Repository navigation
fix(auth): prefer the embedded session user in finalize/push_context (#879) - #106
Merged
Merged
Conversation
…(#879) The auth service now embeds the session user record in session reads, finalization, and login-session reads for the session-owning client (campus companion change for campus#879). finalize() answers the user-exists check from the embed and push_context() hydrates g.user from it, falling back to the operator-gated users route on pre-#879 services or campus-suite installs without the model field. Session.finalize() returns (target, user) instead of target alone — the only in-repo caller is Auth.finalize().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to campus#880 (server half of campus#879).
Problem
Auth.finalize()(step 4) andAuth.push_context()hydrate the signed-in user viaGET /users/{id}with the app's own client credentials. Since campus#854 that route is operator-only, so every non-operator flask_campus app fails sign-in at/finalize_login(reproduced live on nyxchange-timetable-v2; diagnosis in campus#879).Fix
The auth service now embeds the user record in session reads, finalization, and login-session reads for the session-owning client. This SDK change consumes it:
Session.finalize()returns(target, user)— the response'suseris parsed explicitly, so it works even against older campus-suite installs without the model field. Only in-repo caller:Auth.finalize().Auth.finalize()answers the user-exists check from the embed;users.getremains the fallback when no embed came back (pre-#879 services).push_context()(both session and login branches) hydratesg.userfrom the embedded record with the same fallback; agetattrguard covers campus-suite installs that predate the model field.Version-skew matrix: new SDK + new service → no users-route call for owning clients (the fix); new SDK + old service → fallback, behavior unchanged; old SDK + new service → unknown key ignored, unchanged.
Tests
test_embedded_session_user.py(8): finalize embed/fallback, push_context session and login branches, and the model-without-field skew case.test_sessions.pyandtest_finalize_device_id.pyfor the tuple return.