perf: batch authorization and activity updates

src/govoplan_access/backend/auth/dependencies.py

@@ -249,11 +249,19 @@ def _resolve_api_key_principal_context(
 ) -> ResolvedPrincipalContext | None:
     # API keys remain supported for CLI/automation. Their permissions are the
     # intersection of the key grant and the owner's current tenant roles.
-    api_key = authenticate_api_key(session, token)
+    api_key = authenticate_api_key(
+        session,
+        token,
+        touch_interval_seconds=settings.auth_activity_touch_interval_seconds,
+    )
     if api_key is None:
         return None
-    user = session.get(User, api_key.user_id)
-    account = session.get(Account, user.account_id) if user else None
+    activity_touch_pending = session.is_modified(
+        api_key,
+        include_collections=False,
+    )
+    user = api_key.user
+    account = user.account if user else None
     tenant = session.get(Tenant, api_key.tenant_id)
     if (
         not user or not account or not tenant
@@ -277,7 +285,6 @@ def _resolve_api_key_principal_context(
         extra_roles=idm_roles,
     )
     effective_scopes = intersect_api_key_scopes(authorization_context.scopes, api_key.scopes or [])
-    session.commit()
     principal = _build_principal_ref(
         session,
         api_key=api_key,
@@ -291,6 +298,8 @@ def _resolve_api_key_principal_context(
         extra_roles=idm_roles,
         authorization_context=authorization_context,
     )
+    if activity_touch_pending:
+        session.commit()
     return ResolvedPrincipalContext(principal=principal, account=account, user=user, tenant=tenant, api_key=api_key)
 
 
@@ -326,11 +335,19 @@ def _resolve_session_principal_context(
     identity_directory: IdentityDirectory | None,
     organization_directory: OrganizationDirectory | None,
 ) -> ResolvedPrincipalContext | None:
-    auth_session = authenticate_session_token(session, token)
+    auth_session = authenticate_session_token(
+        session,
+        token,
+        touch_interval_seconds=settings.auth_activity_touch_interval_seconds,
+    )
     if auth_session is None:
         return None
-    user = session.get(User, auth_session.user_id)
-    account = session.get(Account, auth_session.account_id)
+    activity_touch_pending = session.is_modified(
+        auth_session,
+        include_collections=False,
+    )
+    user = auth_session.user
+    account = auth_session.account
     tenant = session.get(Tenant, auth_session.tenant_id)
     if (
         not user or not account or not tenant
@@ -357,7 +374,6 @@ def _resolve_session_principal_context(
         extra_roles=idm_roles,
     )
     scopes = authorization_context.scopes
-    session.commit()
     principal = _build_principal_ref(
         session,
         auth_session=auth_session,
@@ -372,6 +388,8 @@ def _resolve_session_principal_context(
         authorization_context=authorization_context,
         include_system_roles=True,
     )
+    if activity_touch_pending:
+        session.commit()
     return ResolvedPrincipalContext(principal=principal, account=account, user=user, tenant=tenant, auth_session=auth_session)