🎨 Pattern: How to authenticate session API calls without frontend userI...

Date: 2026-02-20
Time: 21:40:05 UTC
Session: gspace1-129.10
Agent: backend
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How to authenticate session API calls without frontend userId resolution timing issues?

Task: Eliminate auth timing dependency for session loading

🎯 Decision Made

Chosen:

JWT soft-auth endpoints (GET /sessions/my/active, /sessions/my/history) — backend decodes JWT, frontend sends nothing

Options Considered:

1. Resolve userId from AuthService signal with effect()
2. Use localStorage fallback userId
3. JWT soft-auth backend endpoints (chosen)

💭 Reasoning

AuthService.user() is a signal that starts null and populates after async JWT decode. Using it in constructor/queueMicrotask/effect causes timing failures — the userId isn't available when needed. Solution: add @Public() + @CurrentUser() endpoints where the backend's JwtAuthGuard decodes the token (automatically attached by frontend's authInterceptor). The frontend just calls GET /sessions/my/active with zero params — the JWT in the Authorization header identifies the user. This eliminates all auth timing dependencies on the frontend. Pattern: for any user-scoped API that needs to work during initialization, use JWT-based identity resolution on the backend, not signal-based resolution on the frontend.

📁 Files Involved

• apis/backend-ai-api/src/app/sessions/sessions.controller.ts
• libs/libs-ui/auth-ui/src/lib/interceptors/auth.interceptor.ts

🔗 Related

• Decision ID: dev_1771623605018_gzlq13e
• Session: 129
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation