perf(core,plugin-auth): an authenticated request resolves its caller's grants once, not twice by objectstack-fleet[bot] · Pull Request #22441 · objectstack-ai/objectstack

perf(core,plugin-auth): one resolveAuthzContext call resolves the session principal's grants once

claude

committed

ce8ee02

test(core): pin the request-scoped grants memo per caller class, its count, isolation and freshness

claude

committed

1bb907b

test(plugin-auth): the real customSession hook and resolveAuthzContext resolve grants once per warm request

claude

committed

71d418c

chore(changeset): core and plugin-auth patch for the request-scoped grants memo

claude

committed

fa9bc38

refactor(plugin-auth): read the hook's seed email off better-auth's typed user

claude

committed

0b07e02

fix(core): the grants memo serves only when no write landed or is in flight since the first resolution opened

claude

committed

1f61b8a

fix(core): register the grants memo's write observer only on an engine that carries the write epoch

claude

committed

606c334

test(core): the landing pin asserts the authorization decision before the read count

claude

committed

870b429

docs(core): the grants memo's observer sees statement execution, not commit visibility; state the transactional residual

claude

committed

da29c61

Navigation Menu

Repository navigation

perf(core,plugin-auth): an authenticated request resolves its caller's grants once, not twice - #22441

perf(core,plugin-auth): an authenticated request resolves its caller's grants once, not twice#22441
objectstack-fleet[bot] merged 9 commits into
mainfrom
claude/issue-2634-prehandler-grants-once

Commits on Oct 9, 2026

perf(core,plugin-auth): one resolveAuthzContext call resolves the session principal's grants once

test(core): pin the request-scoped grants memo per caller class, its count, isolation and freshness

test(plugin-auth): the real customSession hook and resolveAuthzContext resolve grants once per warm request

chore(changeset): core and plugin-auth patch for the request-scoped grants memo

refactor(plugin-auth): read the hook's seed email off better-auth's typed user

fix(core): the grants memo serves only when no write landed or is in flight since the first resolution opened

fix(core): register the grants memo's write observer only on an engine that carries the write epoch

test(core): the landing pin asserts the authorization decision before the read count

docs(core): the grants memo's observer sees statement execution, not commit visibility; state the transactional residual