Description
Currently, the frontend is expected to decrypt the JWE to extract the User ID for authorization and UI logic, which is complex and prone to errors. To simplify this, the backend should provide a basic user metadata payload alongside the token during authentication.
Proposed Changes
- Backend: Update authentication responses (Login/Signup) to return a JSON object containing both the JWE and a
user metadata object.
{
"token": "ey...",
"user": {
"id": 123,
"fullName": "John Doe",
"email": "john@example.com"
}
}
- Frontend: Update
AuthService to store and expose this metadata via a Signal or Observable (currentUser), removing any token decryption logic from the client.
🛡️ Security Model
- Client-Side: The
user object is used strictly for UI and local logic (e.g., displaying the name, filtering views).
- Server-Side: The backend must ignore any User ID sent by the client in request bodies for sensitive operations. The JWE remains the only source of truth for authentication and authorization. The server must always extract the
userId from the validated token before processing any request.
Acceptance Criteria
Priority
This is critical to unblock permission-based features and list ownership logic.
Description
Currently, the frontend is expected to decrypt the JWE to extract the User ID for authorization and UI logic, which is complex and prone to errors. To simplify this, the backend should provide a basic user metadata payload alongside the token during authentication.
Proposed Changes
usermetadata object.{ "token": "ey...", "user": { "id": 123, "fullName": "John Doe", "email": "john@example.com" } }AuthServiceto store and expose this metadata via a Signal or Observable (currentUser), removing any token decryption logic from the client.🛡️ Security Model
userobject is used strictly for UI and local logic (e.g., displaying the name, filtering views).userIdfrom the validated token before processing any request.Acceptance Criteria
AuthServiceprovides easy access to the current User ID without token decoding.Priority
This is critical to unblock permission-based features and list ownership logic.