[Debt] Add safe auth principal caching with explicit invalidation #260

New Issue

2026-07-14T00:13:18+02:00

zemion commented

2026-07-14 00:13:18 +02:00

Current Cost

Every full auth/profile request recomputes principal context even when the user, tenant, role, group, function, delegation, and language state has not changed. Blind caching would be risky because stale permissions are security-sensitive.

Desired Shape

Introduce a small, explicit cache for session/principal summary data only after the fast-session contract and query instrumentation are in place. Invalidation must be tied to access-control and identity-affecting changes.

Constraints

Do not cache across tenants incorrectly.
Do not serve stale permissions after role, group, system role, tenant membership, function assignment, delegation, identity link, or settings changes.
API-key behavior and interactive session behavior may need different cache keys/TTLs.

Checklist

Define cacheable principal/session summary fields.
Define invalidation events and version keys.
Add tests for permission changes invalidating cached context.
Keep cache opt-out or short TTL for debugging.

Verification Target

Permission mutation tests prove stale grants are not retained.
Fast session and full bootstrap timings improve without changing effective scopes.

## Current Cost Every full auth/profile request recomputes principal context even when the user, tenant, role, group, function, delegation, and language state has not changed. Blind caching would be risky because stale permissions are security-sensitive. ## Desired Shape Introduce a small, explicit cache for session/principal summary data only after the fast-session contract and query instrumentation are in place. Invalidation must be tied to access-control and identity-affecting changes. ## Constraints - Do not cache across tenants incorrectly. - Do not serve stale permissions after role, group, system role, tenant membership, function assignment, delegation, identity link, or settings changes. - API-key behavior and interactive session behavior may need different cache keys/TTLs. ## Checklist - [ ] Define cacheable principal/session summary fields. - [ ] Define invalidation events and version keys. - [ ] Add tests for permission changes invalidating cached context. - [ ] Keep cache opt-out or short TTL for debugging. ## Verification Target - Permission mutation tests prove stale grants are not retained. - Fast session and full bootstrap timings improve without changing effective scopes.

zemion referenced this issue

2026-07-29 13:25:59 +02:00

[Debt] Add DB query timing and batch auth principal resolution #259

zemion added the area/auth area/security codex/ready module/core

labels 2026-07-29 14:15:06 +02:00

zemion referenced this issue

2026-07-29 14:20:49 +02:00

[Debt] Add DB query timing and batch auth principal resolution #259

zemion commented

2026-07-29 14:24:40 +02:00

Codex State: reviewed

Reviewed after Core 68328f3. This remains open: query batching and activity-write throttling are present, but there is no principal-summary cache with explicit role/group/function/delegation/identity invalidation, opt-out, and stale-grant tests.

## Codex State: reviewed Reviewed after Core `68328f3`. This remains open: query batching and activity-write throttling are present, but there is no principal-summary cache with explicit role/group/function/delegation/identity invalidation, opt-out, and stale-grant tests.

zemion commented

2026-07-29 19:27:28 +02:00

Implemented and pushed. Core 48fb953 adds durable tenant/global authorization revisions and cache controls; Access b6c2c89 caches only immutable PrincipalRef summaries, rehydrates request-scoped ORM state, rechecks session/API-key validity, and tests permission-change invalidation. IDM 94c1d08, Organizations 5885765, and Tenancy 922b3f4 publish transactional invalidations for optional authority sources. Focused Ruff and auth/module tests pass.

Implemented and pushed. Core 48fb953 adds durable tenant/global authorization revisions and cache controls; Access b6c2c89 caches only immutable PrincipalRef summaries, rehydrates request-scoped ORM state, rechecks session/API-key validity, and tests permission-change invalidation. IDM 94c1d08, Organizations 5885765, and Tenancy 922b3f4 publish transactional invalidations for optional authority sources. Focused Ruff and auth/module tests pass.

zemion closed this issue

2026-07-29 19:27:30 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#260