- Ya
- 22 Agosti 2026, 21:47 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 0fc3aff
Nothing in SecurityService has ever written users.last_login. The write lived in the retired AuthenticationService and was not carried over when authentication moved to the JDBC-only UserAuthenticationService, which reads and never writes. The column was therefore NULL for every user, and every surface showing it read "Never": the /account members and team-members grids, the member profile header chip, and the Login & Security tab. Nothing errored anywhere, because each layer behaves correctly for a null. Stamp it where the one-time key is minted rather than where the password is checked. The OTK is what actually hands the session to the browser, so a sign-in that stops at the second factor has proven a password, not an identity, and leaves no mark until the factor is met. Impersonation and enter-as deliberately do not stamp: those mint a session an administrator drives, and recording it as the member's own sign-in would put a login they never performed into an audit surface. /device/exchange is a background token refresh that also handles org switching, so stamping it would turn the value into "last time the phone phoned home". The value is LocalDateTime.toString() in UTC truncated to milliseconds, the offset-less shape app/lib/serverTime.ts already parses; the web side needed no change. Side effect worth knowing: this makes the placeholder gate in SecurityController real. It tests "never verified AND never signed in", and with last_login always NULL the second clause was always true, degenerating the check to !emailVerified alone. Existing rows stay NULL until each user next signs in. The logins were never recorded, so there is nothing to backfill from.