sillsdev / sillsdev/languageforge-lexbox

FW Lite shows the wrong current user when a project's GUID exists on more than one logged-in server

Open
#2,491 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
9
Forks
8
Avg merge
2d 13h
Merged PRs (30d)
49

Description

When the same CRDT project GUID exists on more than one Lexbox server you're logged into, FW Lite can attribute the project to the wrong user. The comments UI then shows the wrong "current user", and (until the next sync) new CRDT commits can be authored under that wrong identity. Even after the sync, the UI has the wrong user.

How to reproduce

  1. Log into two Lexbox servers in FW Lite (e.g. staging as Tim, dev as Test Admin).
  2. Have the same project on both — same GUID, shared history (e.g. Sena 3 downloaded from staging, and the same GUID also present on dev).
  3. On the home page (Dictionaries list), let the project list refresh, then open the project.
  4. Open the comments UI. It shows the other server's user as "you".

Root cause

ProjectData.LastUserId / LastUserName is a single per-project field, but two flows write it without agreeing on which server the project actually belongs to:

  1. Home page clobbers it unscoped. CombinedProjectsService.UpdateProjectServerInfo looks the project up by GUID alone (CrdtProjectsService.GetProject(Guid)), so every logged-in server that happens to list a matching GUID stamps its own user onto the project — even a server that isn't the project's origin.
  2. Open races the background sync. Opening the project snapshots whatever value is currently persisted, while a background sync is concurrently resetting it, so the UI can render the stale/wrong identity.

Fix

  • Only the origin server stamps the user (ServerOwnsProject gate keyed on ServerId), so a non-origin server with a matching GUID no longer overwrites identity.
  • Resolve the origin server's signed-in user at project open, before the UI reads identity off the project context — using a cache-only MSAL read so it doesn't slow down open or hit the network.
  • Attribute synced comment read-status to the freshly-fetched user, falling back to the persisted last-known user.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with CombinedProjectsService.UpdateProjectServerInfo, CrdtProjectsService.GetProject(Guid), and ProjectData.LastUserId/LastUserName to trace how server identity is persisted. Then read the project-open flow and the ServerOwnsProject and cache-only MSAL paths described in the issue. Done means non-origin servers no longer overwrite identity, project open resolves the origin user's cached identity before UI rendering, and synced comment read-status uses that user with the persisted fallback.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, distributed-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.