Repair Authentication & Authorization Failures

The likely defect is not one login bug but a contract split between token/session freshness and authorization freshness. I would trace identity generation from login through refresh, middleware, permission lookup, tenant scope, caches, and logout/revocation. The repair should establish one authoritative session/token generation, invalidate or version cached authorization when roles change, bind authorization to the current tenant/user identity, and make refresh/revocation transitions atomic from the application perspective. Focused tests should cover refresh while requests are in flight, role downgrade during an active session, logout followed by replay, stale cache entries, wrong-tenant identity, expired credentials, and concurrent tabs. I would preserve existing security policy and never “fix” this by extending token lifetime, skipping verification, or broadening permissions. Repository edits/tests would only be claimed if actually performed.