fix(auth): confirm a missed session on the write host before 401ing (9893 root cause)

[edwh]

Follow-up to #1048 (merged). #1048 fixed the symptom — a stray 401 no longer wipes the whole session and forces a relogin. This fixes the root cause of the stray 401, which the adversarial review correctly flagged was left unaddressed.

Root cause

iznik-server-go/user/authMiddleware.go runs a per-request session-consistency check as a plain, replica-routed SELECT ... FROM sessions JOIN users. The session row is INSERTed on the write host at login (auth.CreateSessionAndJWT), so a Galera read replica can momentarily return zero rows right after login (apply lag). The middleware treats zero rows as an invalid session and overrides the response with a 401.

Right after login the ModTools client fires a burst of authenticated requests (chat poll, notification/work counts, …); any one landing in that replication window gets spuriously 401'd. On /session that still forces a logout even after #1048 — and each forced relogin mints a fresh session row, re-opening the window (the self-reinforcing loop heavy mods hit "several times a day").

Fix

On a zero-row miss, re-confirm the lookup against the write host before deciding the session is invalid:

if dbQueryErr == nil && userIdInDB.Id == 0 {
    result = db.Clauses(dbresolver.Write).Raw(q, sessionIdInJWT, userIdInJWT).Scan(&userIdInDB)
    dbQueryErr = result.Error
}

This is the same read-after-write pinning already used in authority/stats.go and ~10 message/chat sites. .Clauses(dbresolver.Write) is a documented no-op when no replica is configured. The happy path (session found on the replica) is unchanged and adds no extra query — only a genuine miss pays for the confirming read.

Testing

The race needs a lagging read replica, which the single-host test DB can't reproduce, so there's no new unit test; existing auth tests still cover the happy path (a valid session authenticates, and my change is a no-op there).

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for golden-caramel-d2c3a7 ready!

Name	Link
🔨 Latest commit	1d169e7
🔍 Latest deploy log	https://app.netlify.com/projects/golden-caramel-d2c3a7/deploys/6a554cd1dec3840007b28a7d
😎 Deploy Preview	https://deploy-preview-1055--golden-caramel-d2c3a7.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.