Auto refresh of user entitlements every 5 - 15 mins so don't need to

relogin

Author: simonredfern

apps/api-manager/src/hooks.server.ts

@@ -332,5 +332,7 @@ declare module "svelte-kit-sessions" {
     authInfo?: {
       authenticated: boolean;
     };
+    /** Epoch ms of the last /users/current fetch (set at login and by the layout's silent refresh) */
+    userRefreshedAt?: number;
   }
 }

apps/api-manager/src/lib/utils/roleChecker.ts

@@ -470,6 +470,11 @@ const JIT_EXCLUDED_ROLES = new Set([
  * - User holds CanCreateEntitlementAtAnyBank (system-wide), OR
  *   CanCreateEntitlementAtOneBank for the relevant bank (bank-scoped roles)
  * - The missing role is not one of the excluded meta-roles
+ *
+ * Only real (database) entitlements count as grant-capable. /users/current also
+ * returns virtual entitlements (super_admin_user_ids / oidc_operator_user_ids props)
+ * with an empty entitlement_id; the OBP JIT grant logic only honours real
+ * entitlements, so counting virtual ones here would promise a grant that never happens.
  */
 function canJitGrant(
   requirement: RoleRequirement,
@@ -478,8 +483,10 @@ function canJitGrant(
 ): boolean {
   if (JIT_EXCLUDED_ROLES.has(requirement.role)) return false;
 
+  const realEntitlements = userEntitlements.filter((e) => e.entitlement_id);
+
   // CanCreateEntitlementAtAnyBank covers everything
-  const hasAnyBank = userEntitlements.some(
+  const hasAnyBank = realEntitlements.some(
     (e) => e.role_name === "CanCreateEntitlementAtAnyBank",
   );
   if (hasAnyBank) return true;
@@ -488,7 +495,7 @@ function canJitGrant(
   if (requirement.bankScoped || requirement.bankId) {
     const bankId = requirement.bankId || currentBankId;
     if (!bankId) return false;
-    return userEntitlements.some(
+    return realEntitlements.some(
       (e) => e.role_name === "CanCreateEntitlementAtOneBank" && e.bank_id === bankId,
     );
   }

apps/api-manager/src/routes/(protected)/+layout.server.ts

@@ -1,9 +1,8 @@
 import type { LayoutServerLoad } from "./$types";
 
-export const load: LayoutServerLoad = async ({ locals }) => {
-  const session = locals.session;
-  const userEntitlements =
-    (session?.data?.user as any)?.entitlements?.list || [];
-  const userId = (session?.data?.user as any)?.user_id || "";
-  return { userEntitlements, userId };
+// Derive from the root layout load (rather than reading the session directly) so
+// this load reruns when invalidate("app:session-user") refreshes the session user.
+export const load: LayoutServerLoad = async ({ parent }) => {
+  const { userEntitlements, userId } = await parent();
+  return { userEntitlements: userEntitlements || [], userId: userId || "" };
 };

apps/api-manager/src/routes/+layout.server.ts

@@ -1,7 +1,9 @@
 import { createLogger } from "@obp/shared/utils";
 const logger = createLogger("LayoutServer");
-import type { RequestEvent } from "@sveltejs/kit";
+import type { ServerLoadEvent } from "@sveltejs/kit";
+import type { Session } from "svelte-kit-sessions";
 import { obpIntegrationService } from "$lib/server/opey/OBPIntegrationService";
+import { OBP_API_URL } from "$lib/config";
 import type { OBPConsentInfo } from "$lib/obp/types";
 // import { computePosition, autoUpdate, offset, shift, flip, arrow } from '@floating-ui/dom';
 // import { storePopup } from '@skeletonlabs/skeleton';
@@ -22,10 +24,61 @@ export interface RootLayoutData {
   jitEnabled: boolean;
 }
 
-export async function load(event: RequestEvent) {
+// Session user (incl. entitlements) is a login-time snapshot. Refresh it from
+// /users/current when older than this, so granted roles (manual or JIT) show up
+// without logout/login. The client layout re-polls via invalidate() every 5 min;
+// keeping the base threshold below the poll interval guarantees each poll refreshes.
+// Users with very large entitlement lists (JIT accumulation can reach thousands of
+// rows) get a several-hundred-KB /users/current response, so back off for them —
+// see security_TODO.md "Prune JIT-accumulated entitlements".
+const USER_REFRESH_STALE_MS = 4 * 60 * 1000;
+const USER_REFRESH_STALE_LARGE_MS = 15 * 60 * 1000;
+const LARGE_ENTITLEMENT_COUNT = 500;
+
+async function refreshSessionUser(session: Session) {
+  const lastRefresh = session.data.userRefreshedAt ?? 0;
+  const entitlementCount =
+    (session.data.user as any)?.entitlements?.list?.length ?? 0;
+  const staleMs =
+    entitlementCount > LARGE_ENTITLEMENT_COUNT
+      ? USER_REFRESH_STALE_LARGE_MS
+      : USER_REFRESH_STALE_MS;
+  if (Date.now() - lastRefresh < staleMs) return;
+
+  try {
+    const response = await fetch(`${OBP_API_URL}/users/current`, {
+      headers: { Authorization: `Bearer ${session.data.oauth!.access_token}` },
+    });
+    if (!response.ok) {
+      logger.warn(`Failed to refresh /users/current: ${response.status}`);
+      return;
+    }
+    const freshUser = await response.json();
+    if (!freshUser.user_id) {
+      logger.warn("Refresh of /users/current returned no user_id, keeping session user");
+      return;
+    }
+    await session.setData({
+      ...session.data,
+      user: freshUser,
+      userRefreshedAt: Date.now(),
+    });
+    await session.save();
+    logger.info(
+      `Refreshed session user from /users/current (${freshUser.entitlements?.list?.length ?? 0} entitlements)`,
+    );
+  } catch (error) {
+    logger.warn("Failed to refresh /users/current, keeping session user:", error);
+  }
+}
+
+export async function load(event: ServerLoadEvent) {
   const startTime = performance.now();
   logger.info("🚀 Layout server load started");
 
+  // Rerun this load (and dependants) when the client calls invalidate("app:session-user")
+  event.depends("app:session-user");
+
   const { session } = event.locals;
 
   let data: Partial<RootLayoutData> = {};
@@ -59,6 +112,7 @@ export async function load(event: RequestEvent) {
   // User is only considered logged in if they have both user data AND a valid access token
   logger.info("👤 Checking user session");
   if (session?.data?.user && session?.data?.oauth?.access_token) {
+    await refreshSessionUser(session);
     data.userId = session.data.user.user_id;
     data.email = session.data.user.email;
     data.username = session.data.user.username;

apps/api-manager/src/routes/+layout.svelte

@@ -19,6 +19,7 @@
   import { currentBank } from "$lib/stores/currentBank.svelte";
   import { userPreferences } from "$lib/stores/userPreferences.svelte";
   import { onMount } from "svelte";
+  import { invalidate } from "$app/navigation";
 
   const logger = createLogger("LayoutClient");
   const layoutStartTime = performance.now();
@@ -103,6 +104,19 @@
     }
   });
 
+  // Silently re-fetch the session user (incl. entitlements) every 5 minutes so
+  // newly granted roles show up without logout/login. The server layout load
+  // throttles the actual /users/current call, so this is cheap when fresh.
+  const USER_REFRESH_POLL_MS = 5 * 60 * 1000;
+  onMount(() => {
+    const interval = setInterval(() => {
+      if (isAuthenticated) {
+        invalidate("app:session-user");
+      }
+    }, USER_REFRESH_POLL_MS);
+    return () => clearInterval(interval);
+  });
+
   // Fetch system dynamic entities for shortcuts
   async function fetchSystemDynamicEntities() {
     if (!isAuthenticated) return;

apps/api-manager/src/routes/login/[provider]/callback/+server.ts

@@ -231,6 +231,7 @@ export async function GET(event: RequestEvent): Promise<Response> {
     const { session } = event.locals;
     await session.setData({
       user: user,
+      userRefreshedAt: Date.now(),
       oauth: {
         access_token: obpAccessToken,
         refresh_token: tokens.refreshToken(),

apps/api-manager/src/routes/login/obp/callback/+server.ts

@@ -214,6 +214,7 @@ export async function GET(event: RequestEvent): Promise<Response> {
     const { session } = event.locals;
     await session.setData({
       user: user,
+      userRefreshedAt: Date.now(),
       oauth: {
         access_token: obpAccessToken,
         refresh_token: tokens.refreshToken(),