Bug 2047912 - Fix - Auth token refresh demoting users by davidmiculit · Pull Request #9614 · mozilla/treeherder

davidmiculit · 2026-06-16T11:56:00Z

The problem:

User gets demoted from "is_staff: true" on token refresh because the groups claim is missing from renewals
The session continues with user logged in with "is_staff: false" and the UI showing "You must be logged into perfherder/treeherder and be a sheriff to make changes"

Proposed fix:

In the case of a token refresh, which doesn't carry the groups claim, keep the user's current permissions granted when logging in

…ermissions

davidmiculit added 2 commits June 16, 2026 14:46

fix: if groups claim is not present at renewal, preserve the user's p…

4445ef1

…ermissions

fix: verify the claim existence differently

ef4eb6e

Provide feedback