Repository: goauthentik/authentik
File: web/src/elements/mixins/session.ts (TypeScript)

Code before:
                context: AuthentikConfigContext,
                subscribe,
            })
            public readonly [kAKConfig]!: Readonly<Config>;

            @consume({
                context: LocaleContext,
                subscribe,
            })
            public [kAKLocale]!: LocaleContextValue;

            #uiConfig: Readonly<UIConfig> = DefaultUIConfig;

            @consume({
                context: SessionContext,
            })
            @property({ attribute: false })
            public session!: APIResult<Readonly<SessionUser>>;

            //#endregion

            //#region Properties

            public get uiConfig(): Readonly<UIConfig> {
                return this.#uiConfig;
            }

            public get currentUser(): Readonly<UserSelf> | null {
                return (isAPIResultReady(this.session) && this.session.user) || null;
            }

            public get originalUser(): Readonly<UserSelf> | null {
                return (isAPIResultReady(this.session) && this.session.original) || null;
            }

            public get impersonating(): boolean {
                return !!this.originalUser;
            }

            //#endregion

            //#region Methods

            public async refreshSession(): Promise<SessionUser | null> {
                this.#logger.debug("Fetching session...");
                const nextResult = await this.#contextController?.refresh();

                if (!isAPIResultReady(nextResult)) {
                    return null;
                }


Review comment (security):
@kensternberg-authentik After a few rounds of testing I can confirm that `useDefault: true` without `reflect` appears to have a desired effect, preventing the host's `updated` callback from invoking on the first render.

Code after:
        SuperClass,
        subscribe = true,
    }) => {
        abstract class SessionProvider extends SuperClass implements SessionMixin {
            #logger = ConsoleLogger.prefix("session");
            #contextController = ContextControllerRegistry.get(SessionContext);

            //#region Context Consumers

            @consume({
                context: AuthentikConfigContext,
                subscribe,
            })
            public readonly [kAKConfig]!: Readonly<Config>;

            @consume({
                context: LocaleContext,
                subscribe,
            })
            public [kAKLocale]!: LocaleContextValue;

            @consume({
                context: UIConfigContext,
                subscribe,
            })
            @property({ attribute: false, useDefault: true })
            public uiConfig: Readonly<UIConfig> = {
                // Debugging symbol to identify default config in the element lifecycle.
                [Symbol.for("ak-default-brand")]: true,
                ...DefaultUIConfig,
            };

            @consume({
                context: SessionContext,
            })
            @property({ attribute: false })
            public session!: APIResult<Readonly<SessionUser>>;

            //#endregion

            //#region Properties

            public get currentUser(): Readonly<UserSelf> | null {
                return (isAPIResultReady(this.session) && this.session.user) || null;
            }

            public get originalUser(): Readonly<UserSelf> | null {
                return (isAPIResultReady(this.session) && this.session.original) || null;
            }

            public get impersonating(): boolean {