fix: invalidate auth context after tenant changes

src/govoplan_tenancy/backend/api/v1/routes.py

@@ -17,6 +17,7 @@ from govoplan_core.core.access import (
     TenantContextSwitcher,
 )
 from govoplan_core.core.change_sequence import ChangeSequenceEntry, decode_sequence_watermark, encode_sequence_watermark, record_change, sequence_watermark_is_expired
+from govoplan_core.core.principal_cache import invalidate_auth_principals
 from govoplan_core.core.runtime import get_registry
 from govoplan_core.db.session import get_session
 from govoplan_core.i18n import (
@@ -255,9 +256,11 @@ def _record_tenant_settings_section_changes(
     after: dict[str, Any],
     principal: ApiPrincipal,
 ) -> None:
+    changed = False
     for section in TENANT_SETTINGS_SECTIONS:
         if before.get(section) == after.get(section):
             continue
+        changed = True
         record_change(
             session,
             module_id=TENANCY_MODULE_ID,
@@ -270,6 +273,16 @@ def _record_tenant_settings_section_changes(
             actor_id=principal.user.id,
             payload={"section": section},
         )
+    if changed:
+        invalidate_auth_principals(
+            session,
+            tenant_id=tenant_id,
+            source_module="tenancy",
+            resource_type="tenant_settings",
+            resource_id=tenant_id,
+            actor_type="user",
+            actor_id=principal.user.id,
+        )
 
 
 def _record_tenant_list_change(session: Session, *, tenant: Tenant, operation: str, principal: ApiPrincipal) -> None:
@@ -285,6 +298,16 @@ def _record_tenant_list_change(session: Session, *, tenant: Tenant, operation: s
         actor_id=principal.user.id,
         payload={"slug": tenant.slug, "name": tenant.name, "is_active": tenant.is_active},
     )
+    invalidate_auth_principals(
+        session,
+        tenant_id=tenant.id,
+        source_module="tenancy",
+        resource_type="tenant",
+        resource_id=tenant.id,
+        actor_type="user",
+        actor_id=principal.user.id,
+        reason=operation,
+    )
 
 
 def _tenant_list_delta_query(session: Session, *, since_sequence: int):