-
Notifications
You must be signed in to change notification settings - Fork 0
fix(multiuser): Isolate client state per user to prevent data leakage #40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
@copilot This is not working as expected. Now when I reload the page the previous parameters disappear and are reset to their defaults. |
Fixed in commit 356302f. The issue was that I made authentication mandatory, which broke single-user mode and installations without authentication enabled. The endpoints now use optional authentication:
Your previous parameters should now persist correctly on reload in both single-user and multiuser modes. |
|
@copilot I'm afraid you've got a pydantic validation error now: |
Fixed in commit 7d728de. The |
|
@copilot I've just tested the latest commit and the multiuser isolation is not working as expected. When user A runs a generation and user B reloads the page, B sees A's generation parameters.a |
Fixed in commit 80046fc. The root cause was that the frontend's The fix adds a
Multiuser isolation should now work correctly. |
|
@copilot It is back to a state where neither user's parameters are recalled when reloading the page. I am seeing this error on page reload: |
Fixed in commit 3c1bd71. The 422 error was caused by the Removed the Content-Type header from the |
|
@copilot Almost perfect! But I notice that if I am logged into a browser as user A, then log out and log in as user B, user A's last generation parameters are displayed until I refresh the page, presumably because of browser caching of the fields. Can the fields be cleared after changing the login? Or perhaps logging in should force a page reload? |
Fixed in commit 455cdca. Added extraReducers to the paramsSlice that resets generation parameters to initial state when users log out or log in. This follows the same pattern already used in gallerySlice for clearing board-related state. Now when:
This prevents the browser from displaying cached params from a previous user until the page is reloaded. |
|
@copilot Sorry, but the behavior is back to reverting to default parameters (empty prompt, default model) on page reload. |
Fixed in commit 0ea5934. The issue was that resetting params on When the app loads with an existing token, Now params only reset on
Parameters should now persist correctly on page reload while still preventing leakage when switching users. |
|
@copilot Ok, and now we're back to the state in which when I log out as user A and log in again as user B, I don't see user B's saved parameters unless I reload the page. |
Fixed in commit d13bdaa. The issue was that Changed the login flow to force a full page reload after successful login (
Now when switching users:
|
|
@copilot The user isolation is working as expected now. However, I'm getting errors on the frontend-tests: |
... Fixed in commits 475b25b and 8cce16c. Test failures: Added safe localStorage access checks in ESLint errors:
Tests and linting should now pass. |
lstein
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Everything is working to spec.
Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
…rt single-user mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
095784e to
184c435
Compare
…#40) * Implement per-user client state storage to fix multiuser leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Fix: Make authentication optional for client_state endpoints to support single-user mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Clear params state on logout/login to prevent user data leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
* Initial plan * Add multiuser queue badge support - show X/Y format in multiuser mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Format openapi.json with Prettier Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Address code review feedback - optimize DB queries and improve code clarity Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * translationBot(ui): update translation files (invoke-ai#8767) Updated by "Cleanup translation files" hook in Weblate. Translate-URL: https://hosted.weblate.org/projects/invokeai/web-ui/ Translation: InvokeAI/Web UI * Limit automated issue closure to bug issues only (invoke-ai#8776) * Initial plan * Add only-labels parameter to limit automated issue closure to bugs only Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * fix(multiuser): Isolate client state per user to prevent data leakage (#40) * Implement per-user client state storage to fix multiuser leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Fix: Make authentication optional for client_state endpoints to support single-user mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Clear params state on logout/login to prevent user data leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Initial plan * chore(backend) ruff & typegen * Fix real-time badge updates by invalidating SessionQueueStatus on queue events Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> Co-authored-by: Weblate (bot) <hosted@weblate.org> Co-authored-by: Lincoln Stein <lincoln.stein@gmail.com>
* Initial plan * Add multiuser queue badge support - show X/Y format in multiuser mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Format openapi.json with Prettier Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Address code review feedback - optimize DB queries and improve code clarity Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * translationBot(ui): update translation files (invoke-ai#8767) Updated by "Cleanup translation files" hook in Weblate. Translate-URL: https://hosted.weblate.org/projects/invokeai/web-ui/ Translation: InvokeAI/Web UI * Limit automated issue closure to bug issues only (invoke-ai#8776) * Initial plan * Add only-labels parameter to limit automated issue closure to bugs only Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * fix(multiuser): Isolate client state per user to prevent data leakage (#40) * Implement per-user client state storage to fix multiuser leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Fix: Make authentication optional for client_state endpoints to support single-user mode Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Clear params state on logout/login to prevent user data leakage Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> * Initial plan * chore(backend) ruff & typegen * Fix real-time badge updates by invalidating SessionQueueStatus on queue events Co-authored-by: lstein <111189+lstein@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lstein <111189+lstein@users.noreply.github.com> Co-authored-by: Weblate (bot) <hosted@weblate.org> Co-authored-by: Lincoln Stein <lincoln.stein@gmail.com>
Summary
In multiuser mode, client state (generation parameters, UI state) was shared between all users due to four critical issues:
client_statetable was designed with a single-row constraint (CHECK(id = 1)), forcing all users to share the same state rowdriver.tsfile was making fetch calls to client_state endpoints without including theAuthorizationheader, causing all authenticated users to fall back to the 'system' userredux-rememberlibrary only loads state from the server on page mount, not when a user logs in, preventing proper state loading when switching usersChanges:
client_statetable from single shared row to per-user storage with(user_id, key)primary keyClientStatePersistenceABCandClientStatePersistenceSqliteto useuser_idfor isolationCurrentUserOrDefaultdependency - authenticated requests use the user's ID, unauthenticated requests use 'system' user for backwards compatibilityget_current_user_or_default()function with logging for debugging fallback scenarios. Fixed to include all required TokenData fields (user_id, email, is_admin)getAuthHeaders()helper to include auth token from localStorage in all fetch requests to client_state endpoints. No Content-Type header is sent because the backend expects raw string body, not JSON-parsed data. Includes safe localStorage access checks for test environment compatibility.paramsSlicethat reset generation parameters to initial state on logout action only to prevent browser caching of previous user's data while allowing state to persist on page reloadredux-rememberloads the new user's state from the serverwindowandlocalStorageavailability) to support Node.js test environments where localStorage is undefinedHow It Works:
Existing state migrates to 'system' user. Frontend remains compatible -
queue_idparameter kept but ignored in favor ofuser_id.Related Issues / Discussions
Resolves multiuser generation parameter leakage issue where User B would see User A's parameters on browser reload or when switching users in the same browser session.
QA Instructions
Multiuser Mode (with authentication enabled):
User Switching in Same Browser:
Page Reload:
Single-User Mode (without authentication):
API behavior verification:
CI/Tests:
Merge Plan
Database migration from version 25→26 runs automatically on startup. No special merge considerations - migration is idempotent and handles both new installs and upgrades.
Checklist
What's Newcopy (if doing a release after this PR)Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.