Copilot commented on code in PR #13969:
URL: https://github.com/apache/cloudstack/pull/13969#discussion_r3975510101
##########
ui/src/store/modules/user.js:
##########
@@ -46,6 +46,51 @@ import {
LATEST_CS_VERSION
} from '@/store/mutation-types'
+function setLoginCookies (result) {
+ Cookies.set('account', result.account)
+ Cookies.set('domainid', result.domainid)
+ Cookies.set('role', result.type)
+ Cookies.set('timezone', result.timezone)
+ Cookies.set('timezoneoffset', result.timezoneoffset)
+ Cookies.set('userfullname', result.firstname + ' ' + result.lastname)
+ Cookies.set('userid', result.userid)
+ Cookies.set('username', result.username)
Review Comment:
This refactor changes cookie persistence behavior: previously these cookies
were set with `{ expires: 1 }`, but now they’re session cookies by default.
That can cause `userid` (and other identity cookies) to disappear while the
`ACCESS_TOKEN` in localStorage is still valid, triggering unexpected `Identity
session expired` errors. Consider restoring an explicit expiry (or aligning
cookie expiry with the token TTL) via a shared cookie options object used by
`setLoginCookies`.
##########
ui/src/store/modules/user.js:
##########
@@ -304,6 +273,11 @@ const user = {
commit('SET_DARK_MODE', darkMode)
commit('SET_LATEST_VERSION', latestVersion)
if (hasAuth) {
+ if (!Cookies.get('userid')) {
+ reject(new Error('Identity session expired'))
+ return
+ }
Review Comment:
On this rejection path, the code returns without clearing the cached auth
state (e.g., token/localStorage, any cached API state, or related cookies).
That can lead to repeated failures/loops where the app believes it’s
authenticated but cannot proceed. Consider performing the same cleanup as
logout (or explicitly clearing the relevant localStorage/cookies/state) before
rejecting so the UI can reliably fall back to a fresh login.
##########
ui/src/store/modules/user.js:
##########
@@ -304,6 +273,11 @@ const user = {
commit('SET_DARK_MODE', darkMode)
commit('SET_LATEST_VERSION', latestVersion)
if (hasAuth) {
+ if (!Cookies.get('userid')) {
+ reject(new Error('Identity session expired'))
Review Comment:
The new error message is developer-centric and may surface directly to
users. Consider using an existing, consistent login/session-expired message
pattern (and localization/i18n if the UI uses it), e.g., instructing the user
to re-authenticate and avoiding the ambiguous term 'Identity session'.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
