refactor(auth): read the session policy fresh instead of caching it

Follows the pattern the two sibling enterprise-settings call sites already
establish. `lib/logs/execution/logger.ts` and
`lib/workflows/executor/execution-core.ts` both resolve org enterprise settings
with a single indexed read at enforcement time and carry explicit comments
rejecting a cached/re-checked resolution, because a stale or failed read there
silently skips the control.

The session policy is the same shape of thing, and it is not a hot path: it is
read on sign-in and on a sliding session refresh, which the 24h cookie cache
limits to roughly once per user per day. Caching it bought nothing and cost the
correctness bug this branch set out to fix — so drop the cache rather than build
machinery to keep two caches coherent. Better Auth also documents
`cookieCache.version` as a static string bumped at deploy and offers no
cross-instance invalidation, so the version TTL is inherent to the design while
the policy cache never was.

This removes, rather than fixes, the whole class of problems the previous
revision introduced: no merged record, no cache-bypass flag, no last-known-good
fallback, no entitlement cache, no destructive-invalidation window, and no
ordering hazard between concurrent readers. `security-policy.ts` is back to
caching only the cookie-cache version — which genuinely is per-request — plus
the membership lookup.

Failure posture is now chosen per call site instead of globally fail-open:

- `getSessionPolicy` and `getMemberOrganizationId` propagate read errors.
- The session UPDATE hook refuses to EXTEND on a failed read, keeping the
  member's current expiry rather than granting a fresh 30 days the policy may
  forbid.
- The session CREATE hook allows the sign-in but logs that the session went
  unclamped — refusing sign-ins would turn a read blip into an org-wide outage.
- `getSessionCookieCacheVersion` still never throws; it runs on every request,
  and its fallback only costs a cookie mismatch and a database session read.

Kept from the previous revision: the entry caps with low-water-mark eviction,
the organizations-disabled short-circuit, the propagating enterprise-plan
resolver, and the corrected idle-timeout copy.

Author: waleedlatif1

apps/sim/app/api/organizations/[id]/session-policy/route.test.ts

@@ -24,7 +24,7 @@ vi.mock('@/lib/auth/session-policy', () => ({
 }))
 
 vi.mock('@/lib/auth/security-policy', () => ({
-  invalidateOrgSecurityCache: vi.fn(),
+  invalidateSecurityPolicyVersionCache: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/subscription', () => ({

apps/sim/app/api/organizations/[id]/session-policy/route.ts

@@ -9,7 +9,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { updateOrganizationSessionPolicyContract } from '@/lib/api/contracts/organization'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { invalidateOrgSecurityCache } from '@/lib/auth/security-policy'
+import { invalidateSecurityPolicyVersionCache } from '@/lib/auth/security-policy'
 import { eagerClampOrgSessions } from '@/lib/auth/session-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
@@ -160,7 +160,7 @@ export const PUT = withRouteHandler(
       return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
     }
 
-    invalidateOrgSecurityCache(organizationId)
+    invalidateSecurityPolicyVersionCache(organizationId)
 
     logger.info('Updated organization session policy', { organizationId })
 

apps/sim/app/api/organizations/[id]/sessions/revoke/route.test.ts

@@ -13,14 +13,14 @@ import {
 } from '@sim/testing'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockIsEnterprise, mockRecordAudit, mockInvalidateOrgSecurityCache } = vi.hoisted(() => ({
+const { mockIsEnterprise, mockRecordAudit, mockInvalidateVersionCache } = vi.hoisted(() => ({
   mockIsEnterprise: vi.fn(),
   mockRecordAudit: vi.fn(),
-  mockInvalidateOrgSecurityCache: vi.fn(),
+  mockInvalidateVersionCache: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/security-policy', () => ({
-  invalidateOrgSecurityCache: mockInvalidateOrgSecurityCache,
+  invalidateSecurityPolicyVersionCache: mockInvalidateVersionCache,
 }))
 
 vi.mock('@/lib/billing/core/subscription', () => ({
@@ -157,7 +157,7 @@ describe('org sessions revoke route', () => {
       expect(dbChainMockFns.set).toHaveBeenCalledWith(
         expect.objectContaining({ securityPolicyVersion: expect.anything() })
       )
-      expect(mockInvalidateOrgSecurityCache).toHaveBeenCalledWith(ORG_ID)
+      expect(mockInvalidateVersionCache).toHaveBeenCalledWith(ORG_ID)
       expect(mockRecordAudit).toHaveBeenCalledWith(
         expect.objectContaining({
           action: 'organization.sessions.revoked',

apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts

@@ -8,7 +8,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { revokeOrganizationSessionsContract } from '@/lib/api/contracts/organization'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { invalidateOrgSecurityCache } from '@/lib/auth/security-policy'
+import { invalidateSecurityPolicyVersionCache } from '@/lib/auth/security-policy'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -105,7 +105,7 @@ export const POST = withRouteHandler(
         .where(eq(organization.id, organizationId))
       return deleted
     })
-    invalidateOrgSecurityCache(organizationId)
+    invalidateSecurityPolicyVersionCache(organizationId)
 
     logger.info('Revoked organization sessions', {
       organizationId,

apps/sim/lib/auth/auth.ts

@@ -685,13 +685,7 @@ export const auth = betterAuth({
           }
 
           try {
-            // Session creation is rare and, unlike a sliding refresh, is not
-            // already preceded by a cookie-version mismatch read — so it must
-            // read the policy fresh or a just-tightened policy could be missed
-            // for the life of the session.
-            const expiresAt = await clampExpiryForSession(session, membershipOrgId, {
-              bypassPolicyCache: true,
-            })
+            const expiresAt = await clampExpiryForSession(session, membershipOrgId)
             return {
               data: {
                 ...session,
@@ -703,7 +697,10 @@ export const auth = betterAuth({
               },
             }
           } catch (error) {
-            logger.error('Error clamping new session to org policy', {
+            // Allow the sign-in: refusing it would turn a policy-read blip into
+            // an org-wide outage. The session keeps Better Auth's default
+            // expiry and the next refresh clamps it.
+            logger.error('Error clamping new session to org policy; session not clamped', {
               error,
               userId: session.userId,
             })
@@ -728,11 +725,22 @@ export const auth = betterAuth({
           if (!data.expiresAt) return { data }
           const current = ctx?.context?.session?.session
           if (!current) return { data }
-          const expiresAt = await clampExpiryForSession({
-            ...current,
-            expiresAt: new Date(data.expiresAt),
-          })
-          return { data: { ...data, expiresAt } }
+          try {
+            const expiresAt = await clampExpiryForSession({
+              ...current,
+              expiresAt: new Date(data.expiresAt),
+            })
+            return { data: { ...data, expiresAt } }
+          } catch (error) {
+            // Refuse to EXTEND when the policy cannot be read: keeping the
+            // session's current expiry leaves the member signed in without
+            // granting them a fresh 30 days a policy might have forbidden.
+            logger.error('Error re-clamping refreshed session; leaving expiry unchanged', {
+              error,
+              userId: current.userId,
+            })
+            return { data: { ...data, expiresAt: current.expiresAt } }
+          }
         },
       },
     },

apps/sim/lib/auth/security-policy.test.ts

@@ -12,11 +12,10 @@ import {
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   getMemberOrganizationId,
-  getOrgSecurityRecord,
   getSecurityPolicyVersion,
   getSessionCookieCacheVersion,
   invalidateMembershipCache,
-  invalidateOrgSecurityCache,
+  invalidateSecurityPolicyVersionCache,
 } from '@/lib/auth/security-policy'
 
 /** Module-level caches persist across cases, so every case uses a fresh id. */
@@ -33,104 +32,37 @@ describe('security policy', () => {
     setEnvFlags({ isOrganizationsEnabled: true })
   })
 
-  describe('getOrgSecurityRecord', () => {
-    it('serves the version and the session policy from ONE row read', async () => {
+  describe('getSecurityPolicyVersion', () => {
+    it('caches the version and re-reads after invalidation', async () => {
       const orgId = nextOrgId()
-      queueTableRows(organization, [
-        { version: 7, sessionPolicySettings: { maxSessionHours: 8, idleTimeoutHours: null } },
-      ])
+      queueTableRows(organization, [{ version: 3 }])
 
-      const record = await getOrgSecurityRecord(orgId)
-
-      expect(record.version).toBe(7)
-      expect(record.sessionPolicySettings).toEqual({ maxSessionHours: 8, idleTimeoutHours: null })
+      expect(await getSecurityPolicyVersion(orgId)).toBe(3)
+      expect(await getSecurityPolicyVersion(orgId)).toBe(3)
       expect(dbChainMockFns.select).toHaveBeenCalledTimes(1)
-    })
 
-    it('reads the row once for a version lookup, then serves the policy from cache', async () => {
-      const orgId = nextOrgId()
-      queueTableRows(organization, [
-        { version: 3, sessionPolicySettings: { maxSessionHours: 12, idleTimeoutHours: null } },
-      ])
-
-      // This is the coherence guarantee: whatever version a caller observed,
-      // the policy it goes on to read came from that same row. Two independent
-      // caches previously allowed a bumped version to pair with a stale policy.
-      const version = await getSecurityPolicyVersion(orgId)
-      const { sessionPolicySettings } = await getOrgSecurityRecord(orgId)
-
-      expect(version).toBe(3)
-      expect(sessionPolicySettings).toEqual({ maxSessionHours: 12, idleTimeoutHours: null })
-      expect(dbChainMockFns.select).toHaveBeenCalledTimes(1)
+      invalidateSecurityPolicyVersionCache(orgId)
+      queueTableRows(organization, [{ version: 4 }])
+      expect(await getSecurityPolicyVersion(orgId)).toBe(4)
     })
 
-    it('re-reads after invalidation', async () => {
-      const orgId = nextOrgId()
-      queueTableRows(organization, [{ version: 1, sessionPolicySettings: null }])
-      await getOrgSecurityRecord(orgId)
-
-      invalidateOrgSecurityCache(orgId)
-      queueTableRows(organization, [
-        { version: 2, sessionPolicySettings: { maxSessionHours: 4, idleTimeoutHours: null } },
-      ])
-
-      const record = await getOrgSecurityRecord(orgId)
-      expect(record.version).toBe(2)
-      expect(record.sessionPolicySettings).toEqual({ maxSessionHours: 4, idleTimeoutHours: null })
-      expect(dbChainMockFns.select).toHaveBeenCalledTimes(2)
+    it('returns the default without querying for an org-less session', async () => {
+      expect(await getSecurityPolicyVersion(null)).toBe(1)
+      expect(dbChainMockFns.select).not.toHaveBeenCalled()
     })
 
-    it('re-reads when the caller bypasses the cache', async () => {
-      const orgId = nextOrgId()
-      queueTableRows(organization, [{ version: 1, sessionPolicySettings: null }])
-      await getOrgSecurityRecord(orgId)
-
-      queueTableRows(organization, [
-        { version: 2, sessionPolicySettings: { maxSessionHours: 6, idleTimeoutHours: null } },
-      ])
-      const record = await getOrgSecurityRecord(orgId, { bypassCache: true })
-
-      expect(record.sessionPolicySettings).toEqual({ maxSessionHours: 6, idleTimeoutHours: null })
-      expect(dbChainMockFns.select).toHaveBeenCalledTimes(2)
+    it('defaults an unknown organization to version 1', async () => {
+      queueTableRows(organization, [])
+      expect(await getSecurityPolicyVersion(nextOrgId())).toBe(1)
     })
 
-    it('serves the last known-good record when a refresh fails', async () => {
-      const orgId = nextOrgId()
-      queueTableRows(organization, [
-        { version: 5, sessionPolicySettings: { maxSessionHours: 8, idleTimeoutHours: null } },
-      ])
-      await getOrgSecurityRecord(orgId)
-
-      invalidateOrgSecurityCache(orgId)
-      // A read failure must not silently drop the org's bounds — that would
-      // disable a security control on a transient database blip.
-      dbChainMockFns.limit.mockImplementationOnce(() => {
-        throw new Error('connection reset')
-      })
-
-      // Nothing cached for this org after invalidation, so it falls to defaults.
-      const cold = await getOrgSecurityRecord(orgId)
-      expect(cold).toEqual({ version: 1, sessionPolicySettings: null })
-
-      queueTableRows(organization, [
-        { version: 5, sessionPolicySettings: { maxSessionHours: 8, idleTimeoutHours: null } },
-      ])
-      await getOrgSecurityRecord(orgId)
+    it('falls back to the default when the read fails', async () => {
       dbChainMockFns.limit.mockImplementationOnce(() => {
         throw new Error('connection reset')
       })
-
-      const warm = await getOrgSecurityRecord(orgId, { bypassCache: true })
-      expect(warm.version).toBe(5)
-      expect(warm.sessionPolicySettings).toEqual({ maxSessionHours: 8, idleTimeoutHours: null })
-    })
-
-    it('defaults an unknown organization to version 1 with no policy', async () => {
-      queueTableRows(organization, [])
-      expect(await getOrgSecurityRecord(nextOrgId())).toEqual({
-        version: 1,
-        sessionPolicySettings: null,
-      })
+      // Erring low only costs a cookie mismatch and a database session read —
+      // it can never suppress a revocation the way a stale-high value would.
+      expect(await getSecurityPolicyVersion(nextOrgId())).toBe(1)
     })
   })
 
@@ -152,14 +84,21 @@ describe('security policy', () => {
       queueTableRows(member, [{ organizationId: 'org-b' }])
       expect(await getMemberOrganizationId(userId)).toBe('org-b')
     })
+
+    it('propagates a read failure so callers can tell it apart from "no org"', async () => {
+      dbChainMockFns.limit.mockImplementationOnce(() => {
+        throw new Error('connection reset')
+      })
+      await expect(getMemberOrganizationId(nextUserId())).rejects.toThrow('connection reset')
+    })
   })
 
   describe('getSessionCookieCacheVersion', () => {
     it('embeds the org id so two orgs never share a version string', async () => {
       const userId = nextUserId()
       const orgId = nextOrgId()
       queueTableRows(member, [{ organizationId: orgId }])
-      queueTableRows(organization, [{ version: 4, sessionPolicySettings: null }])
+      queueTableRows(organization, [{ version: 4 }])
 
       expect(await getSessionCookieCacheVersion({ userId })).toBe(`${orgId}:4`)
     })
@@ -169,6 +108,14 @@ describe('security policy', () => {
       expect(await getSessionCookieCacheVersion({ userId: nextUserId() })).toBe('none')
     })
 
+    it('never throws on a failed membership read', async () => {
+      dbChainMockFns.limit.mockImplementationOnce(() => {
+        throw new Error('connection reset')
+      })
+      // Runs on every authenticated request — a throw here would 500 the app.
+      expect(await getSessionCookieCacheVersion({ userId: nextUserId() })).toBe('none')
+    })
+
     it('costs no lookups when organizations are disabled for the deployment', async () => {
       setEnvFlags({ isOrganizationsEnabled: false })
       expect(await getSessionCookieCacheVersion({ userId: nextUserId() })).toBe('none')