fix(authentication-service): ensure JWT lastLogin reflects current login time by piyushsinghgaur1 · Pull Request #2410 · sourcefuse/loopback4-microservice-catalog

piyushsinghgaur1 · 2026-02-09T10:23:08Z

user lastLogin detail will be a part of the response body

This pull request updates the process for recording and handling the user's last login time across the authentication service. The changes ensure that a consistent timestamp is used when updating the user's last login and that this timestamp is also set in the returned in response body .

Last Login will not be a part of the token instead it will be a part of the response body.

Copilot

Pull request overview

Updates last-login tracking so the database update and JWT/user payload share the same captured timestamp for a login event.

Changes:

Add optional time parameter to UserRepository.updateLastLogin to support caller-provided timestamps.
Capture Date.now() once per login flow and reuse it for both persistence and response payload population.
Set payload.user.lastLogin during login flows to align with the recorded timestamp.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
services/authentication-service/src/services/idp-login.service.ts	Capture a single login timestamp, persist it, and set it on the returned payload user.
services/authentication-service/src/repositories/user.repository.ts	Allow `updateLastLogin` to accept a caller-provided timestamp (defaults to now).
services/authentication-service/src/modules/auth/controllers/login.controller.ts	Mirror the IDP login flow change: single captured timestamp used for DB + payload.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-09T10:23:58Z

-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);
+        payload.user.lastLogin = new Date(time);


updateLastLogin persists a numeric timestamp (ms since epoch), but the payload sets lastLogin to a Date object. When serialized into JWT/JSON this typically becomes an ISO string, which may diverge from existing clients expecting a number. Consider keeping payload.user.lastLogin the same type as what the API/JWT historically exposed (e.g., set it to time if consumers expect a number) or update the repository/model to store a Date consistently end-to-end.

Suggested change

payload.user.lastLogin = new Date(time);

payload.user.lastLogin = time;

Copilot · 2026-02-09T10:23:59Z

-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);
+        payload.user.lastLogin = new Date(time);


Same issue as in IdpLoginService: the DB update uses a millisecond timestamp while the payload assigns a Date. Align the payload lastLogin type with what downstream consumers expect (number vs Date/ISO string) to avoid subtle client/JWT compatibility breaks.

Suggested change

payload.user.lastLogin = new Date(time);

(payload.user as AnyObject).lastLogin = time;

Copilot · 2026-02-09T10:23:59Z

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


The new parameter name time is ambiguous (units and meaning). Consider renaming to something explicit like timeMs / timestampMs (or switching the parameter type to Date and naming it lastLoginAt) to reduce confusion and prevent accidental misuse.

Copilot · 2026-02-09T10:24:00Z

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


The new parameter name time is ambiguous (units and meaning). Consider renaming to something explicit like timeMs / timestampMs (or switching the parameter type to Date and naming it lastLoginAt) to reduce confusion and prevent accidental misuse.

samarpan-b · 2026-02-09T18:59:34Z

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


I disagree to this approach. We should not send the timestamp here. it should always remain Date.now. The issue is this timestamp is not provided into JWT correctly. We should only fix that.

This is for consistency that we store the "exact" same timestamp in the database and in the JWT token.

The issue is that if we do Date.now() inside this method and then again after or before calling this method, then the lastLogin field might be off by a few milliseconds.

@samarpan-b

I never said to do that twice

Now returning lastLogin as a part of the responseBody

samarpan-b · 2026-02-09T19:06:03Z

      ) {
-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);


use the returned lastlogin timestamp from the method and update it into payload.

samarpan-b · 2026-02-09T19:14:43Z

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


return the new lastlogin time from this function

samarpan-b · 2026-02-09T19:16:07Z

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


return the new lastlogin time from this function

samarpan-b · 2026-02-10T11:56:00Z

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


I never said to do that twice

samarpan-b · 2026-02-13T15:08:50Z

Isn't this a breaking change now ?

…gin time ensure JWT lastLogin reflects current login time GH-2402

…rt of response gh-2402

samarpan-b · 2026-02-27T13:34:18Z

+      if (loginType === LoginType.ACCESS) {
+        lastLogin = Date.now();
+        await this.userRepo.updateLastLogin(user.id ?? '', lastLogin);
+      } else {
+        lastLogin = (await this.userRepo.findById(user.id ?? ''))?.lastLogin;
+      }


Whats happening here ?

if its first time login then its the current date and we update that in the DB else if its relogin then we just fetch that from DB
we dont update the lastlogin time in case of relogin during the same session
relogin as in - generating new token from refresh

samarpan-b · 2026-02-27T13:35:17Z

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


why is time paramter still here ?

since we are sending it from our service class - just to keep the exact same date and time in db and response.
await this.userRepo.updateLastLogin(user.id , lastLogin);

samarpan-b · 2026-02-27T13:35:38Z

        user: this.user,
      };

-      if (


why removed ?

handled in the service class

sonarqubecloud · 2026-03-05T11:49:35Z

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

piyushsinghgaur1 self-assigned this Feb 9, 2026

piyushsinghgaur1 requested review from a team, Surbhi-sharma1 and yeshamavani as code owners February 9, 2026 10:23

Copilot AI review requested due to automatic review settings February 9, 2026 10:23

piyushsinghgaur1 linked an issue Feb 9, 2026 that may be closed by this pull request

authentication-service: lastLogin field not updated in JWT token on subsequent logins #2402

Open

Copilot AI reviewed Feb 9, 2026

View reviewed changes

muzammilsf approved these changes Feb 9, 2026

View reviewed changes

samarpan-b requested changes Feb 9, 2026

View reviewed changes

vaibhavbhalla2505 force-pushed the GH-2402 branch from ed25de2 to 1353dd7 Compare February 10, 2026 05:37

samarpan-b requested changes Feb 11, 2026

View reviewed changes

vaibhavbhalla2505 force-pushed the GH-2402 branch from e5010cd to 952706e Compare February 19, 2026 06:23

Piyush Singh Gaur and others added 2 commits February 19, 2026 11:54

fix(authentication-service): ensure JWT lastLogin reflects current lo…

3a447f7

…gin time ensure JWT lastLogin reflects current login time GH-2402

fix(authentication-service): lastlogin date and time returned as a pa…

30eeede

…rt of response gh-2402

vaibhavbhalla2505 force-pushed the GH-2402 branch from 952706e to 30eeede Compare February 19, 2026 06:24

samarpan-b requested changes Feb 27, 2026

View reviewed changes

Merge branch 'master' into GH-2402

e5df9ee

	payload.user.lastLogin = new Date(time);
	payload.user.lastLogin = time;

	payload.user.lastLogin = new Date(time);
	(payload.user as AnyObject).lastLogin = time;

Conversation

piyushsinghgaur1 commented Feb 9, 2026 • edited by yeshamavani Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

samarpan-b commented Feb 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Mar 5, 2026

SonarQube reviewer guide

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

piyushsinghgaur1 commented Feb 9, 2026 •

edited by yeshamavani

Loading