feat(authz): add caching decorator for PermissionStore

2026-08-04 16:47:50 +05:30
parent a01b7bc99e
commit 4362d49770
2 changed files with 136 additions and 0 deletions
@@ -0,0 +1,66 @@
+import { describe, expect, test } from "bun:test";
+import { cachedPermissionStore, memoryPermissionStore } from "../src/store.ts";
+import { runStoreConformance } from "./store-conformance.ts";
+
+// A cache must not change observable behaviour: writes invalidate internally.
+runStoreConformance("cached(memory)", async () => cachedPermissionStore(memoryPermissionStore()));
+
+describe("cachedPermissionStore", () => {
+  test("serves a repeat read from cache", async () => {
+    const inner = memoryPermissionStore();
+    let reads = 0;
+    const counting = {
+      ...inner,
+      assignmentsFor: (id: string, scope?: { tenantId?: string }) => {
+        reads++;
+        return inner.assignmentsFor(id, scope);
+      },
+    };
+    const store = cachedPermissionStore(counting, { ttlMs: 60_000 });
+    await store.assignmentsFor("u1");
+    await store.assignmentsFor("u1");
+    expect(reads).toBe(1);
+  });
+
+  test("a write invalidates that subject", async () => {
+    const store = cachedPermissionStore(memoryPermissionStore(), { ttlMs: 60_000 });
+    await store.assignmentsFor("u1");
+    await store.assignRole("u1", "editor");
+    expect((await store.assignmentsFor("u1")).roles).toEqual(["editor"]);
+  });
+
+  test("invalidate() drops a cached subject", async () => {
+    const inner = memoryPermissionStore();
+    const store = cachedPermissionStore(inner, { ttlMs: 60_000 });
+    await store.assignmentsFor("u1");
+    await inner.assignRole("u1", "editor"); // behind the cache's back
+    expect((await store.assignmentsFor("u1")).roles).toEqual([]);
+    store.invalidate("u1");
+    expect((await store.assignmentsFor("u1")).roles).toEqual(["editor"]);
+  });
+
+  test("entries expire after ttlMs", async () => {
+    const inner = memoryPermissionStore();
+    const store = cachedPermissionStore(inner, { ttlMs: 1 });
+    await store.assignmentsFor("u1");
+    await inner.assignRole("u1", "editor");
+    await Bun.sleep(5);
+    expect((await store.assignmentsFor("u1")).roles).toEqual(["editor"]);
+  });
+
+  test("cache is bounded by max", async () => {
+    const store = cachedPermissionStore(memoryPermissionStore(), { ttlMs: 60_000, max: 2 });
+    await store.assignmentsFor("a");
+    await store.assignmentsFor("b");
+    await store.assignmentsFor("c");
+    expect(store.size()).toBeLessThanOrEqual(2);
+  });
+
+  test("scoped and global reads cache separately", async () => {
+    const inner = memoryPermissionStore();
+    const store = cachedPermissionStore(inner, { ttlMs: 60_000 });
+    await inner.assignRole("u1", "editor", { tenantId: "t1" });
+    expect((await store.assignmentsFor("u1")).roles).toEqual([]);
+    expect((await store.assignmentsFor("u1", { tenantId: "t1" })).roles).toEqual(["editor"]);
+  });
+});