From 9d475858ab66ccfcf34a535abc37b829ef97f34b Mon Sep 17 00:00:00 2001 From: Ashwin Kumar Sivakumar Date: Thu, 9 Jul 2026 23:41:49 +0530 Subject: [PATCH] fix(auth): default role assignment to APPROVED at signup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Roles assigned at registration are immediately active for login + session. Document/profile approval (handled separately by user_role_profiles in onboarding/verifications) is the correct gate for review workflows — do not gate raw role assignment on that flow. Previously defaulted to PENDING for non-demo accounts, which get filtered out by get_user_role_keys (WHERE status = 'APPROVED') and produced JWTs with empty roles, causing the 'role is not assigned' UX bug after login. --- apps/users/src/handlers/auth.rs | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/apps/users/src/handlers/auth.rs b/apps/users/src/handlers/auth.rs index cce3a4f..23702f6 100644 --- a/apps/users/src/handlers/auth.rs +++ b/apps/users/src/handlers/auth.rs @@ -330,14 +330,19 @@ async fn register( for role_key in role_candidates { let role_id = ensure_role_exists(&state.pool, &role_key).await; if let Some(role_id) = role_id { - // For demo accounts, auto-approve the role immediately - let status = if is_demo_account { "APPROVED" } else { "PENDING" }; - + // Roles assigned at signup are immediately ACTIVE for login + session. + // Document/profile review (handled separately in onboarding / verifications) + // still uses PENDING_APPROVAL via user_role_profiles — do NOT gate raw + // role assignment on that flow. Previously this defaulted to "PENDING" + // which made get_user_role_keys return [] and login issued a JWT with + // no role, breaking the "role not assigned" UX bug. + let status = "APPROVED"; + // Try to update existing assignment first let update_result = sqlx::query( r#" UPDATE user_role_assignments - SET status = $3 + SET status = $3, approved_at = NOW() WHERE user_id = $1 AND role_id = $2 "#, )