You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Fixed
Group membership changes (PUT/DELETE /api/group/:group/:uid) didn't invalidate the User cache, so isServiceAccount (and anything else derived from memberOf) could stay stale for up to 5 minutes after a change. This is what caused a real "lost user" report — the account had landed in app_sso_service_account (which users.ejs's People tab filters out entirely) and looked exactly like data loss, though nothing was ever deleted.
Added
A confirmation before adding anyone to app_sso_service_account via the Groups page — that group's whole purpose is to hide an account from the People tab, and there was no guardrail against doing that to a real person by mistake (which is how the bug above happened). Every other group's add-member flow is unchanged.
