573b6a1affa677ee Mon Sep 17 00:00:00 2001
From: Tim Haasdyk <tim_haasdyk@sil.org>
Date: Thu, 30 Nov 2023 12:49:12 +0100
Subject: [PATCH 01/18] Add startup probe to hg container so otel initializes

---
 deployment/base/hg-deployment.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/deployment/base/hg-deployment.yaml b/deployment/base/hg-deployment.yaml
index a16a31b3e..4d1b55ebc 100644
--- a/deployment/base/hg-deployment.yaml
+++ b/deployment/base/hg-deployment.yaml
@@ -65,6 +65,13 @@ spec:
         ports:
           - containerPort: 8088
 
+        startupProbe:
+          httpGet:
+            path: /
+            port: 8088
+          failureThreshold: 30
+          periodSeconds: 10
+
         volumeMounts:
           - name: repos
             mountPath: /var/hg/repos

From 94a7f616fcefe508648c896bb83a735319c5e628 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 14:57:06 +0700
Subject: [PATCH 02/18] escape icontains search string so we can search for
 first_last email patterns and it matches on _ instead of treating that as a
 single char wildcard. #451

---
 ...ngDeterministicInvariantContainsHandler.cs | 26 ++++++++++---------
 .../LexBoxApi/GraphQL/GraphQlSetupKernel.cs   | 13 ++--------
 2 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/backend/LexBoxApi/GraphQL/CustomFilters/QueryableStringDeterministicInvariantContainsHandler.cs b/backend/LexBoxApi/GraphQL/CustomFilters/QueryableStringDeterministicInvariantContainsHandler.cs
index 6747f7439..532d69f04 100644
--- a/backend/LexBoxApi/GraphQL/CustomFilters/QueryableStringDeterministicInvariantContainsHandler.cs
+++ b/backend/LexBoxApi/GraphQL/CustomFilters/QueryableStringDeterministicInvariantContainsHandler.cs
@@ -1,5 +1,6 @@
 using System.Linq.Expressions;
 using System.Reflection;
+using System.Text.RegularExpressions;
 using HotChocolate.Data.Filters;
 using HotChocolate.Data.Filters.Expressions;
 using HotChocolate.Language;
@@ -12,9 +13,10 @@ namespace LexBoxApi.GraphQL.CustomFilters;
 /// Postgres doesn't support substring comparisons on nondeterministic collations, so we offer a
 /// case insensitive filter that explicitly uses a deterministic collation (und-x-icu) instead.
 /// </summary>
-public class QueryableStringDeterministicInvariantContainsHandler : QueryableStringOperationHandler
+public class QueryableStringDeterministicInvariantContainsHandler(InputParser inputParser)
+    : QueryableStringOperationHandler(inputParser)
 {
-    private static readonly MethodInfo Ilike = ((Func<DbFunctions, string, string, bool>)NpgsqlDbFunctionsExtensions.ILike).Method;
+    private static readonly MethodInfo Ilike = ((Func<DbFunctions, string, string, string, bool>)NpgsqlDbFunctionsExtensions.ILike).Method;
     private static readonly MethodInfo Collate = ((Func<DbFunctions, string, string, string>)RelationalDbFunctionsExtensions.Collate).Method;
     private static readonly ConstantExpression EfFunctions = Expression.Constant(EF.Functions);
 
@@ -25,22 +27,19 @@ static QueryableStringDeterministicInvariantContainsHandler()
     }
 
     protected override int Operation => CustomFilterOperations.IContains;
-
-    public QueryableStringDeterministicInvariantContainsHandler(InputParser inputParser)
-        : base(inputParser)
-    {
-    }
+    private static readonly Regex EscapeLikePatternRegex = new(@"([\\_%])", RegexOptions.Compiled);
 
     public override Expression HandleOperation(
         QueryableFilterContext context,
         IFilterOperationField field,
         IValueNode value,
-        object? search)
+        object? searchObject)
     {
-        if (search is not string)
-            throw new InvalidOperationException($"Expected {nameof(QueryableStringDeterministicInvariantContainsHandler)} to be called with a string, but was {search}.");
+        if (searchObject is not string search)
+            throw new InvalidOperationException($"Expected {nameof(QueryableStringDeterministicInvariantContainsHandler)} to be called with a string, but was {searchObject}.");
 
-        var pattern = $"%{search}%";
+        var escapedString = EscapeLikePatternRegex.Replace(search, @"\$1");
+        var pattern = $"%{escapedString}%";
         var property = context.GetInstance();
 
         var collatedValueExpression = Expression.Call(
@@ -53,6 +52,8 @@ public override Expression HandleOperation(
             Expression.Constant("und-x-icu")
         );
 
+        //this is a bit of a hack to make sure that the pattern is interpreted as a query parameter instead of a string constant. This means queries will be cached.
+        Expression<Func<string>> lambda = () => pattern;
         // property != null && EF.Functions.ILike(EF.Functions.Collate(property, "und-x-icu"), "%search%")
         return Expression.AndAlso(
             Expression.NotEqual(property, Expression.Constant(null, typeof(object))),
@@ -61,7 +62,8 @@ public override Expression HandleOperation(
                 Ilike,
                 EfFunctions,
                 collatedValueExpression,
-                Expression.Constant(pattern)
+                lambda.Body,
+                Expression.Constant(@"\")
             )
         );
     }
diff --git a/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs b/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs
index 0121e0e92..0f79ccb4e 100644
--- a/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs
+++ b/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs
@@ -40,17 +40,8 @@ public static void AddLexGraphQL(this IServiceCollection services, IHostEnvironm
                 descriptor.AddDefaults();
                 descriptor.AddDeterministicInvariantContainsFilter();
             })
-            .AddProjections(descriptor =>
-            {
-                descriptor.Provider(new QueryableProjectionProvider(providerDescriptor =>
-                {
-                    //does not work because hot chocolate wants to make this as the select `p => new project { userCount = p.usercount}`
-                    // which doesn't work when using projectable because the field needs to be write only
-                    //shelving it for now
-                    providerDescriptor.RegisterFieldHandler<EfCoreProjectablesFieldHandler>();
-                    providerDescriptor.AddDefaults();
-                }));
-            }).SetPagingOptions(new ()
+            .AddProjections()
+            .SetPagingOptions(new ()
             {
                 DefaultPageSize = 100,
                 MaxPageSize = 1000,

From 3a0e0651543d50ef92ab0f2ddccc00fc4bb52356 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 15:01:13 +0700
Subject: [PATCH 03/18] remove prod domain references #420

---
 .github/workflows/release-pipeline.yaml       |  2 +-
 .../production/ingress-config-prod.yaml       | 45 +------------------
 .../production/lexbox-deployment.patch.yaml   |  2 +-
 3 files changed, 4 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/release-pipeline.yaml b/.github/workflows/release-pipeline.yaml
index bab9609dc..59cbfd116 100644
--- a/.github/workflows/release-pipeline.yaml
+++ b/.github/workflows/release-pipeline.yaml
@@ -75,5 +75,5 @@ jobs:
       version: ${{ needs.set-version.outputs.version }}
       image: 'ghcr.io/sillsdev/lexbox-*'
       k8s-environment: production
-      deploy-domain: prod.languagedepot.org
+      deploy-domain: languagedepot.org
 
diff --git a/deployment/production/ingress-config-prod.yaml b/deployment/production/ingress-config-prod.yaml
index 2d2c30de9..ae155b2b3 100644
--- a/deployment/production/ingress-config-prod.yaml
+++ b/deployment/production/ingress-config-prod.yaml
@@ -1,9 +1,9 @@
 - op: replace
   path: /spec/rules/0/host
-  value: prod.languagedepot.org
+  value: languagedepot.org
 - op: replace
   path: /spec/rules/1/host
-  value: hg-prod.languageforge.org
+  value: hg-public.languageforge.org
 - op: replace
   path: /spec/rules/2/host
   value: resumable.languagedepot.org
@@ -13,9 +13,7 @@
 - op: replace
   path: /spec/tls/0/hosts
   value:
-    - prod.languagedepot.org
     - languagedepot.org
-    - hg-prod.languageforge.org
     - resumable.languagedepot.org
     - resumable.languageforge.org
     - hg-public.languagedepot.org
@@ -37,11 +35,6 @@
             name: lexbox
             port:
               name: http
-- op: add
-  path: /spec/rules/-
-  value:
-    host: hg-public.languageforge.org
-    http: *rule
 - op: add
   path: /spec/rules/-
   value:
@@ -62,37 +55,3 @@
   value:
     host: admin.languageforge.org
     http: *rule
-- op: add
-  path: /spec/rules/-
-  value:
-    host: languagedepot.org
-    http:
-      paths:
-        - path: /api
-          pathType: Prefix
-          backend:
-            service:
-              name: lexbox
-              port:
-                name: http
-        - path: /hg
-          pathType: Prefix
-          backend:
-            service:
-              name: lexbox
-              port:
-                name: http
-        - path: /v1/traces
-          pathType: Prefix
-          backend:
-            service:
-              name: lexbox
-              port:
-                name: otel
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: ui
-              port:
-                name: sveltekit
diff --git a/deployment/production/lexbox-deployment.patch.yaml b/deployment/production/lexbox-deployment.patch.yaml
index 42c22e35d..3f903858e 100644
--- a/deployment/production/lexbox-deployment.patch.yaml
+++ b/deployment/production/lexbox-deployment.patch.yaml
@@ -24,7 +24,7 @@ spec:
               # TODO: need to parameterize this
               value: "Language Depot <no-reply@languagedepot.org>"
             - name: Email__BaseUrl
-              value: "https://prod.languagedepot.org"
+              value: "https://languagedepot.org"
             - name: HgConfig__PublicRedmineHgWebUrl
               value: "https://hg-public-redmine.languagedepot.org/"
             - name: HgConfig__PrivateRedmineHgWebUrl

From 9a7ede53515af043980892fb3c063514eab5bf12 Mon Sep 17 00:00:00 2001
From: Tim Haasdyk <tim_haasdyk@sil.org>
Date: Tue, 5 Dec 2023 16:49:11 +0100
Subject: [PATCH 04/18] Standardize enum serialization to fix creating projects

---
 backend/LexBoxApi/Program.cs                  | 3 ++-
 backend/LexBoxApi/Services/EmailService.cs    | 8 +++++++-
 frontend/src/lib/components/IconButton.svelte | 5 ++++-
 frontend/src/routes/email/+server.ts          | 2 +-
 frontend/src/routes/email/emails.ts           | 8 ++++----
 5 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/backend/LexBoxApi/Program.cs b/backend/LexBoxApi/Program.cs
index 85f8f4742..faa04be86 100644
--- a/backend/LexBoxApi/Program.cs
+++ b/backend/LexBoxApi/Program.cs
@@ -1,4 +1,5 @@
 using System.Net;
+using System.Text.Json;
 using System.Text.Json.Serialization;
 using LexBoxApi;
 using LexBoxApi.Auth;
@@ -50,7 +51,7 @@
     options.ModelMetadataDetailsProviders.Add(new SystemTextJsonValidationMetadataProvider());
 }).AddJsonOptions(options =>
 {
-    options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+    options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter(JsonNamingPolicy.SnakeCaseUpper));
 });
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddEndpointsApiExplorer();
diff --git a/backend/LexBoxApi/Services/EmailService.cs b/backend/LexBoxApi/Services/EmailService.cs
index 59394907f..467ed437e 100644
--- a/backend/LexBoxApi/Services/EmailService.cs
+++ b/backend/LexBoxApi/Services/EmailService.cs
@@ -1,4 +1,6 @@
 using System.Diagnostics;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using LexBoxApi.Config;
 using LexBoxApi.Models.Project;
 using LexBoxApi.Otel;
@@ -114,7 +116,11 @@ private async Task RenderEmail<T>(MimeMessage message, T parameters) where T : E
         var httpClient = _clientFactory.CreateClient();
         httpClient.BaseAddress = new Uri("http://" + _emailConfig.EmailRenderHost);
         parameters.BaseUrl = _emailConfig.BaseUrl;
-        var response = await httpClient.PostAsJsonAsync("email", parameters);
+        var response = await httpClient.PostAsJsonAsync("email", parameters, new JsonSerializerOptions()
+        {
+            Converters = { new JsonStringEnumConverter(JsonNamingPolicy.SnakeCaseUpper) },
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        });
         response.EnsureSuccessStatusCode();
         var renderResult = await response.Content.ReadFromJsonAsync<RenderResult>();
         if (renderResult is null)
diff --git a/frontend/src/lib/components/IconButton.svelte b/frontend/src/lib/components/IconButton.svelte
index f1b71461a..9ead2ff63 100644
--- a/frontend/src/lib/components/IconButton.svelte
+++ b/frontend/src/lib/components/IconButton.svelte
@@ -7,9 +7,12 @@
   export let disabled = false;
   export let loading = false;
   export let style: CssClassList<'btn-success', 'btn-ghost' | 'btn-outline'> = 'btn-outline';
+  export let active = false;
+  export let join = false;
+
 </script>
 
-<button class:disabled={disabled || loading} on:click class="btn btn-square {style}">
+<button class:disabled={disabled || loading} on:click class="btn btn-square {style}" class:btn-active={active} class:join-item={join}>
   {#if !loading}
     <span class="{icon} text-lg" />
   {:else}
diff --git a/frontend/src/routes/email/+server.ts b/frontend/src/routes/email/+server.ts
index 9ab3003ae..6f8b1730b 100644
--- a/frontend/src/routes/email/+server.ts
+++ b/frontend/src/routes/email/+server.ts
@@ -7,7 +7,7 @@ export async function POST(event: RequestEvent): Promise<Response> {
   const request = await event.request.json() as EmailTemplateProps;
   const {template, ...props} = request;
   const component = componentMap[template];
-  if (!component) throw new Error(`invalid template${template}`);
+  if (!component) throw new Error(`Invalid email template ${template}.}`);
   return json(render(component, props));
 }
 
diff --git a/frontend/src/routes/email/emails.ts b/frontend/src/routes/email/emails.ts
index 55702cd59..1f2a2b96c 100644
--- a/frontend/src/routes/email/emails.ts
+++ b/frontend/src/routes/email/emails.ts
@@ -6,10 +6,10 @@ import CreateProjectRequest from '$lib/email/CreateProjectRequest.svelte';
 import type {CreateProjectInput} from '$lib/gql/generated/graphql';
 
 export const enum EmailTemplate {
-    ForgotPassword = 'ForgotPassword',
-    VerifyEmailAddress = 'VerifyEmailAddress',
-    PasswordChanged = 'PasswordChanged',
-    CreateProjectRequest = 'CreateProjectRequest',
+    ForgotPassword = 'FORGOT_PASSWORD',
+    VerifyEmailAddress = 'VERIFY_EMAIL_ADDRESS',
+    PasswordChanged = 'PASSWORD_CHANGED',
+    CreateProjectRequest = 'CREATE_PROJECT_REQUEST',
 }
 
 export const componentMap = {

From 5a931a0132ba54e318a35abea0ecee495bb71b46 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 12:03:10 +0700
Subject: [PATCH 05/18] inject json serializer options into Email service so
 those settings stay in sync. Fix error where GetCurrentUserId was throwing
 because it couldn't deserialize api responses because it uses the default
 json options.

---
 backend/LexBoxApi/Program.cs               | 4 ++++
 backend/LexBoxApi/Services/EmailService.cs | 9 ++++-----
 backend/Testing/Browser/Base/PageTest.cs   | 7 +++++--
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/backend/LexBoxApi/Program.cs b/backend/LexBoxApi/Program.cs
index faa04be86..8744a10ae 100644
--- a/backend/LexBoxApi/Program.cs
+++ b/backend/LexBoxApi/Program.cs
@@ -11,7 +11,9 @@
 using LexSyncReverseProxy;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.AspNetCore.HttpLogging;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.ModelBinding.Metadata;
+using Microsoft.Extensions.Options;
 using Microsoft.OpenApi.Models;
 using tusdotnet;
 using IPNetwork = Microsoft.AspNetCore.HttpOverrides.IPNetwork;
@@ -53,6 +55,8 @@
 {
     options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter(JsonNamingPolicy.SnakeCaseUpper));
 });
+builder.Services.AddSingleton(services =>
+    services.GetRequiredService<IOptions<JsonOptions>>().Value.JsonSerializerOptions);
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddSwaggerGen(options =>
diff --git a/backend/LexBoxApi/Services/EmailService.cs b/backend/LexBoxApi/Services/EmailService.cs
index 467ed437e..4bde9d6ce 100644
--- a/backend/LexBoxApi/Services/EmailService.cs
+++ b/backend/LexBoxApi/Services/EmailService.cs
@@ -18,16 +18,19 @@ namespace LexBoxApi.Services;
 public class EmailService
 {
     private readonly EmailConfig _emailConfig;
+    private readonly JsonSerializerOptions _jsonSerializerOptions;
     private readonly IHttpClientFactory _clientFactory;
     private readonly LinkGenerator _linkGenerator;
     private readonly IHttpContextAccessor _httpContextAccessor;
 
     public EmailService(IOptions<EmailConfig> emailConfig,
+        JsonSerializerOptions jsonSerializerOptions,
         IHttpClientFactory clientFactory,
         LexboxLinkGenerator linkGenerator,
         IHttpContextAccessor httpContextAccessor
     )
     {
+        _jsonSerializerOptions = jsonSerializerOptions;
         _clientFactory = clientFactory;
         _linkGenerator = linkGenerator;
         _httpContextAccessor = httpContextAccessor;
@@ -116,11 +119,7 @@ private async Task RenderEmail<T>(MimeMessage message, T parameters) where T : E
         var httpClient = _clientFactory.CreateClient();
         httpClient.BaseAddress = new Uri("http://" + _emailConfig.EmailRenderHost);
         parameters.BaseUrl = _emailConfig.BaseUrl;
-        var response = await httpClient.PostAsJsonAsync("email", parameters, new JsonSerializerOptions()
-        {
-            Converters = { new JsonStringEnumConverter(JsonNamingPolicy.SnakeCaseUpper) },
-            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
-        });
+        var response = await httpClient.PostAsJsonAsync("email", parameters, _jsonSerializerOptions);
         response.EnsureSuccessStatusCode();
         var renderResult = await response.Content.ReadFromJsonAsync<RenderResult>();
         if (renderResult is null)
diff --git a/backend/Testing/Browser/Base/PageTest.cs b/backend/Testing/Browser/Base/PageTest.cs
index 432873744..14fde9f4d 100644
--- a/backend/Testing/Browser/Base/PageTest.cs
+++ b/backend/Testing/Browser/Base/PageTest.cs
@@ -152,8 +152,11 @@ protected async Task<TempUserDashboardPage> RegisterUser(string name, string ema
     private async Task<Guid> GetCurrentUserId()
     {
         var userResponse = await Page.APIRequest.GetAsync($"{TestingEnvironmentVariables.ServerBaseUrl}/api/user/currentUser");
-        var user = await userResponse.JsonAsync<LexAuthUser>();
-        return user.ShouldNotBeNull().Id;
+
+        //can't configure playwright json deserialize options to set enum serialization
+        //so just use JsonElement and pull out the Id
+        var user = await userResponse.JsonAsync();
+        return user.ShouldNotBeNull().GetProperty(LexAuthConstants.IdClaimType).GetGuid();
     }
 }
 

From e18efe5f796a79e1717ea35edf8602b7c59796a6 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Mon, 4 Dec 2023 14:16:53 +0700
Subject: [PATCH 06/18] use new `IAuthorizationRequirementData` to read
 attribute values directly instead of generating a bunch of policies based on
 attribute values

---
 backend/LexBoxApi/Auth/AuthKernel.cs          | 22 +++++--------------
 .../Auth/RequireAudienceAttribute.cs          | 22 ++++++++++++++-----
 .../AudienceRequirementHandler.cs             | 16 +++-----------
 backend/LexCore/Auth/LexboxAudience.cs        |  8 -------
 backend/Testing/ApiTests/ApiTestBase.cs       |  2 +-
 .../Services/TestingEnvironmentVariables.cs   |  2 +-
 6 files changed, 26 insertions(+), 46 deletions(-)

diff --git a/backend/LexBoxApi/Auth/AuthKernel.cs b/backend/LexBoxApi/Auth/AuthKernel.cs
index 5ad7cd923..93f6d2ef7 100644
--- a/backend/LexBoxApi/Auth/AuthKernel.cs
+++ b/backend/LexBoxApi/Auth/AuthKernel.cs
@@ -25,6 +25,7 @@ public static void AddLexBoxAuth(IServiceCollection services,
         if (environment.IsDevelopment())
         {
             IdentityModelEventSource.ShowPII = true;
+            IdentityModelEventSource.LogCompleteSecurityArtifact = true;
         }
 
         services.AddScoped<LexAuthService>();
@@ -37,24 +38,11 @@ public static void AddLexBoxAuth(IServiceCollection services,
             options.FallbackPolicy = options.DefaultPolicy = new AuthorizationPolicyBuilder()
                 .RequireDefaultLexboxAuth()
                 .Build();
-            foreach (var audience in Enum.GetValues<LexboxAudience>())
-            {
-                if (audience == LexboxAudience.Unknown) continue;
-                //for exclusive the endpoint is only accessible for the specified audience
-                options.AddPolicy(audience.PolicyName(true), builder =>
-                {
-                    builder.RequireAuthenticatedUser();
-                    builder.AddRequirements(new AudienceRequirement(audience));
-                });
-                //for non exclusive the endpoint is also accessible for the default audience
-                options.AddPolicy(audience.PolicyName(false), builder =>
-                {
-                    builder.RequireAuthenticatedUser();
-                    builder.AddRequirements(new AudienceRequirement(audience, LexboxAudience.LexboxApi));
-                });
-            }
+
             //don't use RequireDefaultLexboxAuth here because that only allows the default audience
             options.AddPolicy(AllowAnyAudienceAttribute.PolicyName, builder => builder.RequireAuthenticatedUser());
+            //we still need this policy, without it the default policy is used which requires the default audience
+            options.AddPolicy(RequireAudienceAttribute.PolicyName, builder => builder.RequireAuthenticatedUser());
 
             options.AddPolicy(AdminRequiredAttribute.PolicyName,
                 builder => builder.RequireDefaultLexboxAuth()
@@ -181,7 +169,7 @@ public static void AddLexBoxAuth(IServiceCollection services,
     public static AuthorizationPolicyBuilder RequireDefaultLexboxAuth(this AuthorizationPolicyBuilder builder)
     {
         return builder.RequireAuthenticatedUser()
-            .AddRequirements(new AudienceRequirement(LexboxAudience.LexboxApi));
+            .AddRequirements(new RequireAudienceAttribute(LexboxAudience.LexboxApi));
     }
 
     public static bool IsJwtRequest(this HttpRequest request)
diff --git a/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs b/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs
index 8310692ef..fcf43d684 100644
--- a/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs
+++ b/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs
@@ -1,22 +1,32 @@
 using LexCore.Auth;
+using Microsoft.AspNetCore.Authorization;
 
 namespace LexBoxApi.Auth;
 
-//todo for now this attribute only supports a single audience, this may be fine for now.
-//once we are at dotnet 8 we can support multiple audiences using the new IAuthorizationRequirementData api
-//https://learn.microsoft.com/en-us/aspnet/core/release-notes/aspnetcore-8.0?view=aspnetcore-7.0#iauthorizationrequirementdata
-public class RequireAudienceAttribute : LexboxAuthAttribute
+public class RequireAudienceAttribute(params LexboxAudience[] audiences)
+    : LexboxAuthAttribute(PolicyName), IAuthorizationRequirement, IAuthorizationRequirementData
 {
+    public const string PolicyName = "RequireAudiencePolicy";
     /// <param name="audience">audience allowed to access this endpoint</param>
     /// <param name="exclusive">when false the default audience is also allowed, when true the default audience is not allowed</param>
-    public RequireAudienceAttribute(LexboxAudience audience, bool exclusive = false) : base(audience.PolicyName(exclusive))
+    public RequireAudienceAttribute(LexboxAudience audience, bool exclusive) : this(exclusive
+        ? [audience]
+        : [audience, LexboxAudience.LexboxApi])
     {
     }
+
+    public LexboxAudience[] ValidAudiences { get; } = audiences;
+
+    public IEnumerable<IAuthorizationRequirement> GetRequirements()
+    {
+        yield return this;
+    }
 }
 
-public  class AllowAnyAudienceAttribute : LexboxAuthAttribute
+public class AllowAnyAudienceAttribute : LexboxAuthAttribute
 {
     public const string PolicyName = "AllowAnyAudiencePolicy";
+
     public AllowAnyAudienceAttribute() : base(PolicyName)
     {
     }
diff --git a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
index 20d3b9a0b..a80d6f94f 100644
--- a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
+++ b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
@@ -1,22 +1,12 @@
 using LexCore.Auth;
 using Microsoft.AspNetCore.Authorization;
-using Microsoft.IdentityModel.JsonWebTokens;
 
 namespace LexBoxApi.Auth.Requirements;
 
-public class AudienceRequirement : IAuthorizationRequirement
+public class AudienceRequirementHandler : AuthorizationHandler<RequireAudienceAttribute>
 {
-    public LexboxAudience[] ValidAudiences { get; }
-
-    public AudienceRequirement(params LexboxAudience[] validAudiences)
-    {
-        ValidAudiences = validAudiences;
-    }
-}
-
-public class AudienceRequirementHandler : AuthorizationHandler<AudienceRequirement>
-{
-    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, AudienceRequirement requirement)
+    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
+        RequireAudienceAttribute requirement)
     {
         var claim = context.User.FindFirst(LexAuthConstants.AudienceClaimType);
         if (Enum.TryParse<LexboxAudience>(claim?.Value, out var audience) &&
diff --git a/backend/LexCore/Auth/LexboxAudience.cs b/backend/LexCore/Auth/LexboxAudience.cs
index df9a8f046..a40c40bfe 100644
--- a/backend/LexCore/Auth/LexboxAudience.cs
+++ b/backend/LexCore/Auth/LexboxAudience.cs
@@ -12,11 +12,3 @@ public enum LexboxAudience
     ForgotPassword,
     SendAndReceive,
 }
-
-public static class LexboxAudienceHelper
-{
-    public static string PolicyName(this LexboxAudience audience, bool exclusive)
-    {
-        return $"RequireAudience{audience}{(exclusive ? "Exclusive" : "")}Policy";
-    }
-}
diff --git a/backend/Testing/ApiTests/ApiTestBase.cs b/backend/Testing/ApiTests/ApiTestBase.cs
index 26fb4c8a6..f0ad43998 100644
--- a/backend/Testing/ApiTests/ApiTestBase.cs
+++ b/backend/Testing/ApiTests/ApiTestBase.cs
@@ -10,7 +10,7 @@ namespace Testing.ApiTests;
 
 public class ApiTestBase
 {
-    public readonly string BaseUrl = TestingEnvironmentVariables.ServerBaseUrl;
+    public string BaseUrl => TestingEnvironmentVariables.ServerBaseUrl;
     private readonly HttpClientHandler _httpClientHandler = new();
     public readonly HttpClient HttpClient;
 
diff --git a/backend/Testing/Services/TestingEnvironmentVariables.cs b/backend/Testing/Services/TestingEnvironmentVariables.cs
index 94558be84..35b85f655 100644
--- a/backend/Testing/Services/TestingEnvironmentVariables.cs
+++ b/backend/Testing/Services/TestingEnvironmentVariables.cs
@@ -2,7 +2,7 @@ namespace Testing.Services;
 
 public static class TestingEnvironmentVariables
 {
-    public static readonly string ServerHostname = Environment.GetEnvironmentVariable("TEST_SERVER_HOSTNAME") ?? "localhost";
+    public static string ServerHostname = Environment.GetEnvironmentVariable("TEST_SERVER_HOSTNAME") ?? "localhost";
     public static readonly bool IsDev = ServerHostname.StartsWith("localhost");
     public static string HttpScheme = IsDev ? "http://" : "https://";
     public static string ServerBaseUrl => $"{HttpScheme}{ServerHostname}";

From fe4f1c13824fce9d19f52e990d23804cade29be6 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Tue, 5 Dec 2023 16:08:15 +0700
Subject: [PATCH 07/18] move auth attributes into a folder

---
 .../LexBoxApi/Auth/{ => Attributes}/AdminRequiredAttribute.cs  | 2 +-
 .../Auth/{ => Attributes}/CreateProjectRequiredAttribute.cs    | 2 +-
 backend/LexBoxApi/Auth/{ => Attributes}/LexboxAuthAttribute.cs | 2 +-
 .../Auth/{ => Attributes}/RequireAudienceAttribute.cs          | 2 +-
 .../Auth/{ => Attributes}/VerifiedEmailRequiredAttribute.cs    | 2 +-
 backend/LexBoxApi/Auth/AuthKernel.cs                           | 1 +
 .../LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs  | 3 ++-
 backend/LexBoxApi/Controllers/AdminController.cs               | 1 +
 backend/LexBoxApi/Controllers/AuthTestingController.cs         | 1 +
 backend/LexBoxApi/Controllers/LoginController.cs               | 1 +
 backend/LexBoxApi/Controllers/MigrationController.cs           | 1 +
 backend/LexBoxApi/Controllers/ProjectController.cs             | 1 +
 backend/LexBoxApi/GraphQL/LexQueries.cs                        | 1 +
 backend/LexBoxApi/GraphQL/ProjectMutations.cs                  | 1 +
 backend/LexBoxApi/GraphQL/TestQueries.cs                       | 1 +
 backend/LexBoxApi/GraphQL/UserMutations.cs                     | 1 +
 backend/LexBoxApi/Program.cs                                   | 1 +
 17 files changed, 18 insertions(+), 6 deletions(-)
 rename backend/LexBoxApi/Auth/{ => Attributes}/AdminRequiredAttribute.cs (87%)
 rename backend/LexBoxApi/Auth/{ => Attributes}/CreateProjectRequiredAttribute.cs (87%)
 rename backend/LexBoxApi/Auth/{ => Attributes}/LexboxAuthAttribute.cs (95%)
 rename backend/LexBoxApi/Auth/{ => Attributes}/RequireAudienceAttribute.cs (96%)
 rename backend/LexBoxApi/Auth/{ => Attributes}/VerifiedEmailRequiredAttribute.cs (87%)

diff --git a/backend/LexBoxApi/Auth/AdminRequiredAttribute.cs b/backend/LexBoxApi/Auth/Attributes/AdminRequiredAttribute.cs
similarity index 87%
rename from backend/LexBoxApi/Auth/AdminRequiredAttribute.cs
rename to backend/LexBoxApi/Auth/Attributes/AdminRequiredAttribute.cs
index e062e5e9b..856534078 100644
--- a/backend/LexBoxApi/Auth/AdminRequiredAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/AdminRequiredAttribute.cs
@@ -1,4 +1,4 @@
-namespace LexBoxApi.Auth;
+namespace LexBoxApi.Auth.Attributes;
 
 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
 public class AdminRequiredAttribute : LexboxAuthAttribute
diff --git a/backend/LexBoxApi/Auth/CreateProjectRequiredAttribute.cs b/backend/LexBoxApi/Auth/Attributes/CreateProjectRequiredAttribute.cs
similarity index 87%
rename from backend/LexBoxApi/Auth/CreateProjectRequiredAttribute.cs
rename to backend/LexBoxApi/Auth/Attributes/CreateProjectRequiredAttribute.cs
index 25b19aa1d..bed625561 100644
--- a/backend/LexBoxApi/Auth/CreateProjectRequiredAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/CreateProjectRequiredAttribute.cs
@@ -1,4 +1,4 @@
-namespace LexBoxApi.Auth;
+namespace LexBoxApi.Auth.Attributes;
 
 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
 public class CreateProjectRequiredAttribute: LexboxAuthAttribute
diff --git a/backend/LexBoxApi/Auth/LexboxAuthAttribute.cs b/backend/LexBoxApi/Auth/Attributes/LexboxAuthAttribute.cs
similarity index 95%
rename from backend/LexBoxApi/Auth/LexboxAuthAttribute.cs
rename to backend/LexBoxApi/Auth/Attributes/LexboxAuthAttribute.cs
index 5910b6a7a..31cff5996 100644
--- a/backend/LexBoxApi/Auth/LexboxAuthAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/LexboxAuthAttribute.cs
@@ -3,7 +3,7 @@
 using Microsoft.AspNetCore.Authorization;
 using AuthorizeAttribute = HotChocolate.Authorization.AuthorizeAttribute;
 
-namespace LexBoxApi.Auth;
+namespace LexBoxApi.Auth.Attributes;
 
 public abstract class LexboxAuthAttribute : DescriptorAttribute, IAuthorizeData
 {
diff --git a/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs b/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
similarity index 96%
rename from backend/LexBoxApi/Auth/RequireAudienceAttribute.cs
rename to backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
index fcf43d684..a16754f4a 100644
--- a/backend/LexBoxApi/Auth/RequireAudienceAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
@@ -1,7 +1,7 @@
 using LexCore.Auth;
 using Microsoft.AspNetCore.Authorization;
 
-namespace LexBoxApi.Auth;
+namespace LexBoxApi.Auth.Attributes;
 
 public class RequireAudienceAttribute(params LexboxAudience[] audiences)
     : LexboxAuthAttribute(PolicyName), IAuthorizationRequirement, IAuthorizationRequirementData
diff --git a/backend/LexBoxApi/Auth/VerifiedEmailRequiredAttribute.cs b/backend/LexBoxApi/Auth/Attributes/VerifiedEmailRequiredAttribute.cs
similarity index 87%
rename from backend/LexBoxApi/Auth/VerifiedEmailRequiredAttribute.cs
rename to backend/LexBoxApi/Auth/Attributes/VerifiedEmailRequiredAttribute.cs
index 5bfd233cb..a3d2ac897 100644
--- a/backend/LexBoxApi/Auth/VerifiedEmailRequiredAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/VerifiedEmailRequiredAttribute.cs
@@ -1,4 +1,4 @@
-namespace LexBoxApi.Auth;
+namespace LexBoxApi.Auth.Attributes;
 
 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
 public class VerifiedEmailRequiredAttribute : LexboxAuthAttribute
diff --git a/backend/LexBoxApi/Auth/AuthKernel.cs b/backend/LexBoxApi/Auth/AuthKernel.cs
index 93f6d2ef7..0b769948c 100644
--- a/backend/LexBoxApi/Auth/AuthKernel.cs
+++ b/backend/LexBoxApi/Auth/AuthKernel.cs
@@ -1,6 +1,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Net.Http.Headers;
 using System.Text;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.Auth.Requirements;
 using LexCore.Auth;
 using Microsoft.AspNetCore.Authentication.Cookies;
diff --git a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
index a80d6f94f..644d47be6 100644
--- a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
+++ b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
@@ -1,4 +1,5 @@
-using LexCore.Auth;
+using LexBoxApi.Auth.Attributes;
+using LexCore.Auth;
 using Microsoft.AspNetCore.Authorization;
 
 namespace LexBoxApi.Auth.Requirements;
diff --git a/backend/LexBoxApi/Controllers/AdminController.cs b/backend/LexBoxApi/Controllers/AdminController.cs
index 087137803..70d8094a1 100644
--- a/backend/LexBoxApi/Controllers/AdminController.cs
+++ b/backend/LexBoxApi/Controllers/AdminController.cs
@@ -1,5 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.Services;
 using LexCore;
 using LexData;
diff --git a/backend/LexBoxApi/Controllers/AuthTestingController.cs b/backend/LexBoxApi/Controllers/AuthTestingController.cs
index 028f19dc0..908ab6289 100644
--- a/backend/LexBoxApi/Controllers/AuthTestingController.cs
+++ b/backend/LexBoxApi/Controllers/AuthTestingController.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexCore.Auth;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
diff --git a/backend/LexBoxApi/Controllers/LoginController.cs b/backend/LexBoxApi/Controllers/LoginController.cs
index c690dd856..57386292a 100644
--- a/backend/LexBoxApi/Controllers/LoginController.cs
+++ b/backend/LexBoxApi/Controllers/LoginController.cs
@@ -1,5 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.Models;
 using LexBoxApi.Otel;
 using LexBoxApi.Services;
diff --git a/backend/LexBoxApi/Controllers/MigrationController.cs b/backend/LexBoxApi/Controllers/MigrationController.cs
index 9af6dcf06..02d6af91f 100644
--- a/backend/LexBoxApi/Controllers/MigrationController.cs
+++ b/backend/LexBoxApi/Controllers/MigrationController.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.Services;
 using LexCore.Entities;
 using LexData;
diff --git a/backend/LexBoxApi/Controllers/ProjectController.cs b/backend/LexBoxApi/Controllers/ProjectController.cs
index 64e8e94e8..aba869eb0 100644
--- a/backend/LexBoxApi/Controllers/ProjectController.cs
+++ b/backend/LexBoxApi/Controllers/ProjectController.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.Services;
 using LexCore.Entities;
 using LexCore.ServiceInterfaces;
diff --git a/backend/LexBoxApi/GraphQL/LexQueries.cs b/backend/LexBoxApi/GraphQL/LexQueries.cs
index f51999500..9c705d535 100644
--- a/backend/LexBoxApi/GraphQL/LexQueries.cs
+++ b/backend/LexBoxApi/GraphQL/LexQueries.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexCore.Auth;
 using LexCore.Entities;
 using LexCore.ServiceInterfaces;
diff --git a/backend/LexBoxApi/GraphQL/ProjectMutations.cs b/backend/LexBoxApi/GraphQL/ProjectMutations.cs
index bf1a0aa5b..bf1f34bf1 100644
--- a/backend/LexBoxApi/GraphQL/ProjectMutations.cs
+++ b/backend/LexBoxApi/GraphQL/ProjectMutations.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.GraphQL.CustomTypes;
 using LexBoxApi.Models.Project;
 using LexBoxApi.Services;
diff --git a/backend/LexBoxApi/GraphQL/TestQueries.cs b/backend/LexBoxApi/GraphQL/TestQueries.cs
index ef296ac06..9b2cfc8e3 100644
--- a/backend/LexBoxApi/GraphQL/TestQueries.cs
+++ b/backend/LexBoxApi/GraphQL/TestQueries.cs
@@ -1,4 +1,5 @@
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexCore.Auth;
 
 namespace LexBoxApi.GraphQL;
diff --git a/backend/LexBoxApi/GraphQL/UserMutations.cs b/backend/LexBoxApi/GraphQL/UserMutations.cs
index 8696d3832..54d55457e 100644
--- a/backend/LexBoxApi/GraphQL/UserMutations.cs
+++ b/backend/LexBoxApi/GraphQL/UserMutations.cs
@@ -1,5 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.GraphQL.CustomTypes;
 using LexBoxApi.Models.Project;
 using LexBoxApi.Services;
diff --git a/backend/LexBoxApi/Program.cs b/backend/LexBoxApi/Program.cs
index 8744a10ae..753b02dad 100644
--- a/backend/LexBoxApi/Program.cs
+++ b/backend/LexBoxApi/Program.cs
@@ -3,6 +3,7 @@
 using System.Text.Json.Serialization;
 using LexBoxApi;
 using LexBoxApi.Auth;
+using LexBoxApi.Auth.Attributes;
 using LexBoxApi.ErrorHandling;
 using LexBoxApi.Otel;
 using LexBoxApi.Services;

From 29611135f5a10cde529a1e4c863b66c68cc25f39 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Tue, 5 Dec 2023 16:54:32 +0700
Subject: [PATCH 08/18] update user updated date when changes are made

---
 backend/LexBoxApi/Controllers/AdminController.cs | 2 +-
 backend/LexBoxApi/Controllers/LoginController.cs | 1 +
 backend/LexBoxApi/GraphQL/UserMutations.cs       | 2 +-
 backend/LexBoxApi/Services/UserService.cs        | 7 +++++++
 backend/LexCore/Auth/LexAuthConstants.cs         | 1 +
 backend/LexCore/Auth/LexAuthUser.cs              | 4 +++-
 backend/LexCore/Entities/EntityBase.cs           | 1 +
 7 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/backend/LexBoxApi/Controllers/AdminController.cs b/backend/LexBoxApi/Controllers/AdminController.cs
index 70d8094a1..f6dedcf57 100644
--- a/backend/LexBoxApi/Controllers/AdminController.cs
+++ b/backend/LexBoxApi/Controllers/AdminController.cs
@@ -34,9 +34,9 @@ public record ResetPasswordAdminRequest([Required(AllowEmptyStrings = false)] st
     public async Task<ActionResult> ResetPasswordAdmin(ResetPasswordAdminRequest request)
     {
         var passwordHash = request.PasswordHash;
-        var lexAuthUser = _loggedInContext.User;
         var user = await _lexBoxDbContext.Users.FirstAsync(u => u.Id == request.userId);
         user.PasswordHash = PasswordHashing.HashPassword(passwordHash, user.Salt, true);
+        user.UpdateUpdatedDate();
         await _lexBoxDbContext.SaveChangesAsync();
         await _emailService.SendPasswordChangedEmail(user);
         return Ok();
diff --git a/backend/LexBoxApi/Controllers/LoginController.cs b/backend/LexBoxApi/Controllers/LoginController.cs
index 57386292a..49a4766a4 100644
--- a/backend/LexBoxApi/Controllers/LoginController.cs
+++ b/backend/LexBoxApi/Controllers/LoginController.cs
@@ -143,6 +143,7 @@ public async Task<ActionResult> ResetPassword(ResetPasswordRequest request)
         var lexAuthUser = _loggedInContext.User;
         var user = await _lexBoxDbContext.Users.FirstAsync(u => u.Id == lexAuthUser.Id);
         user.PasswordHash = PasswordHashing.HashPassword(passwordHash, user.Salt, true);
+        user.UpdateUpdatedDate();
         await _lexBoxDbContext.SaveChangesAsync();
         await _emailService.SendPasswordChangedEmail(user);
         //the old jwt is only valid for calling forgot password endpoints, we need to generate a new one
diff --git a/backend/LexBoxApi/GraphQL/UserMutations.cs b/backend/LexBoxApi/GraphQL/UserMutations.cs
index 54d55457e..caeceb7e9 100644
--- a/backend/LexBoxApi/GraphQL/UserMutations.cs
+++ b/backend/LexBoxApi/GraphQL/UserMutations.cs
@@ -81,7 +81,7 @@ LexAuthService lexAuthService
                 user.IsAdmin = adminInput.Role == UserRole.admin;
             }
         }
-
+        user.UpdateUpdatedDate();
         await dbContext.SaveChangesAsync();
 
         if (!input.Email.IsNullOrEmpty() && !input.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))
diff --git a/backend/LexBoxApi/Services/UserService.cs b/backend/LexBoxApi/Services/UserService.cs
index 00b86755e..69e05a3ce 100644
--- a/backend/LexBoxApi/Services/UserService.cs
+++ b/backend/LexBoxApi/Services/UserService.cs
@@ -17,4 +17,11 @@ public async Task UpdateUserLastActive(Guid id)
         await _dbContext.Users.Where(u => u.Id == id)
             .ExecuteUpdateAsync(c => c.SetProperty(u => u.LastActive, DateTimeOffset.UtcNow));
     }
+
+    public async Task<DateTimeOffset> GetUserUpdatedDate(Guid id)
+    {
+        return await _dbContext.Users.Where(u => u.Id == id)
+            .Select(u => u.UpdatedDate)
+            .SingleOrDefaultAsync();
+    }
 }
diff --git a/backend/LexCore/Auth/LexAuthConstants.cs b/backend/LexCore/Auth/LexAuthConstants.cs
index bbfa5b325..44c83d292 100644
--- a/backend/LexCore/Auth/LexAuthConstants.cs
+++ b/backend/LexCore/Auth/LexAuthConstants.cs
@@ -10,6 +10,7 @@ public static class LexAuthConstants
     public const string ProjectsClaimType = "proj";
     public const string EmailUnverifiedClaimType = "unver";
     public const string CanCreateProjectClaimType = "mkproj";
+    public const string UpdatedDateClaimType = "date";
 }
 
 /// <summary>
diff --git a/backend/LexCore/Auth/LexAuthUser.cs b/backend/LexCore/Auth/LexAuthUser.cs
index 5671ad507..cda18588e 100644
--- a/backend/LexCore/Auth/LexAuthUser.cs
+++ b/backend/LexCore/Auth/LexAuthUser.cs
@@ -83,6 +83,7 @@ public LexAuthUser(User user)
         Email = user.Email;
         Role = user.IsAdmin ? UserRole.admin : UserRole.user;
         Name = user.Name;
+        UpdatedDate = user.UpdatedDate;
         Projects = user.IsAdmin
             ? Array.Empty<AuthUserProject>() // admins have access to all projects, so we don't include them to prevent going over the jwt limit
             : user.Projects.Select(p => new AuthUserProject(p.Role, p.ProjectId)).ToArray();
@@ -92,7 +93,8 @@ public LexAuthUser(User user)
 
     [JsonPropertyName(LexAuthConstants.IdClaimType)]
     public required Guid Id { get; set; }
-
+    [JsonPropertyName(LexAuthConstants.UpdatedDateClaimType)]
+    public required DateTimeOffset UpdatedDate { get; set; }
     [JsonPropertyName(LexAuthConstants.AudienceClaimType)]
     public LexboxAudience Audience { get; set; } = LexboxAudience.LexboxApi;
 
diff --git a/backend/LexCore/Entities/EntityBase.cs b/backend/LexCore/Entities/EntityBase.cs
index 4d4de8212..a7d268c71 100644
--- a/backend/LexCore/Entities/EntityBase.cs
+++ b/backend/LexCore/Entities/EntityBase.cs
@@ -5,4 +5,5 @@ public class EntityBase
     public Guid Id { get; init; }
     public DateTimeOffset CreatedDate { get; set; } = DateTimeOffset.UtcNow;
     public DateTimeOffset UpdatedDate { get; set; } = DateTimeOffset.UtcNow;
+    public void UpdateUpdatedDate() => UpdatedDate = DateTimeOffset.UtcNow;
 }

From 9313a58d4343705f0508f91dac337a3767dd20d5 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Tue, 5 Dec 2023 16:56:15 +0700
Subject: [PATCH 09/18] send user to login with an error when using a jwt with
 a date that doesn't match the user in the DB

---
 .../RequireCurrentUserInfoAttribute.cs        | 15 +++++++++++
 backend/LexBoxApi/Auth/AuthKernel.cs          |  1 +
 .../ValidateUserUpdatedHandler.cs             | 27 +++++++++++++++++++
 .../LexBoxApi/Controllers/LoginController.cs  | 24 ++++++++++++++++-
 frontend/schema.graphql                       |  1 +
 frontend/src/lib/i18n/locales/en.json         |  1 +
 .../(unauthenticated)/login/+page.svelte      |  8 +++++-
 7 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 backend/LexBoxApi/Auth/Attributes/RequireCurrentUserInfoAttribute.cs
 create mode 100644 backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs

diff --git a/backend/LexBoxApi/Auth/Attributes/RequireCurrentUserInfoAttribute.cs b/backend/LexBoxApi/Auth/Attributes/RequireCurrentUserInfoAttribute.cs
new file mode 100644
index 000000000..412a79a8a
--- /dev/null
+++ b/backend/LexBoxApi/Auth/Attributes/RequireCurrentUserInfoAttribute.cs
@@ -0,0 +1,15 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace LexBoxApi.Auth.Attributes;
+
+/// <summary>
+/// validates the updated date of the jwt against the database, should be used to make a jwt expire if the user is updated
+/// </summary>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public class RequireCurrentUserInfoAttribute: Attribute, IAuthorizationRequirement, IAuthorizationRequirementData
+{
+    public IEnumerable<IAuthorizationRequirement> GetRequirements()
+    {
+        yield return this;
+    }
+}
diff --git a/backend/LexBoxApi/Auth/AuthKernel.cs b/backend/LexBoxApi/Auth/AuthKernel.cs
index 0b769948c..4f7444df8 100644
--- a/backend/LexBoxApi/Auth/AuthKernel.cs
+++ b/backend/LexBoxApi/Auth/AuthKernel.cs
@@ -31,6 +31,7 @@ public static void AddLexBoxAuth(IServiceCollection services,
 
         services.AddScoped<LexAuthService>();
         services.AddSingleton<IAuthorizationHandler, AudienceRequirementHandler>();
+        services.AddSingleton<IAuthorizationHandler, ValidateUserUpdatedHandler>();
         services.AddAuthorization(options =>
         {
             //fallback policy is used when there's no auth attribute.
diff --git a/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs b/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs
new file mode 100644
index 000000000..bede9e904
--- /dev/null
+++ b/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs
@@ -0,0 +1,27 @@
+using LexBoxApi.Auth.Attributes;
+using LexBoxApi.Services;
+using LexData;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.EntityFrameworkCore;
+
+namespace LexBoxApi.Auth.Requirements;
+
+public class ValidateUserUpdatedHandler(IHttpContextAccessor httpContextAccessor) : AuthorizationHandler<RequireCurrentUserInfoAttribute>
+{
+    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, RequireCurrentUserInfoAttribute requirement)
+    {
+        var httpContext = httpContextAccessor.HttpContext;
+        var user = httpContext?.RequestServices.GetRequiredService<LoggedInContext>().MaybeUser;
+        if (user is null) return;
+        var userService = httpContext!.RequestServices.GetRequiredService<UserService>();
+        var actualUpdatedDate = await userService.GetUserUpdatedDate(user.Id);
+        if (actualUpdatedDate != user.UpdatedDate)
+        {
+            context.Fail(new AuthorizationFailureReason(this, "User has been updated since login"));
+        }
+        else
+        {
+            context.Succeed(requirement);
+        }
+    }
+}
diff --git a/backend/LexBoxApi/Controllers/LoginController.cs b/backend/LexBoxApi/Controllers/LoginController.cs
index 49a4766a4..1383808c3 100644
--- a/backend/LexBoxApi/Controllers/LoginController.cs
+++ b/backend/LexBoxApi/Controllers/LoginController.cs
@@ -53,11 +53,23 @@ public async Task<ActionResult> LoginRedirect(
         string jwt, // This is required because auth looks for a jwt in the query string
         string returnTo)
     {
+        var user = _loggedInContext.User;
+        var userUpdatedDate = await _userService.GetUserUpdatedDate(user.Id);
+        if (userUpdatedDate != user.UpdatedDate)
+        {
+            return await EmailLinkExpired();
+        }
         await HttpContext.SignInAsync(User,
             new AuthenticationProperties { IsPersistent = true });
         return Redirect(returnTo);
     }
 
+    private async Task<ActionResult> EmailLinkExpired()
+    {
+        await HttpContext.SignOutAsync();
+        return Redirect("/login?message=link_expired");
+    }
+
     [HttpGet("verifyEmail")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
@@ -74,9 +86,14 @@ public async Task<ActionResult<LexAuthUser>> VerifyEmail(
         var userId = _loggedInContext.User.Id;
         var user = await _lexBoxDbContext.Users.FindAsync(userId);
         if (user == null) return NotFound();
+        if (user.UpdatedDate != _loggedInContext.User.UpdatedDate)
+        {
+            return await EmailLinkExpired();
+        }
 
         user.Email = _loggedInContext.User.Email;
         user.EmailVerified = true;
+        user.UpdateUpdatedDate();
         await _lexBoxDbContext.SaveChangesAsync();
         await RefreshJwt();
         return Redirect(returnTo);
@@ -137,11 +154,16 @@ public record ResetPasswordRequest([Required(AllowEmptyStrings = false)] string
 
     [HttpPost("resetPassword")]
     [RequireAudience(LexboxAudience.ForgotPassword)]
+    [RequireCurrentUserInfo]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesDefaultResponseType]
     public async Task<ActionResult> ResetPassword(ResetPasswordRequest request)
     {
         var passwordHash = request.PasswordHash;
         var lexAuthUser = _loggedInContext.User;
-        var user = await _lexBoxDbContext.Users.FirstAsync(u => u.Id == lexAuthUser.Id);
+        var user = await _lexBoxDbContext.Users.FindAsync(lexAuthUser.Id);
+        if (user == null) return NotFound();
         user.PasswordHash = PasswordHashing.HashPassword(passwordHash, user.Salt, true);
         user.UpdateUpdatedDate();
         await _lexBoxDbContext.SaveChangesAsync();
diff --git a/frontend/schema.graphql b/frontend/schema.graphql
index aa8f291fa..72061393d 100644
--- a/frontend/schema.graphql
+++ b/frontend/schema.graphql
@@ -91,6 +91,7 @@ type IsAdminResponse {
 
 type LexAuthUser {
   id: UUID!
+  updatedDate: DateTime!
   audience: LexboxAudience!
   email: String!
   name: String!
diff --git a/frontend/src/lib/i18n/locales/en.json b/frontend/src/lib/i18n/locales/en.json
index 86bbf5342..332335329 100644
--- a/frontend/src/lib/i18n/locales/en.json
+++ b/frontend/src/lib/i18n/locales/en.json
@@ -119,6 +119,7 @@
     "title": "Log in",
     "password_missing": "Password missing",
     "password_reset": "Your password has been reset",
+    "link_expired": "The email you clicked has expired. Please request a new one.",
     "welcome": "### Welcome to Language Depot!\n\
 Language Depot is a hosting service for [FieldWorks (FLEx)](https://software.sil.org/fieldworks/), \
 [Language Forge](https://languageforge.org/), [OneStory Editor](https://onestory.org/) and [WeSay](https://software.sil.org/wesay/) projects. \
diff --git a/frontend/src/routes/(unauthenticated)/login/+page.svelte b/frontend/src/routes/(unauthenticated)/login/+page.svelte
index 9e42698b0..7c08afded 100644
--- a/frontend/src/routes/(unauthenticated)/login/+page.svelte
+++ b/frontend/src/routes/(unauthenticated)/login/+page.svelte
@@ -31,7 +31,13 @@
     }
   );
 
-  onMount(logout);
+  onMount(() => {
+    const code = new URLSearchParams(window.location.search).get('message');
+    if (code === 'link_expired') {
+      $message = $t('login.link_expired');
+    }
+    logout();
+  });
   let badCredentials = false;
 </script>
 

From 5d11139ff7006285fcd5149193ff35ff56f1201b Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Tue, 5 Dec 2023 17:14:06 +0700
Subject: [PATCH 10/18] update forgot password test to verify that the link has
 expired

---
 backend/Testing/Browser/EmailWorkflowTests.cs | 8 ++++++++
 backend/Testing/LexCore/LexAuthUserTests.cs   | 1 +
 2 files changed, 9 insertions(+)

diff --git a/backend/Testing/Browser/EmailWorkflowTests.cs b/backend/Testing/Browser/EmailWorkflowTests.cs
index 5e0ef5575..103c2754d 100644
--- a/backend/Testing/Browser/EmailWorkflowTests.cs
+++ b/backend/Testing/Browser/EmailWorkflowTests.cs
@@ -94,5 +94,13 @@ public async Task ForgotPassword()
         await loginPage.FillForm(email, newPassword);
         await loginPage.Submit();
         await userDashboardPage.WaitFor();
+
+        // Step: Verify email link has expired
+        inboxPage = await MailInboxPage.Get(Page, mailinatorId).Goto();
+        emailPage = await inboxPage.OpenEmail();
+        //this is never returning a page for some reason
+        newPage = await Page.Context.RunAndWaitForPageAsync(emailPage.ClickResetPassword);
+        loginPage = await new LoginPage(newPage).WaitFor();
+        await Expect(loginPage.Page.GetByText("The email you clicked has expired")).ToBeVisibleAsync();
     }
 }
diff --git a/backend/Testing/LexCore/LexAuthUserTests.cs b/backend/Testing/LexCore/LexAuthUserTests.cs
index 170c5c618..cc7a732f9 100644
--- a/backend/Testing/LexCore/LexAuthUserTests.cs
+++ b/backend/Testing/LexCore/LexAuthUserTests.cs
@@ -32,6 +32,7 @@ static LexAuthUserTests()
         Email = "test@test.com",
         Role = UserRole.user,
         Name = "test",
+        UpdatedDate = DateTimeOffset.Now,
         Projects = new[] { new AuthUserProject(ProjectRole.Manager, Guid.NewGuid()) }
     };
 

From acd39aaf914976dc61f5deae969f07a956816965 Mon Sep 17 00:00:00 2001
From: Tim Haasdyk <tim_haasdyk@sil.org>
Date: Tue, 5 Dec 2023 16:43:17 +0100
Subject: [PATCH 11/18] Fix ForgotPassword email workflow test

---
 backend/Testing/Browser/EmailWorkflowTests.cs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/backend/Testing/Browser/EmailWorkflowTests.cs b/backend/Testing/Browser/EmailWorkflowTests.cs
index 103c2754d..b954cbe81 100644
--- a/backend/Testing/Browser/EmailWorkflowTests.cs
+++ b/backend/Testing/Browser/EmailWorkflowTests.cs
@@ -97,8 +97,7 @@ public async Task ForgotPassword()
 
         // Step: Verify email link has expired
         inboxPage = await MailInboxPage.Get(Page, mailinatorId).Goto();
-        emailPage = await inboxPage.OpenEmail();
-        //this is never returning a page for some reason
+        emailPage = await inboxPage.OpenEmail(1); // 0 is the password changed notification
         newPage = await Page.Context.RunAndWaitForPageAsync(emailPage.ClickResetPassword);
         loginPage = await new LoginPage(newPage).WaitFor();
         await Expect(loginPage.Page.GetByText("The email you clicked has expired")).ToBeVisibleAsync();

From 80225ae9ba57b2f190c9203865c11dffe5010e0d Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 10:27:52 +0700
Subject: [PATCH 12/18] make `RequireAudienceAttribute` not exclusive when
 using a single Audience by default.

---
 backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs | 2 +-
 backend/LexBoxApi/Auth/AuthKernel.cs                          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs b/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
index a16754f4a..215b85860 100644
--- a/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
+++ b/backend/LexBoxApi/Auth/Attributes/RequireAudienceAttribute.cs
@@ -9,7 +9,7 @@ public class RequireAudienceAttribute(params LexboxAudience[] audiences)
     public const string PolicyName = "RequireAudiencePolicy";
     /// <param name="audience">audience allowed to access this endpoint</param>
     /// <param name="exclusive">when false the default audience is also allowed, when true the default audience is not allowed</param>
-    public RequireAudienceAttribute(LexboxAudience audience, bool exclusive) : this(exclusive
+    public RequireAudienceAttribute(LexboxAudience audience, bool exclusive = false) : this(exclusive
         ? [audience]
         : [audience, LexboxAudience.LexboxApi])
     {
diff --git a/backend/LexBoxApi/Auth/AuthKernel.cs b/backend/LexBoxApi/Auth/AuthKernel.cs
index 4f7444df8..6e0b93de0 100644
--- a/backend/LexBoxApi/Auth/AuthKernel.cs
+++ b/backend/LexBoxApi/Auth/AuthKernel.cs
@@ -171,7 +171,7 @@ public static void AddLexBoxAuth(IServiceCollection services,
     public static AuthorizationPolicyBuilder RequireDefaultLexboxAuth(this AuthorizationPolicyBuilder builder)
     {
         return builder.RequireAuthenticatedUser()
-            .AddRequirements(new RequireAudienceAttribute(LexboxAudience.LexboxApi));
+            .AddRequirements(new RequireAudienceAttribute(LexboxAudience.LexboxApi, true));
     }
 
     public static bool IsJwtRequest(this HttpRequest request)

From 15452dc509de8fffa6337c6943146de761408abb Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 11:22:00 +0700
Subject: [PATCH 13/18] simplify forgot password test by just saving the reset
 password url and reusing that to verify the link has expired

---
 backend/Testing/Browser/EmailWorkflowTests.cs | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/backend/Testing/Browser/EmailWorkflowTests.cs b/backend/Testing/Browser/EmailWorkflowTests.cs
index b954cbe81..069527466 100644
--- a/backend/Testing/Browser/EmailWorkflowTests.cs
+++ b/backend/Testing/Browser/EmailWorkflowTests.cs
@@ -1,4 +1,5 @@
-using Testing.Browser.Base;
+using Shouldly;
+using Testing.Browser.Base;
 using Testing.Browser.Page;
 using Testing.Browser.Page.External;
 
@@ -81,6 +82,8 @@ public async Task ForgotPassword()
         // Step: Use reset password link
         var inboxPage = await MailInboxPage.Get(Page, mailinatorId).Goto();
         var emailPage = await inboxPage.OpenEmail();
+        var resetPasswordUrl = await emailPage.GetFirstLanguageDepotUrl();
+        resetPasswordUrl.ShouldNotBeNull().ShouldContain("resetpassword");
 
         var newPage = await Page.Context.RunAndWaitForPageAsync(emailPage.ClickResetPassword);
         var resetPasswordPage = await new ResetPasswordPage(newPage).WaitFor();
@@ -96,10 +99,8 @@ public async Task ForgotPassword()
         await userDashboardPage.WaitFor();
 
         // Step: Verify email link has expired
-        inboxPage = await MailInboxPage.Get(Page, mailinatorId).Goto();
-        emailPage = await inboxPage.OpenEmail(1); // 0 is the password changed notification
-        newPage = await Page.Context.RunAndWaitForPageAsync(emailPage.ClickResetPassword);
-        loginPage = await new LoginPage(newPage).WaitFor();
+        await Page.GotoAsync(resetPasswordUrl);
+        loginPage = await new LoginPage(Page).WaitFor();
         await Expect(loginPage.Page.GetByText("The email you clicked has expired")).ToBeVisibleAsync();
     }
 }

From edb2aa6352516fe6cedf3d41544646a9d7249ef3 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 11:23:05 +0700
Subject: [PATCH 14/18] change updated date to be stored as unix seconds
 instead of date string.

---
 backend/LexBoxApi/Controllers/LoginController.cs |  2 +-
 backend/LexBoxApi/Services/UserService.cs        |  6 +++---
 backend/LexCore/Auth/LexAuthUser.cs              | 12 ++++++++++--
 backend/Testing/LexCore/LexAuthUserTests.cs      |  2 +-
 4 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/backend/LexBoxApi/Controllers/LoginController.cs b/backend/LexBoxApi/Controllers/LoginController.cs
index 1383808c3..ff3850fef 100644
--- a/backend/LexBoxApi/Controllers/LoginController.cs
+++ b/backend/LexBoxApi/Controllers/LoginController.cs
@@ -86,7 +86,7 @@ public async Task<ActionResult<LexAuthUser>> VerifyEmail(
         var userId = _loggedInContext.User.Id;
         var user = await _lexBoxDbContext.Users.FindAsync(userId);
         if (user == null) return NotFound();
-        if (user.UpdatedDate != _loggedInContext.User.UpdatedDate)
+        if (user.UpdatedDate.ToUnixTimeSeconds() != _loggedInContext.User.UpdatedDate)
         {
             return await EmailLinkExpired();
         }
diff --git a/backend/LexBoxApi/Services/UserService.cs b/backend/LexBoxApi/Services/UserService.cs
index 69e05a3ce..48fe5d1e7 100644
--- a/backend/LexBoxApi/Services/UserService.cs
+++ b/backend/LexBoxApi/Services/UserService.cs
@@ -18,10 +18,10 @@ await _dbContext.Users.Where(u => u.Id == id)
             .ExecuteUpdateAsync(c => c.SetProperty(u => u.LastActive, DateTimeOffset.UtcNow));
     }
 
-    public async Task<DateTimeOffset> GetUserUpdatedDate(Guid id)
+    public async Task<long> GetUserUpdatedDate(Guid id)
     {
-        return await _dbContext.Users.Where(u => u.Id == id)
+        return (await _dbContext.Users.Where(u => u.Id == id)
             .Select(u => u.UpdatedDate)
-            .SingleOrDefaultAsync();
+            .SingleOrDefaultAsync()).ToUnixTimeSeconds();
     }
 }
diff --git a/backend/LexCore/Auth/LexAuthUser.cs b/backend/LexCore/Auth/LexAuthUser.cs
index cda18588e..7467b5ab2 100644
--- a/backend/LexCore/Auth/LexAuthUser.cs
+++ b/backend/LexCore/Auth/LexAuthUser.cs
@@ -39,6 +39,11 @@ public record LexAuthUser
                         case ClaimValueTypes.Boolean:
                             jsonObject.Add(claim.Type, JsonValue.Create(bool.Parse(claim.Value)));
                             continue;
+                        case ClaimValueTypes.Integer:
+                        case ClaimValueTypes.Integer32:
+                        case ClaimValueTypes.Integer64:
+                            jsonObject.Add(claim.Type, JsonValue.Create(int.Parse(claim.Value)));
+                            continue;
                         default:
                             jsonObject.Add(claim.Type, JsonValue.Create(claim.Value));
                             continue;
@@ -83,7 +88,7 @@ public LexAuthUser(User user)
         Email = user.Email;
         Role = user.IsAdmin ? UserRole.admin : UserRole.user;
         Name = user.Name;
-        UpdatedDate = user.UpdatedDate;
+        UpdatedDate = user.UpdatedDate.ToUnixTimeSeconds();
         Projects = user.IsAdmin
             ? Array.Empty<AuthUserProject>() // admins have access to all projects, so we don't include them to prevent going over the jwt limit
             : user.Projects.Select(p => new AuthUserProject(p.Role, p.ProjectId)).ToArray();
@@ -94,7 +99,7 @@ public LexAuthUser(User user)
     [JsonPropertyName(LexAuthConstants.IdClaimType)]
     public required Guid Id { get; set; }
     [JsonPropertyName(LexAuthConstants.UpdatedDateClaimType)]
-    public required DateTimeOffset UpdatedDate { get; set; }
+    public required long UpdatedDate { get; set; }
     [JsonPropertyName(LexAuthConstants.AudienceClaimType)]
     public LexboxAudience Audience { get; set; } = LexboxAudience.LexboxApi;
 
@@ -185,6 +190,9 @@ public IEnumerable<Claim> GetClaims()
                     break;
                 case JsonValueKind.Null:
                     break;
+                case JsonValueKind.Number:
+                    yield return new Claim(jsonProperty.Name, jsonProperty.Value.ToString(), ClaimValueTypes.Integer);
+                    break;
                 default:
                     yield return new Claim(jsonProperty.Name, jsonProperty.Value.ToString());
                     break;
diff --git a/backend/Testing/LexCore/LexAuthUserTests.cs b/backend/Testing/LexCore/LexAuthUserTests.cs
index cc7a732f9..f5cb33c72 100644
--- a/backend/Testing/LexCore/LexAuthUserTests.cs
+++ b/backend/Testing/LexCore/LexAuthUserTests.cs
@@ -32,7 +32,7 @@ static LexAuthUserTests()
         Email = "test@test.com",
         Role = UserRole.user,
         Name = "test",
-        UpdatedDate = DateTimeOffset.Now,
+        UpdatedDate = DateTimeOffset.Now.ToUnixTimeSeconds(),
         Projects = new[] { new AuthUserProject(ProjectRole.Manager, Guid.NewGuid()) }
     };
 

From 811634e7e01b432ec5939f553b603640a4994a64 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Wed, 6 Dec 2023 11:25:08 +0700
Subject: [PATCH 15/18] improve failure errors of Page.WaitFor pattern, log
 Auth Handler errors to aide debugging auth issues.

---
 .../Auth/Requirements/AudienceRequirementHandler.cs          | 4 +++-
 .../Auth/Requirements/ValidateUserUpdatedHandler.cs          | 3 ++-
 backend/Testing/Browser/Page/BasePage.cs                     | 5 ++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
index 644d47be6..2688a6be9 100644
--- a/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
+++ b/backend/LexBoxApi/Auth/Requirements/AudienceRequirementHandler.cs
@@ -4,8 +4,9 @@
 
 namespace LexBoxApi.Auth.Requirements;
 
-public class AudienceRequirementHandler : AuthorizationHandler<RequireAudienceAttribute>
+public class AudienceRequirementHandler(ILogger<AudienceRequirementHandler> logger) : AuthorizationHandler<RequireAudienceAttribute>
 {
+
     protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
         RequireAudienceAttribute requirement)
     {
@@ -17,6 +18,7 @@ protected override Task HandleRequirementAsync(AuthorizationHandlerContext conte
         }
         else
         {
+            logger.LogInformation("Token does not have the required audience: [{Audience}] not in {ValidAudiences}", claim?.Value, string.Join(',', requirement.ValidAudiences));
             context.Fail(new AuthorizationFailureReason(this,
                 $"Token does not have the required audience: {requirement.ValidAudiences}"));
         }
diff --git a/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs b/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs
index bede9e904..0b42808a6 100644
--- a/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs
+++ b/backend/LexBoxApi/Auth/Requirements/ValidateUserUpdatedHandler.cs
@@ -6,7 +6,7 @@
 
 namespace LexBoxApi.Auth.Requirements;
 
-public class ValidateUserUpdatedHandler(IHttpContextAccessor httpContextAccessor) : AuthorizationHandler<RequireCurrentUserInfoAttribute>
+public class ValidateUserUpdatedHandler(IHttpContextAccessor httpContextAccessor, ILogger<ValidateUserUpdatedHandler> logger) : AuthorizationHandler<RequireCurrentUserInfoAttribute>
 {
     protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, RequireCurrentUserInfoAttribute requirement)
     {
@@ -17,6 +17,7 @@ protected override async Task HandleRequirementAsync(AuthorizationHandlerContext
         var actualUpdatedDate = await userService.GetUserUpdatedDate(user.Id);
         if (actualUpdatedDate != user.UpdatedDate)
         {
+            logger.LogInformation("User has been updated since login, {UpdatedDate} != {ActualUpdatedDate}", user.UpdatedDate, actualUpdatedDate);
             context.Fail(new AuthorizationFailureReason(this, "User has been updated since login"));
         }
         else
diff --git a/backend/Testing/Browser/Page/BasePage.cs b/backend/Testing/Browser/Page/BasePage.cs
index d1d802172..838a7cb18 100644
--- a/backend/Testing/Browser/Page/BasePage.cs
+++ b/backend/Testing/Browser/Page/BasePage.cs
@@ -46,13 +46,16 @@ public async Task<T> WaitFor()
     {
         if (UrlPattern is not null)
         {
+            //assert to get a good error message
+            await Assertions.Expect(Page).ToHaveURLAsync(UrlPattern);
+            //still wait to make sure we reach the same state we expect
             await Page.WaitForURLAsync(UrlPattern, new() { WaitUntil = WaitUntilState.Load });
         }
         else
         {
             await Page.WaitForLoadStateAsync(LoadState.Load);
         }
-        await Task.WhenAll(TestLocators.Select(l => l.WaitForAsync()));
+        await Task.WhenAll(TestLocators.Select(l => Assertions.Expect(l).ToBeVisibleAsync()));
         return (T)this;
     }
 }

From da1915fa27369afe2daa921a3bf098dd1b1ce134 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Thu, 7 Dec 2023 10:12:18 +0700
Subject: [PATCH 16/18] allow users to validate email with an out of date jwt
 as long as the email isn't changing

---
 backend/LexBoxApi/Controllers/LoginController.cs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/LexBoxApi/Controllers/LoginController.cs b/backend/LexBoxApi/Controllers/LoginController.cs
index ff3850fef..36168db3e 100644
--- a/backend/LexBoxApi/Controllers/LoginController.cs
+++ b/backend/LexBoxApi/Controllers/LoginController.cs
@@ -86,7 +86,10 @@ public async Task<ActionResult<LexAuthUser>> VerifyEmail(
         var userId = _loggedInContext.User.Id;
         var user = await _lexBoxDbContext.Users.FindAsync(userId);
         if (user == null) return NotFound();
-        if (user.UpdatedDate.ToUnixTimeSeconds() != _loggedInContext.User.UpdatedDate)
+        //users can verify their email even if the updated date is out of sync when not changing their email
+        //this is to prevent some edge cases where changing their name and then using an old verify email link would fail
+        if (user.Email != _loggedInContext.User.Email &&
+            user.UpdatedDate.ToUnixTimeSeconds() != _loggedInContext.User.UpdatedDate)
         {
             return await EmailLinkExpired();
         }

From 14929aeb81f31d3cf1cebb11fb9d5bf7b5f18f69 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Thu, 7 Dec 2023 09:42:21 +0700
Subject: [PATCH 17/18] update .idea settings with version upgrade

---
 .idea/.idea.LexBox/.idea/dataSources.xml      | 27 ++++++++++++++++---
 .idea/.idea.LexBox/.idea/indexLayout.xml      |  6 +++++
 .../.idea/kubernetes-settings.xml             |  6 -----
 3 files changed, 30 insertions(+), 9 deletions(-)
 delete mode 100644 .idea/.idea.LexBox/.idea/kubernetes-settings.xml

diff --git a/.idea/.idea.LexBox/.idea/dataSources.xml b/.idea/.idea.LexBox/.idea/dataSources.xml
index db47a63ea..2fbfdd1a0 100644
--- a/.idea/.idea.LexBox/.idea/dataSources.xml
+++ b/.idea/.idea.LexBox/.idea/dataSources.xml
@@ -5,7 +5,16 @@
       <driver-ref>postgresql</driver-ref>
       <synchronize>true</synchronize>
       <jdbc-driver>org.postgresql.Driver</jdbc-driver>
-      <jdbc-url>jdbc:postgresql://localhost:5433/lexbox</jdbc-url>
+      <jdbc-url>jdbc:postgresql://localhost/lexbox</jdbc-url>
+      <jdbc-additional-properties>
+        <property name="com.intellij.clouds.kubernetes.db.host.port" value="5440" />
+        <property name="com.intellij.clouds.kubernetes.db.enabled" value="true" />
+        <property name="com.intellij.clouds.kubernetes.db.resource" value="db" />
+        <property name="com.intellij.clouds.kubernetes.db.context" value="docker-desktop" />
+        <property name="com.intellij.clouds.kubernetes.db.resource.type" value="Service" />
+        <property name="com.intellij.clouds.kubernetes.db.namespace" value="languagedepot" />
+        <property name="com.intellij.clouds.kubernetes.db.container.port" value="5432" />
+      </jdbc-additional-properties>
       <working-dir>$ProjectFileDir$</working-dir>
     </data-source>
     <data-source source="LOCAL" name="@localhost" uuid="a5c85238-865f-4de7-934f-1647c2e21296">
@@ -26,7 +35,13 @@
       <jdbc-driver>org.postgresql.Driver</jdbc-driver>
       <jdbc-url>jdbc:postgresql://localhost:5434/lexbox</jdbc-url>
       <jdbc-additional-properties>
-        <property name="com.intellij.clouds.kubernetes.db.enabled" value="false" />
+        <property name="com.intellij.clouds.kubernetes.db.host.port" value="5434" />
+        <property name="com.intellij.clouds.kubernetes.db.enabled" value="true" />
+        <property name="com.intellij.clouds.kubernetes.db.resource" value="db" />
+        <property name="com.intellij.clouds.kubernetes.db.context" value="dallas-rke" />
+        <property name="com.intellij.clouds.kubernetes.db.resource.type" value="Service" />
+        <property name="com.intellij.clouds.kubernetes.db.namespace" value="languagedepot" />
+        <property name="com.intellij.clouds.kubernetes.db.container.port" value="5432" />
       </jdbc-additional-properties>
       <working-dir>$ProjectFileDir$</working-dir>
     </data-source>
@@ -37,7 +52,13 @@
       <jdbc-driver>org.postgresql.Driver</jdbc-driver>
       <jdbc-url>jdbc:postgresql://localhost:5435/lexbox</jdbc-url>
       <jdbc-additional-properties>
-        <property name="com.intellij.clouds.kubernetes.db.enabled" value="false" />
+        <property name="com.intellij.clouds.kubernetes.db.host.port" value="5435" />
+        <property name="com.intellij.clouds.kubernetes.db.enabled" value="true" />
+        <property name="com.intellij.clouds.kubernetes.db.resource" value="db" />
+        <property name="com.intellij.clouds.kubernetes.db.context" value="aws-rke" />
+        <property name="com.intellij.clouds.kubernetes.db.resource.type" value="Service" />
+        <property name="com.intellij.clouds.kubernetes.db.namespace" value="languagedepot" />
+        <property name="com.intellij.clouds.kubernetes.db.container.port" value="5432" />
       </jdbc-additional-properties>
       <working-dir>$ProjectFileDir$</working-dir>
     </data-source>
diff --git a/.idea/.idea.LexBox/.idea/indexLayout.xml b/.idea/.idea.LexBox/.idea/indexLayout.xml
index d08f0ade8..bfb0056af 100644
--- a/.idea/.idea.LexBox/.idea/indexLayout.xml
+++ b/.idea/.idea.LexBox/.idea/indexLayout.xml
@@ -7,7 +7,13 @@
       <Path>hg-web</Path>
     </attachedFolders>
     <explicitIncludes>
+      <Path>.github</Path>
+      <Path>deployment</Path>
       <Path>hg-web</Path>
+      <Path>hgresumable</Path>
+      <Path>hgweb</Path>
+      <Path>otel</Path>
+      <Path>proxy</Path>
     </explicitIncludes>
     <explicitExcludes>
       <Path>frontend/.svelte-kit/output</Path>
diff --git a/.idea/.idea.LexBox/.idea/kubernetes-settings.xml b/.idea/.idea.LexBox/.idea/kubernetes-settings.xml
deleted file mode 100644
index 9c05fcbdc..000000000
--- a/.idea/.idea.LexBox/.idea/kubernetes-settings.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="KubernetesSettings">
-    <option name="contextName" value="docker-desktop" />
-  </component>
-</project>
\ No newline at end of file

From f450959c6cc42033e11ef55842b8151443bf7d37 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <hahn.kev@gmail.com>
Date: Thu, 7 Dec 2023 11:30:26 +0700
Subject: [PATCH 18/18] write out hg version in verify test

---
 backend/Testing/SyncReverseProxy/SendReceiveServiceTests.cs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/Testing/SyncReverseProxy/SendReceiveServiceTests.cs b/backend/Testing/SyncReverseProxy/SendReceiveServiceTests.cs
index 5c4681c5b..abbdfd50c 100644
--- a/backend/Testing/SyncReverseProxy/SendReceiveServiceTests.cs
+++ b/backend/Testing/SyncReverseProxy/SendReceiveServiceTests.cs
@@ -75,6 +75,7 @@ public async Task VerifyHgWorking()
     {
         string version = await _sendReceiveService.GetHgVersion();
         version.ShouldStartWith("Mercurial Distributed SCM");
+        _output.WriteLine("Hg version: " + version);
         HgRunner.Run("hg version", Environment.CurrentDirectory, 5, new XunitStringBuilderProgress(_output) {ShowVerbose = true});
         HgRepository.GetEnvironmentReadinessMessage("en").ShouldBeNull();
     }