Refresh jwt/cookie when myProjects doesn't match.

backend/LexBoxApi/GraphQL/LexQueries.cs

@@ -14,10 +14,15 @@ public class LexQueries
 
     [UseProjection]
     [UseSorting]
-    public IQueryable<Project> MyProjects(LoggedInContext loggedInContext, LexBoxDbContext context)
+    public async Task<IQueryable<Project>> MyProjects(LoggedInContext loggedInContext, LexBoxDbContext context, LexAuthService lexAuthService)
     {
         var userId = loggedInContext.User.Id;
-        return context.Projects.Where(p => p.Users.Select(u => u.UserId).Contains(userId));
+        var projects = context.Projects.Where(p => p.Users.Select(u => u.UserId).Contains(userId));
+        if (loggedInContext.User.Role != UserRole.admin && !ProjectsMatch(projects, loggedInContext.User.Projects))
+        {
+            await lexAuthService.RefreshUser(userId, LexAuthConstants.ProjectsClaimType);
+        }
+        return projects;
     }
 
     [UseProjection]
@@ -59,4 +64,11 @@ public LexAuthUser Me(LoggedInContext loggedInContext)
     {
         return loggedInContext.User;
     }
+
+    private static bool ProjectsMatch(IQueryable<Project> dbProjects, AuthUserProject[] jwtProjects)
+    {
+        if (dbProjects.Count() != jwtProjects.Length) return false;
+        var dbProjectIds = dbProjects.Select(p => p.Id).ToHashSet();
+        return jwtProjects.All(p => dbProjectIds.Contains(p.ProjectId));
+    }
 }

frontend/package.json

@@ -73,9 +73,11 @@
 		"@opentelemetry/sdk-node": "^0.39.1",
 		"@opentelemetry/sdk-trace-web": "^1.13.0",
 		"@opentelemetry/semantic-conventions": "^1.13.0",
+		"@types/set-cookie-parser": "^2.4.7",
 		"@vitejs/plugin-basic-ssl": "^1.0.1",
 		"css-tree": "^2.3.1",
 		"mjml": "^4.14.1",
+		"set-cookie-parser": "^2.6.0",
 		"svelte-exmarkdown": "^3.0.1",
 		"svelte-intl-precompile": "^0.12.3",
 		"sveltekit-search-params": "^1.0.15",

frontend/src/hooks.server.ts

@@ -1,10 +1,11 @@
-import { getUser, isAuthn } from '$lib/user'
+import { AUTH_COOKIE_NAME, getUser, isAuthn } from '$lib/user'
 import { apiVersion } from '$lib/util/version';
 import { redirect, type Handle, type HandleFetch, type HandleServerError, type ResolveOptions } from '@sveltejs/kit'
 import { loadI18n } from '$lib/i18n';
 import { ensureErrorIsTraced, traceRequest, traceFetch } from '$lib/otel/otel.server'
 import { env } from '$env/dynamic/private';
 import { getErrorMessage, validateFetchResponse } from './hooks.shared';
+import * as setCookieParser from 'set-cookie-parser';
 
 const UNAUTHENTICATED_ROOT = '(unauthenticated)';
 const AUTHENTICATED_ROOT = '(authenticated)';
@@ -69,6 +70,18 @@ export const handleFetch: HandleFetch = async ({ event, request, fetch }) => {
     apiVersion.value = response.headers.get('lexbox-version');
   }
 
+  const lexBoxSetAuthCookieHeader = response.headers.getSetCookie()
+    .find(h => h.startsWith(`${AUTH_COOKIE_NAME}=`));
+
+  if (lexBoxSetAuthCookieHeader) {
+    const { name, value, ...options } = setCookieParser.parseString(lexBoxSetAuthCookieHeader);
+    event.cookies.set(AUTH_COOKIE_NAME, value, {
+      ...options,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-explicit-any
+      sameSite: options.sameSite?.toLocaleLowerCase() as any,
+    });
+  }
+
   return response;
 };
 

frontend/src/routes/(authenticated)/project/[project_code]/AddProjectMember.svelte

@@ -57,9 +57,5 @@
     autofocus
   />
   <ProjectRoleSelect bind:value={$form.role} error={errors.role} />
-  <div class="alert alert-info gap-2 mt-4">
-    <span class="i-mdi-info-outline text-xl"></span>
-    {$t('project_page.add_user.user_needs_to_relogin')}
-  </div>
   <span slot="submitText">{$t('project_page.add_user.submit_button')}</span>
 </FormModal>