From 64e772e32d8c8dd41a02c33be3427caa3fa1f23e Mon Sep 17 00:00:00 2001
From: dadachann <185672915+dadachann@users.noreply.github.com>
Date: Sat, 25 Jul 2026 02:41:31 +0800
Subject: [PATCH] fix(cloud): reuse authenticated account for user info

---
 .../pkg/api/http/controller/groups/user.py    | 19 +++++++------------
 tests/integration/api/test_workspaces.py      | 16 ++++++++++++++++
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/src/langbot/pkg/api/http/controller/groups/user.py b/src/langbot/pkg/api/http/controller/groups/user.py
index 596aaf817..d9a4239df 100644
--- a/src/langbot/pkg/api/http/controller/groups/user.py
+++ b/src/langbot/pkg/api/http/controller/groups/user.py
@@ -222,20 +222,15 @@ class UserRouterGroup(group.RouterGroup):
             except Exception:
                 raise
 
-        @self.route('/info', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
-        async def _(user_email: str) -> str:
-            """Get current user information including account type"""
-            user_obj = await self.ap.user_service.get_user_by_email(user_email)
-
-            if user_obj is None:
-                return self.http_status(404, -1, 'User not found')
-
+        @self.route('/info', methods=['GET'], auth_type=group.AuthType.ACCOUNT_TOKEN)
+        async def _(account) -> str:
+            """Get current Account information without re-querying under Workspace RLS."""
             return self.success(
                 data={
-                    'account_uuid': user_obj.uuid,
-                    'user': user_obj.user,
-                    'account_type': user_obj.account_type,
-                    'has_password': bool(user_obj.password and user_obj.password.strip()),
+                    'account_uuid': account.uuid,
+                    'user': account.user,
+                    'account_type': account.account_type,
+                    'has_password': bool(account.password and account.password.strip()),
                 }
             )
 
diff --git a/tests/integration/api/test_workspaces.py b/tests/integration/api/test_workspaces.py
index 404d283c4..273137456 100644
--- a/tests/integration/api/test_workspaces.py
+++ b/tests/integration/api/test_workspaces.py
@@ -130,6 +130,22 @@ async def test_fresh_sqlite_login_returns_current_workspace_and_user_info(worksp
     assert info['user'] == 'owner@example.com'
 
 
+async def test_user_info_uses_the_account_resolved_from_the_token(workspace_api):
+    application, client, _, owner_token = workspace_api
+    account = await application.user_service.get_authenticated_account(owner_token)
+
+    application.user_service.get_authenticated_account = AsyncMock(return_value=account)
+    application.user_service.get_user_by_email = AsyncMock(return_value=None)
+
+    response = await client.get('/api/v1/user/info', headers=_auth(owner_token))
+
+    assert response.status_code == 200
+    info = (await response.get_json())['data']
+    assert info['account_uuid'] == account.uuid
+    assert info['user'] == account.user
+    application.user_service.get_user_by_email.assert_not_awaited()
+
+
 async def test_authenticated_system_info_reads_workspace_wizard_metadata(workspace_api):
     application, client, _, owner_token = workspace_api