Follow the development progress of our Authentication &amp; Authorizations module:

Backlog

Next up

In Progress

Done

Pending Discussion

Auth N-Z Roadmap

In the current implementation, every time we have to upsert a privilege or retrieve a role by lookupKey, we call the method retrieveStorageContextByCode provided by the RolesService (microservice). This method perform the following steps:<ol><li>retrieve the role identified by lookupKey</li><li>if the role has extendedRoleIds, it performs an additional query for each extended role id</li><li>if the extended role has extendedRoleIds, repeat step 2 and 3 (recursion)</li></ol><blockquote>Note: steps 2 and 3 are executed sequentially</blockquote>Currently the max depth for extended roles is 2:<pre><code>organization-admin/owner → space-supervisor → space-folder, course-observer</code></pre>This means executing up to 2 queries for each extended role.<img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/680a601e6d243d52f3cb96a6/01966887-5a35-7eb2-909b-cc5f76542d9f/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/680a601e6d243d52f3cb96a6/01966887-5a35-7eb2-909b-cc5f76542d9f/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=c7e73283e7cf1cbf87ec44f44fffe2eb11759ccbc90bd6ebbc759f7d751bd8f7" data-featurebase-content-filename="image.png">In order to avoid this amount of queries, we can refactor the method by leveraging population ($lookup). This way we will perform a single query.<img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/680a601e6d243d52f3cb96a6/0196687f-2276-7e57-8267-e3f8b27952f6/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/680a601e6d243d52f3cb96a6/0196687f-2276-7e57-8267-e3f8b27952f6/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=46ffdbb1981418f86393163ca49886a54b83b38ed4f2f9867f3134ddfa6f97c3" data-featurebase-content-filename="image.png"><blockquote>Note: if we want to support more than 2 levels of inheritance, we can adjust the method like this:<ol><li>retrieve role and populate up to the second level</li><li>if second-level roles have extendedRoleIds, collect role ids and repeat step 1 on them (using find instead of findOne)</li><li>repeat until second-level roles have no extendedRoleIds</li></ol></blockquote>

Completed

High Priority

Refactor RolesService retrieveStorageContextByCode

Ivan Ligotino

Objective: Evaluate the usability, functionality, and overall user experience of the "Auth" domain through key user journeys, identifying potential pain points or areas of improvement.Scope: This test focuses on how users interact with their Auth domain. Test File: <code>tests/domains/auth/main.spec.ts</code> Key User Journeys to Test: User Profile - [Flow: Code Verification after registration via email] - [Flow: Forgot Password internally]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/84dfb1e3-54d4-4ce9-8880-a7a0b9599b87/Forgot%20Password%20-%20Internally.webm">https://sharing.clickup.com/clip/p/t9004002740/84dfb1e3-54d4-4ce9-8880-a7a0b9599b87/Forgot%20Password%20-%20Internally.webm</a> - [Flow: Forgot Password externally]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/999e370a-86d2-4507-b69f-673062b1932f/Forgot%20Password%20-%20Externally.webm">https://sharing.clickup.com/clip/p/t9004002740/999e370a-86d2-4507-b69f-673062b1932f/Forgot%20Password%20-%20Externally.webm</a> - [Flow: Creating and updating, and deleting webhook]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm">https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm</a> - [Flow: Connect with feature base]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/9e47fc80-d66c-4f83-a31a-3c30c78130dc/screen-recording-2025-05-05-15%3A49.webm">https://sharing.clickup.com/clip/p/t9004002740/9e47fc80-d66c-4f83-a31a-3c30c78130dc/screen-recording-2025-05-05-15%3A49.webm</a> Organization Profile - [Flow: Create Organization]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/56da0682-5c18-44e5-ac79-89e418b57888/Create%20Organization.webm">https://sharing.clickup.com/clip/p/t9004002740/56da0682-5c18-44e5-ac79-89e418b57888/Create%20Organization.webm</a> - [Flow: Creating and updating, and deleting webhook]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm">https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm</a> - [Flow: Creating and updating, and deleting api token]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/7ad6af27-3282-4fb5-b767-27373b22a921/screen-recording-2025-05-05-15%3A57.webm">https://sharing.clickup.com/clip/p/t9004002740/7ad6af27-3282-4fb5-b767-27373b22a921/screen-recording-2025-05-05-15%3A57.webm</a>- [Flow: Delete the Organization]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/9d27ab2c-878c-4d82-b998-1a1268648df7/Delete%20Organization.webm">https://sharing.clickup.com/clip/p/t9004002740/9d27ab2c-878c-4d82-b998-1a1268648df7/Delete%20Organization.webm</a>

Obiettivo: valutare l'usabilità, la funzionalità e l'esperienza complessiva dell'utente del dominio "Auth" attraverso i percorsi chiave degli utenti, identificando potenziali punti critici o aree di miglioramento.Ambito: questo test si concentra sul modo in cui gli utenti interagiscono con il loro dominio Auth. File di test: <code>tests/domains/auth/main.spec.ts</code> Percorsi chiave degli utenti da testare: Profilo utente - [Flusso: verifica del codice dopo la registrazione tramite e-mail] - [Flusso: password dimenticata internamente]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/84dfb1e3-54d4-4ce9-8880-a7a0b9599b87/Forgot%20Password%20-%20Internally.webm">https://sharing.clickup.com/clip/p/t9004002740/84dfb1e3-54d4-4ce9-8880-a7a0b9599b87/Forgot%20Password%20-%20Internally.webm</a> - [Flusso: Password dimenticata esternamente]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/999e370a-86d2-4507-b69f-673062b1932f/Forgot%20Password%20-%20Externally.webm">https://sharing.clickup.com/clip/p/t9004002740/999e370a-86d2-4507-b69f-673062b1932f/Forgot%20Password%20-%20Externally.webm</a> - [Flusso: creazione, aggiornamento ed eliminazione di webhook]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm">https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm</a> - [Flusso: connessione con la base delle funzionalità]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/9e47fc80-d66c-4f83-a31a-3c30c78130dc/screen-recording-2025-05-05-15%3A49.webm">https://sharing.clickup.com/clip/p/t9004002740/9e47fc80-d66c-4f83-a31a-3c30c78130dc/screen-recording-2025-05-05-15%3A49.webm</a> Profilo dell'organizzazione - [Flusso: Crea organizzazione]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/56da0682-5c18-44e5-ac79-89e418b57888/Create%20Organization.webm">https://sharing.clickup.com/clip/p/t9004002740/56da0682-5c18-44e5-ac79-89e418b57888/Create%20Organization.webm</a> - [Flusso: Creazione, aggiornamento ed eliminazione di webhook]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm">https://sharing.clickup.com/clip/p/t9004002740/b81b35c7-dd8d-4f9d-adec-4a6fe443ec14/Webhook.webm</a> - [Flusso: creazione, aggiornamento ed eliminazione di token API]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/7ad6af27-3282-4fb5-b767-27373b22a921/screen-recording-2025-05-05-15%3A57.webm">https://sharing.clickup.com/clip/p/t9004002740/7ad6af27-3282-4fb5-b767-27373b22a921/screen-recording-2025-05-05-15%3A57.webm</a>- [Flusso: eliminazione dell'organizzazione]<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://sharing.clickup.com/clip/p/t9004002740/9d27ab2c-878c-4d82-b998-1a1268648df7/Delete%20Organization.webm">https://sharing.clickup.com/clip/p/t9004002740/9d27ab2c-878c-4d82-b998-1a1268648df7/Delete%20Organization.webm</a>

Dominio autore drammaturgo – Test del percorso utente n. 2

Playwright Auth Domain – User Journey Testing #2

Mattia Vaccari

Whenever a user is created, we’re creating default roles like social, billing manager, and developer roles. I don’t think that’s necessary. If every user gets all roles by default, then assigning roles per user becomes redundant. Removing this can improve the overall codebase. The reason we added those default roles was to ensure all users can pass the ScopeAbilityGuard, since having the role allows access. But that guard is meant to be used in organization context mode, where it checks if the user has a role within a specific organization. Instead, we can keep the guard and update our logic to check <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://request.params.id">request.params.id</a>. If that ID is not defined and the user is not in organization mode, we can simply return true, instead of checking whether the user has roles like Social, Billing Manager, or Developer which is unnecessary if everyone has them by default. this will improve performance by avoiding the need to call <code>this.abilityFactory.defineAbility(user, resource)</code> every time we send a request to endpoints guarded by <code>ScopeAbilityGuard.</code>

Low Priority

Scope Ablity improvement

tadael shewarega

We have introduced a new feature to improve security and streamline the experience when switching between user and organization contexts. Whenever a user switches context from user to organization or vice versa, the system will now automatically remove any older tokens associated with the previous context. This ensures that only valid tokens are active at any given time, thereby reducing potential security risks associated with token leakage or misuse. Additionally, for course creation functionality, we have implemented a default API key for both individual users and organizations. This API key will be used automatically during the AI course creation process, simplifying the process for users and ensuring consistent access to necessary features.

Abbiamo introdotto una nuova funzionalità per migliorare la sicurezza e semplificare l'esperienza quando si passa dal contesto utente a quello organizzazione e viceversa. Ogni volta che un utente passa dal contesto utente a quello organizzazione o viceversa, il sistema rimuove automaticamente tutti i token precedenti associati al contesto precedente. Ciò garantisce che solo i token validi siano attivi in un dato momento, riducendo così i potenziali rischi per la sicurezza associati alla fuga o all'uso improprio dei token. Inoltre, per la funzionalità di creazione dei corsi, abbiamo implementato una chiave API predefinita sia per i singoli utenti che per le organizzazioni. Questa chiave API verrà utilizzata automaticamente durante il processo di creazione dei corsi AI, semplificando il processo per gli utenti e garantendo un accesso coerente alle funzionalità necessarie.

Rimuovere i token obsoleti durante il cambio di contesto e utilizzare la chiave API per la creazione di corsi tramite IA

Remove Old Tokens During Context Switch and Use API Key for Course Creation using AI

Piyush Patel

owner can not remove the supervisor from the space

Org owner access to remove supervisors

Mahyar Bahari

<ul><li>We need to extend the list of prohibited words even when creating user names.</li></ul><img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/6876621523660fb11a5211c3/01980e5c-e0bc-7367-8dcc-aa6eab336b34/b64u-MjAyNS0wNy0xNV8xNS01Mi5qcGVn.jpeg" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/6876621523660fb11a5211c3/01980e5c-e0bc-7367-8dcc-aa6eab336b34/b64u-MjAyNS0wNy0xNV8xNS01Mi5qcGVn.jpeg?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=66f680f70bdd7ae11d412756f4c9c24f1ac7b70f2b55df9a26da7f41baed5914" data-featurebase-content-filename="2025-07-15_15-52.jpeg">

Add banned user names list

Daniele Cosentino

Optimize the Auth domain

I am experiencing a strange behavior in login with google. After logging in with Google, the pop up for fast login with Google does not stay there until I close it or accept it. I have attached a video demonstrating the issue: https://sharing.clickup.com/clip/p/t9004002740/cd0d7232-0b76-4a69-8aba-fc468322bc3f/google%20pop%20up%2C%20dot%20disappear%20after%20google%20login.webm

Google fast login pop-up disappears after login

A <code>TypeError</code> is occurring when a user profile undergoes content moderation. This task involves identifying the root cause of the error, such as improper data handling, missing fields, or unexpected input types during the moderation process. Fix the issue and ensure robust error handling is implemented to prevent similar problems in the future. Add tests to validate the fix and verify that moderation continues to work correctly without throwing errors. <img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/68490a96dff123667acb2129/01975d4f-15e0-7baa-87f0-d391ec443f9f/b64u-MjAyNS0wNi0xMF8xNS01M18xLnBuZw.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/68490a96dff123667acb2129/01975d4f-15e0-7baa-87f0-d391ec443f9f/b64u-MjAyNS0wNi0xMF8xNS01M18xLnBuZw.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=989fc6ff7ac0f2d12566c4a2fdd4c91c31a0371998655daf6f2648939cfcaad4" data-featurebase-content-filename="2025-06-10_15-53_1.png">

Investigate and Fix TypeError During Profile Moderation

When we cache user documents by ID, we use a key based on an object like <code>{ filter: { _id: "ObjectId" } }</code> <img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/682ef0e6f7e7d4c248767134/0196f756-6b70-7834-853f-69c60665aefc/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/682ef0e6f7e7d4c248767134/0196f756-6b70-7834-853f-69c60665aefc/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=a98ac08793d9a569ac34a996d07c9fe87922b489571ed5271771eeb9985eec54" data-featurebase-content-filename="image.png">Then, during the login request, we attempt to invalidate the cached user by calling <code>BaseRepository.invalidateCacheById</code>, which internally triggers <code>invalidateCacheByFilterId</code> asynchronously.<img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/682ef0e6f7e7d4c248767134/0196f75c-7203-77e9-8649-596eeff54528/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/682ef0e6f7e7d4c248767134/0196f75c-7203-77e9-8649-596eeff54528/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=e0d6132440212f5d39c31ff6b0c44c9f0d1cfb9f754f875ab3a41f3ccc8768d4" data-featurebase-content-filename="image.png"><img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/682ef0e6f7e7d4c248767134/0196f756-a5b5-70ce-ab63-96b05e8e5ced/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/682ef0e6f7e7d4c248767134/0196f756-a5b5-70ce-ab63-96b05e8e5ced/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=47fff0b1c7fd185014bb4708130752d87e77f5fd09380586f92e20e069668bb0" data-featurebase-content-filename="image.png"> As a result, in some cases, the next request in the test scenario might be executed before <code>invalidateCacheByFilterId</code> has completed. This leads to the user being retrieved from the cache instead of the database, causing the Unauthorized issue reported by many CI/CD executions — specifically, the cached user does not contain the token returned during login. <img data-width="100%" data-align="left" data-featurebase-content-key="67d92e38ed4a743bbba6fa42/post/682ef0e6f7e7d4c248767134/0196f759-c9ec-79db-ab27-6af10bc9cbba/b64u-aW1hZ2UucG5n.png" src="https://67d92e38ed4a743bbba6fa42.featurebase-attachments.com/c/post/682ef0e6f7e7d4c248767134/0196f759-c9ec-79db-ab27-6af10bc9cbba/b64u-aW1hZ2UucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260401T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260401%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=d6275a4a4f09fe7890cdff3f539c8676ee5b82ea3b5f3a3eecd6aedee54c0827" data-featurebase-content-filename="image.png">

Aladia

Auth N-Z Roadmap