fix(authentication-service): ensure JWT lastLogin reflects current login time #2410

piyushsinghgaur1 · 2026-02-09T10:23:08Z

user lastLogin detail will be a part of the response body

This pull request updates the process for recording and handling the user's last login time across the authentication service. The changes ensure that a consistent timestamp is used when updating the user's last login and that this timestamp is also set in the returned in response body .

Last Login will not be a part of the token instead it will be a part of the response body.

…gin time ensure JWT lastLogin reflects current login time GH-2402

Copilot

Pull request overview

Updates last-login tracking so the database update and JWT/user payload share the same captured timestamp for a login event.

Changes:

Add optional time parameter to UserRepository.updateLastLogin to support caller-provided timestamps.
Capture Date.now() once per login flow and reuse it for both persistence and response payload population.
Set payload.user.lastLogin during login flows to align with the recorded timestamp.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
services/authentication-service/src/services/idp-login.service.ts	Capture a single login timestamp, persist it, and set it on the returned payload user.
services/authentication-service/src/repositories/user.repository.ts	Allow `updateLastLogin` to accept a caller-provided timestamp (defaults to now).
services/authentication-service/src/modules/auth/controllers/login.controller.ts	Mirror the IDP login flow change: single captured timestamp used for DB + payload.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-09T10:23:58Z

services/authentication-service/src/services/idp-login.service.ts

-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);
+        payload.user.lastLogin = new Date(time);


updateLastLogin persists a numeric timestamp (ms since epoch), but the payload sets lastLogin to a Date object. When serialized into JWT/JSON this typically becomes an ISO string, which may diverge from existing clients expecting a number. Consider keeping payload.user.lastLogin the same type as what the API/JWT historically exposed (e.g., set it to time if consumers expect a number) or update the repository/model to store a Date consistently end-to-end.

Suggested change

payload.user.lastLogin = new Date(time);

payload.user.lastLogin = time;

Copilot · 2026-02-09T10:23:59Z

services/authentication-service/src/modules/auth/controllers/login.controller.ts

-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);
+        payload.user.lastLogin = new Date(time);


Same issue as in IdpLoginService: the DB update uses a millisecond timestamp while the payload assigns a Date. Align the payload lastLogin type with what downstream consumers expect (number vs Date/ISO string) to avoid subtle client/JWT compatibility breaks.

Suggested change

payload.user.lastLogin = new Date(time);

(payload.user as AnyObject).lastLogin = time;

Copilot · 2026-02-09T10:23:59Z

services/authentication-service/src/repositories/user.repository.ts

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


The new parameter name time is ambiguous (units and meaning). Consider renaming to something explicit like timeMs / timestampMs (or switching the parameter type to Date and naming it lastLoginAt) to reduce confusion and prevent accidental misuse.

Copilot · 2026-02-09T10:24:00Z

services/authentication-service/src/repositories/user.repository.ts

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


The new parameter name time is ambiguous (units and meaning). Consider renaming to something explicit like timeMs / timestampMs (or switching the parameter type to Date and naming it lastLoginAt) to reduce confusion and prevent accidental misuse.

samarpan-b · 2026-02-09T18:59:34Z

services/authentication-service/src/repositories/user.repository.ts

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


I disagree to this approach. We should not send the timestamp here. it should always remain Date.now. The issue is this timestamp is not provided into JWT correctly. We should only fix that.

This is for consistency that we store the "exact" same timestamp in the database and in the JWT token.

The issue is that if we do Date.now() inside this method and then again after or before calling this method, then the lastLogin field might be off by a few milliseconds.

@samarpan-b

I never said to do that twice

Now returning lastLogin as a part of the responseBody

fix trivy vulnerability GH-2402

samarpan-b · 2026-02-09T19:06:03Z

services/authentication-service/src/modules/auth/controllers/login.controller.ts

      ) {
-        await this.userRepo.updateLastLogin(payload.user.id);
+        const time = Date.now();
+        await this.userRepo.updateLastLogin(payload.user.id, time);


use the returned lastlogin timestamp from the method and update it into payload.

samarpan-b · 2026-02-09T19:14:43Z

services/authentication-service/src/repositories/user.repository.ts

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


return the new lastlogin time from this function

samarpan-b · 2026-02-09T19:16:07Z

services/authentication-service/src/repositories/user.repository.ts

      userId,
      {
-        lastLogin: Date.now(),
+        lastLogin: time ?? Date.now(),


return the new lastlogin time from this function

samarpan-b · 2026-02-10T11:56:00Z

services/authentication-service/src/repositories/user.repository.ts

  }

-  async updateLastLogin(userId: string): Promise<void> {
+  async updateLastLogin(userId: string, time?: number): Promise<void> {


I never said to do that twice

…rt of response gh-2402

sonarqubecloud · 2026-02-13T10:58:43Z

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

fix(authentication-service): ensure JWT lastLogin reflects current lo…

47563a0

…gin time ensure JWT lastLogin reflects current login time GH-2402

piyushsinghgaur1 self-assigned this Feb 9, 2026

piyushsinghgaur1 requested review from a team, Surbhi-sharma1 and yeshamavani as code owners February 9, 2026 10:23

Copilot AI review requested due to automatic review settings February 9, 2026 10:23

piyushsinghgaur1 linked an issue Feb 9, 2026 that may be closed by this pull request

authentication-service: lastLogin field not updated in JWT token on subsequent logins #2402

Open

Copilot AI reviewed Feb 9, 2026

View reviewed changes

muzammilsf approved these changes Feb 9, 2026

View reviewed changes

samarpan-b requested changes Feb 9, 2026

View reviewed changes

fix(sandbox): fix trivy vulnerability

1353dd7

fix trivy vulnerability GH-2402

vaibhavbhalla2505 force-pushed the GH-2402 branch from ed25de2 to 1353dd7 Compare February 10, 2026 05:37

samarpan-b requested changes Feb 11, 2026

View reviewed changes

fix(authentication-service): lastlogin date and time returned as a pa…

e5010cd

…rt of response gh-2402

	payload.user.lastLogin = new Date(time);
	payload.user.lastLogin = time;

	payload.user.lastLogin = new Date(time);
	(payload.user as AnyObject).lastLogin = time;

fix(authentication-service): ensure JWT lastLogin reflects current login time #2410

Are you sure you want to change the base?

fix(authentication-service): ensure JWT lastLogin reflects current login time #2410

Conversation

piyushsinghgaur1 commented Feb 9, 2026 • edited by yeshamavani Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 13, 2026

SonarQube reviewer guide

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

piyushsinghgaur1 commented Feb 9, 2026 •

edited by yeshamavani

Loading