fix(realtime): prefer a mid-flight recorded role decision over the in-flight query result

If a fresh authoritative read (join-time verify) records a decision while
a single-flighted resolution's query is in flight, keep the recorded
decision instead of overwriting it with the potentially stale result.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

apps/realtime/src/middleware/permissions.test.ts

@@ -518,4 +518,33 @@ describe('verifyWorkflowAccess role-cache refresh', () => {
     mockAuthorize.mockRejectedValue(new Error('must not re-query'))
     expect(await resolveCurrentWorkflowRole(userId, workflowId, 'read')).toBe('write')
   })
+
+  it('does not let a stale in-flight resolution overwrite a fresher verify decision', async () => {
+    const userId = 'vw-user-2'
+    const workflowId = 'vw-wf-2'
+
+    // A sweep-style resolution starts against pre-re-grant state and stalls.
+    let resolveStaleQuery!: (value: {
+      allowed: boolean
+      workspacePermission: string | null
+    }) => void
+    mockAuthorize.mockReturnValueOnce(
+      new Promise((resolve) => {
+        resolveStaleQuery = resolve
+      })
+    )
+    const staleResolution = resolveCurrentWorkflowRole(userId, workflowId, 'read')
+
+    // Access is re-granted and a fresh join-time verify records it mid-flight.
+    mockAuthorize.mockResolvedValueOnce({ allowed: true, workspacePermission: 'write' })
+    await verifyWorkflowAccess(userId, workflowId)
+
+    // The stale query now completes with the pre-re-grant revocation — it must
+    // yield to the fresher recorded decision, not overwrite it.
+    resolveStaleQuery({ allowed: false, workspacePermission: null })
+    expect(await staleResolution).toBe('write')
+
+    mockAuthorize.mockRejectedValue(new Error('must not re-query'))
+    expect(await resolveCurrentWorkflowRole(userId, workflowId, 'read')).toBe('write')
+  })
 })

apps/realtime/src/middleware/permissions.ts

@@ -150,13 +150,22 @@ async function resolveRoleUncached(
   workflowId: string,
   fallbackRole: string
 ): Promise<string | null> {
+  const entryBeforeQuery = roleCache.get(key)
   try {
     const authorization = await authorizeWorkflowByWorkspacePermission({
       workflowId,
       userId,
       action: 'read',
     })
     const role = authorization.allowed ? (authorization.workspacePermission ?? null) : null
+    // A fresh authoritative read (e.g. a join-time verifyWorkflowAccess) may
+    // have recorded a decision while this query was in flight. That write is
+    // newer than this query's read snapshot, so prefer it instead of
+    // overwriting it with a potentially stale result.
+    const entryAfterQuery = roleCache.get(key)
+    if (entryAfterQuery !== undefined && entryAfterQuery !== entryBeforeQuery) {
+      return entryAfterQuery.role
+    }
     recordRoleDecision(key, role)
     return role
   } catch (error) {