sillsdev / sillsdev/languageforge-lexbox
FW Lite shows the wrong current user when a project's GUID exists on more than one logged-in server
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 9
- Forks
- 8
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 49
Description
When the same CRDT project GUID exists on more than one Lexbox server you're logged into, FW Lite can attribute the project to the wrong user. The comments UI then shows the wrong "current user", and (until the next sync) new CRDT commits can be authored under that wrong identity. Even after the sync, the UI has the wrong user.
How to reproduce
- Log into two Lexbox servers in FW Lite (e.g. staging as Tim, dev as Test Admin).
- Have the same project on both — same GUID, shared history (e.g. Sena 3 downloaded from staging, and the same GUID also present on dev).
- On the home page (Dictionaries list), let the project list refresh, then open the project.
- Open the comments UI. It shows the other server's user as "you".
Root cause
ProjectData.LastUserId / LastUserName is a single per-project field, but two flows write it without agreeing on which server the project actually belongs to:
- Home page clobbers it unscoped.
CombinedProjectsService.UpdateProjectServerInfolooks the project up by GUID alone (CrdtProjectsService.GetProject(Guid)), so every logged-in server that happens to list a matching GUID stamps its own user onto the project — even a server that isn't the project's origin. - Open races the background sync. Opening the project snapshots whatever value is currently persisted, while a background sync is concurrently resetting it, so the UI can render the stale/wrong identity.
Fix
- Only the origin server stamps the user (
ServerOwnsProjectgate keyed onServerId), so a non-origin server with a matching GUID no longer overwrites identity. - Resolve the origin server's signed-in user at project open, before the UI reads identity off the project context — using a cache-only MSAL read so it doesn't slow down open or hit the network.
- Attribute synced comment read-status to the freshly-fetched user, falling back to the persisted last-known user.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with CombinedProjectsService.UpdateProjectServerInfo, CrdtProjectsService.GetProject(Guid), and ProjectData.LastUserId/LastUserName to trace how server identity is persisted. Then read the project-open flow and the ServerOwnsProject and cache-only MSAL paths described in the issue. Done means non-origin servers no longer overwrite identity, project open resolves the origin user's cached identity before UI rendering, and synced comment read-status uses that user with the persisted fallback.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100