search

DeutscheModelUnitedNations / munify-delegator

DELEGATOR registration app, part of MUN-Product Suite MUNify
GNU Affero General Public License v3.0
4 stars 3 forks source link

Manually Invalidate Cookie when starting to edit data in MUNify Guard #33

Open Strehk opened 1 month ago

Strehk commented 1 month ago

The edited user data is not updated in the DELEGATOR until the cookie expires, since that triggers a renewed fetch of the user data via the id token. We should invalidate the cookie once we suspect the user of editing the account data in the GUARD.

Strehk commented 1 month ago

See https://fb-delegator.dmun.de/posts/17/aktualisierung-der-account-daten-in-munify-guard-werden-im-delegator-nicht-ubernommen

m1212e commented 1 month ago

Yeah the data will only be transferred after completing the login flow. This is decoupled from the redirect flow and available as a separate endpoint here: https://github.com/DeutscheModelUnitedNations/munify-delegator/blob/a524c9f63d883e062b5f1e925642de0d39c83098/src/api/routes/user.ts#L44

Maybe there is a more sensible default to call this? Is there a good way to detect "suspicion" of data changes on our side? We can't really know when the user is changing this stuff so I guess we have to guess?

Strehk commented 1 month ago

Yeah... We have to guess and flag once the "change data" Button is pressed? Maybe a new Database level boolean is too overkill?