fix(dashboard-api): invalidate auth cache on team membership changes (#2288)

* fix(dashboard-api): invalidate auth cache on team membership changes

Evict the cached user-team auth entry when a member is added or removed,
so the change takes effect immediately instead of waiting for TTL expiry.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(auth): normalize teamID in cache key to prevent case mismatch

The teamID from the X-Supabase-Team header could differ in casing
(e.g. uppercase UUID) from uuid.UUID.String() used during invalidation,
causing cache keys to not match and invalidation to silently fail.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ben-fornefeld

packages/auth/pkg/auth/service.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -155,7 +156,7 @@ func (s *AuthService[T]) ValidateSupabaseTeam(ctx context.Context, ginCtx *gin.C
 		}
 	}
 
-	cacheKey := fmt.Sprintf("%s-%s", userID.String(), teamID)
+	cacheKey := supabaseTeamCacheKey(userID, teamID)
 
 	result, err := s.teamCache.GetOrSet(ctx, cacheKey, func(ctx context.Context, _ string) (T, error) {
 		return s.store.GetTeamByIDAndUserID(ctx, userID, teamID)
@@ -197,6 +198,12 @@ func (s *AuthService[T]) ValidateSupabaseTeam(ctx context.Context, ginCtx *gin.C
 	return result, nil
 }
 
+// InvalidateTeamMemberCache removes the cached auth entry for a specific user-team pair.
+// This should be called when team membership changes (member added or removed).
+func (s *AuthService[T]) InvalidateTeamMemberCache(userID uuid.UUID, teamID string) {
+	s.teamCache.Invalidate(supabaseTeamCacheKey(userID, teamID))
+}
+
 // InvalidateTeamCache queries the team's API key hashes and removes their cached entries.
 func (s *AuthService[T]) InvalidateTeamCache(ctx context.Context, teamID uuid.UUID) error {
 	hashes, err := s.store.GetTeamAPIKeyHashes(ctx, teamID)
@@ -211,6 +218,10 @@ func (s *AuthService[T]) InvalidateTeamCache(ctx context.Context, teamID uuid.UU
 	return nil
 }
 
+func supabaseTeamCacheKey(userID uuid.UUID, teamID string) string {
+	return fmt.Sprintf("%s-%s", userID.String(), strings.ToLower(teamID))
+}
+
 // Close stops the underlying cache's background refresh goroutines.
 func (s *AuthService[T]) Close(ctx context.Context) error {
 	return s.teamCache.Close(ctx)

packages/dashboard-api/internal/handlers/team_members.go

@@ -107,6 +107,8 @@ func (s *APIStore) PostTeamsTeamIDMembers(c *gin.Context, teamID api.TeamID) {
 		return
 	}
 
+	s.authService.InvalidateTeamMemberCache(user.ID, teamInfo.Team.ID.String())
+
 	c.Status(http.StatusCreated)
 }
 
@@ -187,5 +189,7 @@ func (s *APIStore) DeleteTeamsTeamIDMembersUserId(c *gin.Context, teamID api.Tea
 		return
 	}
 
+	s.authService.InvalidateTeamMemberCache(userId, teamInfo.Team.ID.String())
+
 	c.Status(http.StatusNoContent)
 }