Bug: unable to reload users information when reassigning organizations

[drochag]

Prerequisites

• I have searched the repository’s issues and Kinde community to ensure my issue isn’t a duplicate
• I have checked the latest version of the library to replicate my issue
• I have read the contributing guidelines
• I agree to the terms within the code of conduct

Describe the issue

While reassigning an organization for a logged in user we're unable to see the user as part of the newly created organization in any way.

Tried out using refreshTokens on getKindeServerSession from @kinde-oss/kinde-auth-nextjs/server and also refreshUserClaims from UsersApi on @kinde-oss/kinde-typescript-sdk (although the last one not sure could help on reloading the current user information).

Steps to reproduce:

• sign up as a new user -- should be in the default organization
• create a new organization
• assign the user to the new organization
• remove the user from the default organization
• user won't be able to see he is part of the new organization unless we do search for him using organizationsApi.getOrganizationUsers with the new organization code

Reproduction repo / PR here

Library URL

https://github.com/kinde-oss/kinde-auth-nextjs and @kinde-oss/kinde-typescript-sdk

Library version

2.3.8 and 2.9.1

Operating system(s)

macOS

Operating system version(s)

Sonoma 14.6

Further environment details

No response

Reproducible test case URL

drochag/kinde-nextjs-app-router-starter-kit#1

Additional information

No response

[dxptqhtlutehvlyxcmtg]

We're seeing this too with @kinde-oss/kinde-typescript-sdk. For new users, in our auth callback request handler we're removing the user from the default org and placing them in a newly created one.

A query to the Management API shows the new org state, but, querying the user's orgs via the session attached to the request still shows the user assigned only to the default org. Here's some more or less psuedo-code to illustrate. See the very last call to getUserOrganizations to see the issue:

async function processRegisterCallback(request) {
  const DEFAULT_ORG_CODE = 'org_111111111111';

  // Get Management API access token
  const managementAccessToken = await createKindeServerClient(
    GrantType.CLIENT_CREDENTIALS,
    {
      // '...'
    },
  ).getToken(getSessionManager('admin-session'));

  const orgApiClient = new OrganizationsApi(
    new Configuration({
      accessToken: managementAccessToken,
      // ...
    }),
  );

  // Make session manager for current request
  const sessionManager = makeSessionManager(
    request.headers.get('Cookie').get('session_id'),
  );

  const kindeClient = createKindeServerClient(
    GrantType.AUTHORIZATION_CODE,
    {
      // '...'
    }
  );

  /*
    see newly created user from registering

    console.log:
    {
      user: {
        family_name: '...',
        given_name: '...',
        picture: '...',
        email: '...',
        id: 'kp_00000000000000000000000000000000'
      }
    }
  */
  const user = await kindeClient.getUser(sessionManager);

  /*
    User is in default org by default

    console.log:
    { orgCodes: [ 'org_111111111111' ] }
  */
  await kindeClient.getUserOrganizations(sessionManager);

  /*
    Create a new org via Management API

  {
    message: 'Success',
    code: 'OK',
    organization: { code: 'org_222222222222' }
  }
  */
  const createOrgResponse = await orgApiClient.createOrganization({
    createOrganizationRequest: {
      name: 'New Org',
    },
  });

  /*
    Add user to the new org

    {
      code: 'OK',
      message: 'Users successfully added',
      usersAdded: [ 'kp_00000000000000000000000000000000' ]
    }
  */
  await orgApiClient.addOrganizationUsers({
    orgCode: createOrgResponse.organization.code,
    addOrganizationUsersRequest: {
      users: [
        {
          id: user.id,
        },
      ],
    },
  });

  /*
    Remove user from our default org_111111111111

    { 
      message: 'User successfully removed', 
      code: 'OK' 
    }
  */
  await orgApiClient.removeOrganizationUser({
    orgCode: DEFAULT_ORG_CODE,
    userId: user.id,
  });

  /*
    Get user data via Management API, it correctly shows
    new org org_222222222222 is now assigned and user is no
    longer in default org org_111111111111

    {
      id: 'kp_00000000000000000000000000000000',
      providedId: undefined,
      preferredEmail: '...',
      username: undefined,
      lastName: '...',
      firstName: '...',
      isSuspended: false,
      picture: '...',
      totalSignIns: 1,
      failedSignIns: 0,
      lastSignedIn: '...',
      createdOn: '...',
      organizations: [ 'org_222222222222' ],
      identities: undefined
    }
  */
  const usersApiClient = new UsersApi(
    new Configuration({
      accessToken: managementAccessToken,
      // ...
    }),
  );

  await usersApiClient.getUserData({ id: user.id, expand: 'organizations' });

  /*
    Read user orgs via request session

    This is wrong, it should be org_222222222222
    
    { 
      orgCodes: [ 'org_111111111111' ] 
    }
  */
  await kindeClient.getUserOrganizations(sessionManager);
}

[coel]

@drochag, thank you for providing the code example. I believe a recent server fix has addressed this. Using the example code I am able to get the updated list of organizations after adding await to await currentSession.refreshTokens().

@dxptqhtlutehvlyxcmtg, to get the new details, a call will need to be made to refreshTokens() first to retrieve a token with the updated values.

[drochag]

Thanks for the update @coel

I updated the PR with the needed await, however this isn't working correctly either

did two clips to hide my google accounts
WALi is my default org

part.1.mov

-- deleted part.2.mov --

you can see the client organization is correct, although being correct after reloading the page, not after refreshing the token
the server organization is wrong

[coel]

@drochag, I've deleted the second video as the preview frame still showed your email addresses. I'll have a closer look at this today.

[dxptqhtlutehvlyxcmtg]

@coel Calling refreshTokens seems to fix the issue for us, thanks. However, I'm having trouble locating any references for that method. Could you please point to where it is documented?

[coel]

@drochag, I've raised a PR that may help with the server listing of organizations: kinde-oss/kinde-auth-nextjs#217

For the client listing, there is a function refreshData returned from useKindeBrowserClient that needs to be called for it to retrieve the updated data.

@dxptqhtlutehvlyxcmtg, I can't seem to locate the documentation myself, I will look into it further. The only thing I have found is this video tutorial we released https://www.youtube.com/watch?v=7eLs7OOSH80

[coel]

@drochag , We've released a new version of the Next.js SDK v2.3.11, can you try this version and see if your server listing now displays?

Just to note, assigning an organization to a user will add the organization to the list of available organizations for that user, but it won't change the organization currently logged into. The active organization can be switched by initiating login again, but with the organization code passed through.

Some relevant documentation: https://docs.kinde.com/authenticate/manage-authentication/navigate-between-organizations/

[DevEnable]

Hi @coel. I believe that this issue (or perhaps behaviour) is causing the issue in this Discord discussion.

Essentially the flow is:

• Create user using the standard Kinde flow
• Create an org or add a user to an org with role(s)
• Refresh user claims
• Load a page protected by role assertions (and currently getting forbidden / auth issues)

In my scenarios in both cases the user is being added to an organisation with roles assigned. I suspect this is also the case for the other user in that thread (Woet).

I think the issue is we're trying to refresh tokens but it's not using an organisation. What we need to be doing is something like the Next.js login approach you passed through with an organisation ID (I haven't check the SDK but I imagine your Nuxt or TypeScript API has something similar).

My question is if the user has logged in, gets added to an organisation with roles, something calls the Kinde API to RefreshUserClaims() if we then log in but pass in the created / assigned Kinde Org ID, from a UX experience standpoint will the user need to sign in again? Because that would not be a great experience

[coel]

Hi @DevEnable ,

The behaviour will depend on the parameters passed through. The default is for an already logged in user to get silently redirected back to your application, the login screen will be shown if not logged in.

If the prompt (or the older start_page) parameter is set to login, it will always show the login screen even for logged in users.

If prompt is set to none it will ensure the login page is not shown, if a user is not logged in they will be redirected back to your application callback with some error parameter set.

Some details of the prompt parameter can be found in our using Kinde without an SDK guide.

For the TypeScript SDK, the prompt parameter can be set via the authUrlParams option.

[DevEnable]

Thanks for the explanation @coel. I'm working on something else at the moment but will take another crack at this next week.

I'm actually using Nuxt on my frontend, just the Typescript SDK for the M2M claim refresh, so it's possibly an issue with that library (or my code).

[DevEnable]

Thanks @coel that worked. By redirecting in my middleware I was able to get a new set of claims with roles & organisations.

await sendRedirect(event, '/api/login?prompt=none&org_code=' + config.DEFAULT_KINDE_ORG_CODE)

Note: For anyone referencing the above code, this is for Nuxt so your mileage may vary.

[DanielRivers]

Thanks for the update @DevEnable, we are looking to add in a switchOrg helper to our SDKs to simplify this.