Add access approval requests to project permission cache logic

2026-09-22 13:39:35 +00:00 · 2025-09-26 17:50:14 -03:00
parent a0dc051f6b
commit 2374182f75
10 changed files with 36 additions and 160 deletions
--- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
+++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
@@ -35,7 +35,7 @@ import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-a

 type TSecretApprovalRequestServiceFactoryDep = {
  additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "create" | "findById">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
  accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
  projectDAL: Pick<
@@ -758,6 +758,8 @@ export const accessApprovalRequestServiceFactory = ({
            { privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED },
            tx
          );
+
+          await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx);
        }
      }

--- a/backend/src/ee/services/group/group-service.ts
+++ b/backend/src/ee/services/group/group-service.ts
@@ -46,10 +46,7 @@ type TGroupServiceFactoryDep = {
  projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "findLatestProjectKey" | "insertMany">;
  permissionService: Pick<
    TPermissionServiceFactory,
-    | "getOrgPermission"
-    | "getOrgPermissionByRole"
-    | "invalidateUserProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
+    "getOrgPermission" | "getOrgPermissionByRole" | "invalidateProjectPermissionCache"
  >;
  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
  oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
@@ -232,10 +229,8 @@ export const groupServiceFactory = ({
    });

    if (role) {
-      const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
      const groupProjects = await groupProjectDAL.find({ groupId: group.id });
      await Promise.allSettled([
-        ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
        ...groupProjects.map((groupProject) =>
          permissionService.invalidateProjectPermissionCache(groupProject.projectId)
        )
@@ -264,7 +259,6 @@ export const groupServiceFactory = ({
        message: "Failed to delete group due to plan restriction. Upgrade plan to delete group."
      });

-    const groupMembers = await userGroupMembershipDAL.find({ groupId: id });
    const groupProjects = await groupProjectDAL.find({ groupId: id });

    const [group] = await groupDAL.delete({
@@ -273,7 +267,6 @@ export const groupServiceFactory = ({
    });

    await Promise.allSettled([
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
      ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
    ]);

@@ -425,7 +418,6 @@ export const groupServiceFactory = ({

    const groupProjects = await groupProjectDAL.find({ groupId: group.id });
    await Promise.allSettled([
-      permissionService.invalidateUserProjectPermissionCache(user.id),
      ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
    ]);

@@ -512,7 +504,6 @@ export const groupServiceFactory = ({

    const groupProjects = await groupProjectDAL.find({ groupId: group.id });
    await Promise.allSettled([
-      permissionService.invalidateUserProjectPermissionCache(user.id),
      ...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
    ]);

--- a/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts
+++ b/backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts
@@ -28,10 +28,7 @@ type TIdentityProjectAdditionalPrivilegeV2ServiceFactoryDep = {
  identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeV2DALFactory;
  identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
  projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
-  permissionService: Pick<
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
-  >;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
 };

 export type TIdentityProjectAdditionalPrivilegeV2ServiceFactory = ReturnType<
@@ -118,10 +115,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
        permissions: packedPermission
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -141,10 +135,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
      temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -239,10 +230,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
        temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -260,10 +248,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
      temporaryMode: null
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -321,10 +306,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({

    const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...deletedPrivilege,
--- a/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts
+++ b/backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts
@@ -31,10 +31,7 @@ type TIdentityProjectAdditionalPrivilegeServiceFactoryDep = {
  identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeDALFactory;
  identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
  projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
-  permissionService: Pick<
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
-  >;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
 };

 export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
@@ -133,10 +130,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
        permissions: packedPermission
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -156,10 +150,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
      temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -266,10 +257,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
        temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-        permissionService.invalidateIdentityProjectPermissionCache(identityId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -287,10 +275,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
      temporaryMode: null
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -366,10 +351,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({

    const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);

    return {
      ...deletedPrivilege,
--- a/backend/src/ee/services/permission/permission-service-types.ts
+++ b/backend/src/ee/services/permission/permission-service-types.ts
@@ -285,6 +285,4 @@ export type TPermissionServiceFactory = {
    checkPermissions: ProjectPermissionSet;
  }) => Promise<boolean>;
  invalidateProjectPermissionCache: (projectId: string, tx?: Knex) => Promise<void>;
-  invalidateUserProjectPermissionCache: (userId: string) => Promise<void>;
-  invalidateIdentityProjectPermissionCache: (identityId: string) => Promise<void>;
 };
--- a/backend/src/ee/services/permission/permission-service.ts
+++ b/backend/src/ee/services/permission/permission-service.ts
@@ -97,16 +97,6 @@ export const permissionServiceFactory = ({
    });
  };

-  const invalidateUserProjectPermissionCache = async (userId: string) => {
-    const pattern = KeyStorePrefixes.UserProjectPermissionPattern(userId);
-    await keyStore.deleteItems({ pattern });
-  };
-
-  const invalidateIdentityProjectPermissionCache = async (identityId: string) => {
-    const pattern = KeyStorePrefixes.IdentityProjectPermissionPattern(identityId);
-    await keyStore.deleteItems({ pattern });
-  };
-
  const calculateProjectPermissionTtl = (membership: unknown): number => {
    const now = new Date();
    let minTtl = KeyStoreTtls.ProjectPermissionCacheInSeconds;
@@ -805,8 +795,6 @@ export const permissionServiceFactory = ({
    buildOrgPermission,
    buildProjectPermissionRules,
    checkGroupProjectPermission,
-    invalidateProjectPermissionCache,
-    invalidateUserProjectPermissionCache,
-    invalidateIdentityProjectPermissionCache
+    invalidateProjectPermissionCache
  };
 };
--- a/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts
+++ b/backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts
@@ -27,10 +27,7 @@ import {
 type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
  projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
-  permissionService: Pick<
-    TPermissionServiceFactory,
-    "getProjectPermission" | "invalidateUserProjectPermissionCache" | "invalidateProjectPermissionCache"
-  >;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
  accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
 };

@@ -119,10 +116,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
        permissions: packedPermission
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-        permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -143,10 +137,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
      temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -245,10 +236,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
        temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
      });

-      await Promise.allSettled([
-        permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-        permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-      ]);
+      await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);

      return {
        ...additionalPrivilege,
@@ -266,10 +254,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
      temporaryMode: null
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);

    return {
      ...additionalPrivilege,
@@ -318,10 +303,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
    );
    const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
-      permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);

    return {
      ...deletedPrivilege,
--- a/backend/src/services/group-project/group-project-service.ts
+++ b/backend/src/services/group-project/group-project-service.ts
@@ -45,10 +45,7 @@ type TGroupProjectServiceFactoryDep = {
  groupDAL: Pick<TGroupDALFactory, "findOne" | "findAllGroupPossibleMembers">;
  permissionService: Pick<
    TPermissionServiceFactory,
-    | "getProjectPermission"
-    | "getProjectPermissionByRole"
-    | "invalidateProjectPermissionCache"
-    | "invalidateUserProjectPermissionCache"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
  >;
 };

@@ -269,11 +266,7 @@ export const groupProjectServiceFactory = ({
      return groupProjectMembership;
    });

-    const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return projectGroup;
  };
@@ -384,11 +377,7 @@ export const groupProjectServiceFactory = ({
      return groupProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
    });

-    const groupMembers = await userGroupMembershipDAL.find({ groupId });
-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return updatedRoles;
  };
@@ -421,8 +410,6 @@ export const groupProjectServiceFactory = ({
    });
    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionGroupActions.Delete, ProjectPermissionSub.Groups);

-    const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
-
    const deletedProjectGroup = await groupProjectDAL.transaction(async (tx) => {
      const groupMembersNotInProject = await userGroupMembershipDAL.findGroupMembersNotInProject(
        group.id,
@@ -446,10 +433,7 @@ export const groupProjectServiceFactory = ({
      return projectGroup;
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId))
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return deletedProjectGroup;
  };
--- a/backend/src/services/identity-project/identity-project-service.ts
+++ b/backend/src/services/identity-project/identity-project-service.ts
@@ -37,10 +37,7 @@ type TIdentityProjectServiceFactoryDep = {
  identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
  permissionService: Pick<
    TPermissionServiceFactory,
-    | "getProjectPermission"
-    | "getProjectPermissionByRole"
-    | "invalidateIdentityProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
  >;
 };

@@ -172,10 +169,7 @@ export const identityProjectServiceFactory = ({
      return { ...identityProjectMembership, roles: identityRoles };
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return projectIdentity;
  };
@@ -284,10 +278,7 @@ export const identityProjectServiceFactory = ({
      return identityProjectMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return updatedRoles;
  };
@@ -320,10 +311,7 @@ export const identityProjectServiceFactory = ({

    const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      permissionService.invalidateIdentityProjectPermissionCache(identityId)
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return deletedIdentity;
  };
--- a/backend/src/services/project-membership/project-membership-service.ts
+++ b/backend/src/services/project-membership/project-membership-service.ts
@@ -45,10 +45,7 @@ import { TProjectUserMembershipRoleDALFactory } from "./project-user-membership-
 type TProjectMembershipServiceFactoryDep = {
  permissionService: Pick<
    TPermissionServiceFactory,
-    | "getProjectPermission"
-    | "getProjectPermissionByRole"
-    | "invalidateUserProjectPermissionCache"
-    | "invalidateProjectPermissionCache"
+    "getProjectPermission" | "getProjectPermissionByRole" | "invalidateProjectPermissionCache"
  >;
  smtpService: TSmtpService;
  projectBotDAL: TProjectBotDALFactory;
@@ -245,12 +242,7 @@ export const projectMembershipServiceFactory = ({
      );
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...orgMembers.map(({ userId }) =>
-        userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve()
-      )
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    if (sendEmails) {
      await notificationService.createUserNotifications(
@@ -384,12 +376,7 @@ export const projectMembershipServiceFactory = ({
      return projectUserMembershipRoleDAL.insertMany(sanitizedProjectMembershipRoles, tx);
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      membershipUser?.userId
-        ? permissionService.invalidateUserProjectPermissionCache(membershipUser.userId)
-        : Promise.resolve()
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return updatedRoles;
  };
@@ -435,10 +422,7 @@ export const projectMembershipServiceFactory = ({
      return deletedMembership;
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      membership.userId ? permissionService.invalidateUserProjectPermissionCache(membership.userId) : Promise.resolve()
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return membership;
  };
@@ -542,12 +526,7 @@ export const projectMembershipServiceFactory = ({
      return deletedMemberships;
    });

-    await Promise.allSettled([
-      permissionService.invalidateProjectPermissionCache(projectId),
-      ...memberships.map(({ userId }) =>
-        userId ? permissionService.invalidateUserProjectPermissionCache(userId) : Promise.resolve()
-      )
-    ]);
+    await permissionService.invalidateProjectPermissionCache(projectId);

    return memberships;
  };