fix(dashboard-api): invalidate auth cache on team membership changes#2288
fix(dashboard-api): invalidate auth cache on team membership changes#2288ben-fornefeld merged 3 commits intomainfrom
Conversation
Evict the cached user-team auth entry when a member is added or removed, so the change takes effect immediately instead of waiting for TTL expiry. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PR SummaryMedium Risk Overview Written by Cursor Bugbot for commit 58827e7. This will update automatically on new commits. Configure here. |
…h-cache-invalidation # Conflicts: # packages/auth/pkg/auth/cache.go # packages/auth/pkg/auth/service.go
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f63c2a4382
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
packages/auth/pkg/auth/service.go
Outdated
| func supabaseTeamCacheKey(userID uuid.UUID, teamID string) string { | ||
| return fmt.Sprintf("%s-%s", userID.String(), teamID) |
There was a problem hiding this comment.
supabaseTeamCacheKey uses the raw teamID string, but invalidation now passes teamInfo.Team.ID.String() from the DB-backed UUID object. If a client sends an equivalent but differently formatted header value (for example uppercase UUID text), ValidateSupabaseTeam caches under one key while InvalidateTeamMemberCache deletes another, so removed members can keep access until TTL expires. Parsing/normalizing teamID before key generation would make invalidation reliable.
Useful? React with 👍 / 👎.
The teamID from the X-Supabase-Team header could differ in casing (e.g. uppercase UUID) from uuid.UUID.String() used during invalidation, causing cache keys to not match and invalidation to silently fail. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
this pr is only half of the story. it does not invalidate infra api's in memory auth cache |
4 participants
No description provided.