JWT username claims become stale after profile renames and corrupt follow analytics

[Ridanshi]

Summary

JWT tokens contain username-based claims that are not refreshed when users rename their profiles.

Operations relying on those claims continue using outdated usernames.

Affected Files

• auth.ts
• follow.ts
• analytics.ts

Root Cause

Username information is embedded into JWT payloads.

When a username changes, existing sessions continue operating with stale claim values until reauthentication occurs.

Reproduction

1. Log in.
2. Rename the account username.
3. Continue using the existing session.
4. Perform follow operations.
5. Inspect analytics records.
6. Observe outdated usernames being recorded.

Expected Behavior

Operations should use current user identity information.

Actual Behavior

Stale usernames continue propagating through follow and analytics workflows.

Why This Is Difficult To Detect

Most testing uses freshly issued tokens.

The issue appears only after profile updates.

Production Impact

• Corrupted analytics
• Inconsistent records
• Follow tracking inaccuracies
• Identity confusion

Suggested Fix

Use immutable user identifiers for analytics and follow relationships.

Severity

Medium-High

[Ridanshi]

I investigated this issue and would like to work on it.

The current identity flow appears to rely on mutable username information embedded in JWT claims.

I plan to:

• review identity propagation logic
• replace mutable identifiers where appropriate
• preserve existing authentication behavior
• add regression coverage for profile rename scenarios

Please assign this issue to me.