From 58857654e906d5e2d0b75e24cbb66ba4a20491b4 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Wed, 29 Jul 2026 19:24:12 +0200
Subject: [PATCH] fix: invalidate auth context after organization changes

---
 src/govoplan_organizations/backend/api/v1/routes.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/govoplan_organizations/backend/api/v1/routes.py b/src/govoplan_organizations/backend/api/v1/routes.py
index de6be37..27877a3 100644
--- a/src/govoplan_organizations/backend/api/v1/routes.py
+++ b/src/govoplan_organizations/backend/api/v1/routes.py
@@ -14,6 +14,7 @@ from govoplan_core.core.configuration_control import (
     ensure_configuration_change_allowed,
     record_configuration_change_applied,
 )
+from govoplan_core.core.principal_cache import invalidate_auth_principals
 from govoplan_core.db.session import get_session
 from govoplan_organizations.backend.db.models import (
     OrganizationFunction,
@@ -130,6 +131,13 @@ def _ensure_unique_slug(session: Session, model: type, tenant_id: str, slug: str
 
 
 def _commit(session: Session, item: ModelT) -> ModelT:
+    invalidate_auth_principals(
+        session,
+        tenant_id=getattr(item, "tenant_id", None),
+        source_module="organizations",
+        resource_type=item.__class__.__name__,
+        resource_id=str(getattr(item, "id", getattr(item, "tenant_id", "system"))),
+    )
     try:
         session.commit()
     except IntegrityError as exc: