v0.5.4: fix isolation — resolveUser syncs activeClientId from session

2026-06-02 11:11:20 +03:00
parent 1b1b3b6bd7
commit 8ab2271ff9
2 changed files with 6 additions and 2 deletions
@@ -52,7 +52,11 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
      if (!payload) throw new Error('empty payload');
      const rawClientId = payload.ClientID || payload.clientId || payload.sub || '';
      const allClientIds = rawClientId.split(',').map(s => s.trim()).filter(Boolean);
-      const activeClientId = allClientIds[0] || rawClientId;
+      // activeClientId из сессии (переключатель компании) или первая из токена
+      const sessionActive = req.session && req.session.user && req.session.user.activeClientId;
+      const activeClientId = (sessionActive && allClientIds.includes(sessionActive))
+        ? sessionActive
+        : (allClientIds[0] || rawClientId);

      req.user = {
        clientId:       rawClientId,