Permission Cache
Production - PermissionCacheController - 12 endpoints at /api/v1/permissions/cache
The permission cache uses Redis to store resolved permissions for fast authorization decisions. The PermissionCacheController provides endpoints for cache inspection, warming, and invalidation.
6.5.6Cache Endpoints
Get Cache Statistics
curl -X GET http://localhost:8081/api/v1/permissions/cache/stats \
-H "Authorization: Bearer <admin-token>"Returns CacheStats with hit ratio, total entries, and memory usage.
Get User Permissions
curl -X GET http://localhost:8081/api/v1/permissions/cache/user/42 \
-H "Authorization: Bearer <admin-token>"Returns the set of cached permission strings for the user.
Get User Roles
curl -X GET http://localhost:8081/api/v1/permissions/cache/user/42/roles \
-H "Authorization: Bearer <admin-token>"Check Permission
curl -X POST http://localhost:8081/api/v1/permissions/cache/user/42/check \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <admin-token>" \
-d '{ "permission": "dashboards:write" }'Response:
{
"userId": 42,
"permission": "dashboards:write",
"hasPermission": true
}Warm Cache
# Warm user cache
curl -X POST http://localhost:8081/api/v1/permissions/cache/user/42/warm \
-H "Authorization: Bearer <admin-token>"
# Warm role cache
curl -X POST http://localhost:8081/api/v1/permissions/cache/role/5/warm \
-H "Authorization: Bearer <admin-token>"Invalidate Cache
# Invalidate user cache
curl -X DELETE http://localhost:8081/api/v1/permissions/cache/user/42 \
-H "Authorization: Bearer <admin-token>"
# Invalidate role cache (and all users with that role)
curl -X DELETE http://localhost:8081/api/v1/permissions/cache/role/5 \
-H "Authorization: Bearer <admin-token>"
# Invalidate all caches (SUPER_ADMIN only)
curl -X DELETE http://localhost:8081/api/v1/permissions/cache/all \
-H "Authorization: Bearer <super-admin-token>"Current User Endpoints
# Get my cached permissions
curl -X GET http://localhost:8081/api/v1/permissions/cache/my-permissions \
-H "Authorization: Bearer <access-token>"
# Get my cached roles
curl -X GET http://localhost:8081/api/v1/permissions/cache/my-roles \
-H "Authorization: Bearer <access-token>"6.5.7Cache Strategy
| Aspect | Detail |
|---|---|
| Backend | Redis |
| Key Format | permissions:{user_id}, roles:{user_id}, role_permissions:{role_id} |
| TTL | 300 seconds (configurable) |
| Invalidation | On role change, permission change, or manual flush |
| Warming | On-demand via API or on first access |
Required Permissions
| Endpoint | Required |
|---|---|
| Cache stats | ADMIN or system:cache:read |
| User permissions/roles | ADMIN or users:read |
| Role permissions | ADMIN or roles:read |
| Warm cache | ADMIN or system:cache:write |
| Invalidate cache | ADMIN or system:cache:write |
| Invalidate all | SUPER_ADMIN only |
| My permissions/roles | Any authenticated user |