Permission for logged user are not resolved correcty.

[jorgeltd]

Describe the bug

There is a race condition in the user authentication pipeline on the frontend. There is a small chance that the request querying permissions for the logged-in user is fired before the authentication token is saved in the browser store. As a consequence, a logged-in user will not see options subject to restrictions. This is especially evident for an admin user, where options will be missing in the sidebar and menu sections.

For example, when the admin options are missing on the sidebar in a local environment, this is the request sent to the backend:

GET /server/api/authz/authorizations/search/objects?type=core.site&uuid=46694973-771e-437f-a993-4f17f8f3dd8a&feature=administratorOf&feature=isCommunityAdmin&feature=isCollectionAdmin&feature=epersonRegistration&feature=canManageGroups&feature=canViewUsageStatistics&feature=canViewLoginStatistics&feature=canViewWorkflowStatistics&feature=canSendFeedback&feature=canEditItem&feature=epersonForgotPassword&feature=canCorrectItem&feature=canSubmit&feature=coarNotifyEnabled&feature=canSeeQA&feature=isComColAdmin&embed=object&embed=feature HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: application/json, text/plain, */*
Accept-Language: en;q=1,en;q=0.1,en-US;q=0.09,es;q=0.08
Accept-Encoding: gzip, deflate, br, zstd
Content-Type: application/json; charset=utf-8
X-CORRELATION-ID: b2681d90-2789-4fc4-9e35-be6a9b1ffa9c
X-REFERRER: /
Origin: http://localhost:4000
Sec-GPC: 1
Connection: keep-alive
Referer: http://localhost:4000/
Cookie: JSESSIONID=214AA5F34742FBC3F00265A6B88B5DD2; DSPACE-XSRF-COOKIE=8e492cea-59c4-4c01-b7a8-b3a1276b8dcf; orejime-anonymous={"authentication":true,"preferences":true,"acknowledgement":true,"correlation-id":true,"accessibility":true,"plumX":true,"altmetric":true,"dimensions":true,"google-recaptcha-registration":true,"google-recaptcha":true}; CORRELATION-ID=b2681d90-2789-4fc4-9e35-be6a9b1ffa9c; orejime-da296ea6-53d6-4a37-98a0-c4cfb68aa528={%22authentication%22:true%2C%22preferences%22:true%2C%22acknowledgement%22:true%2C%22plumX%22:true%2C%22altmetric%22:true%2C%22dimensions%22:true%2C%22accessibility%22:true%2C%22correlation-id%22:true%2C%22google-recaptcha-registration%22:true%2C%22google-recaptcha%22:true}; dsAuthInfo={%22accessToken%22:%22eyJhbGciOiJIUzI1NiJ9.eyJlaWQiOiJkYTI5NmVhNi01M2Q2LTRhMzctOThhMC1jNGNmYjY4YWE1MjgiLCJzZyI6W10sImV4cCI6MTc4ODM2NDE0MywiYXV0aGVudGljYXRpb25NZXMethod2OiJwYXNzd29yZCIsInVzZXJBZ3JlZW1lbnRBY2NlcHRlZCI6InRydWUiLCJtYWNoaW5lIjpmYWxzZX0.eFloG-8JX2F3XlgsqN6w7asuEdMsTFTf3pnab_SHFN4%22%2C%22expires%22:1788364143000}; XSRF-TOKEN=8e492cea-59c4-4c01-b7a8-b3a1276b8dcf
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

The backend only responds with the correct permissions if the authorization header is present; otherwise, it defaults to anonymous permissions.

To Reproduce

Steps to reproduce the behavior:

1. As an admin user, authenticate using the login box on the home page.
2. There is a small chance that the admin options in the sidebar and menu sections (like statistics) will be missing.
3. If not, press F5 until options are missing from the sidebar.

Expected behavior

No options should be missing when an admin or admin-like user logs in or reloads the page.