Authentication at Scale

import { LRUCache } from 'lru-cache';

// L1: in-process, tiny TTL. Absorbs the hot users with zero network.
const l1 = new LRUCache({ max: 10_000, ttl: 5_000 });

// Single-flight: one recompute per key, however many callers arrive at once.
const inFlight = new Map();

async function cachedSession(sid) {
  const hit = l1.get(sid);
  if (hit !== undefined) return hit;

  const existing = inFlight.get(sid);
  if (existing) return existing;            // ← prevents the cache stampede

  const promise = (async () => {
    try {
      // L2: Redis, the source of truth.
      const raw = await redis.get(`sess:${hash(sid)}`);
      const value = raw ? JSON.parse(raw) : null;
      l1.set(sid, value, { ttl: value ? 5_000 : 1_000 });   // cache misses briefly too
      return value;
    } finally {
      inFlight.delete(sid);
    }
  })();

  inFlight.set(sid, promise);
  return promise;
}

// The staleness contract you must be able to state out loud:
//   "Revocation takes effect within 5 seconds, because that is the L1 TTL."
// If that is unacceptable, publish invalidations instead of shortening the TTL
// to zero:
redis.subscribe('session-revoked', (sid) => l1.delete(sid));

// Measure the layer, not just the endpoint.
app.use((req, res, next) => {
  const start = process.hrtime.bigint();
  res.on('finish', () => {
    metrics.histogram('auth.duration_us',
      Number(process.hrtime.bigint() - start) / 1000,
      { result: req.user ? 'ok' : 'rejected', layer: req.authLayer ?? 'none' });
  });
  next();
});

// ❌ The bypass that gets written during an incident and never removed
async function authBad(req, res, next) {
  try {
    req.user = await lookupSession(req.cookies.sid);
  } catch (err) {
    logger.warn('session store down, allowing request');   // ← total bypass
    req.user = { id: 'unknown' };
  }
  next();
}

// ✅ Fail closed, and say which kind of failure it was
async function auth(req, res, next) {
  let session;
  try {
    session = await lookupSession(req.cookies.sid);
  } catch (err) {
    // Infrastructure failure is NOT an authentication failure. 503 tells the
    // client to retry; 401 would make it throw away a perfectly good session.
    metrics.increment('auth.store_error');
    logger.error({ err }, 'session store unavailable');
    res.set('Retry-After', '5');
    return res.status(503).json({ error: 'service_unavailable' });
  }

  if (!session) return res.status(401).json({ error: 'authentication_required' });

  req.user = { id: session.userId };
  next();
}

// The distinction matters operationally:
//   401 → "your credential is bad"     → client re-authenticates
//   503 → "we are broken, not you"     → client retries with backoff
// Returning 401 during an outage logs your entire user base out, and they all
// hit the login endpoint at once — turning a partial outage into a full one.

// Roles change rarely and are read constantly — a good cache. But a TTL alone
// means a demoted admin keeps their powers until it expires.
const permCache = new LRUCache({ max: 50_000, ttl: 60_000 });

export async function permissionsFor(userId, tenantId) {
  const key = `${userId}:${tenantId}`;
  const hit = permCache.get(key);
  if (hit) return hit;

  const membership = await db.memberships.findOne({ userId, tenantId });
  const perms = membership ? SCOPES_BY_ROLE[membership.role] : [];
  permCache.set(key, perms);
  return perms;
}

// Any write to a membership publishes an invalidation to EVERY instance.
export async function changeRole(userId, tenantId, role) {
  await db.memberships.update({ userId, tenantId }, { role });

  // Local + fleet-wide. The publish is what makes the cache safe.
  permCache.delete(`${userId}:${tenantId}`);
  await redis.publish('perms-changed', JSON.stringify({ userId, tenantId }));

  // Irreversible removals should not wait for a cache at all.
  if (role === 'removed') {
    await destroyAllSessionsFor(userId, tenantId);
    await db.users.increment(userId, 'tokenVersion');
  }
}

redis.subscribe('perms-changed', (msg) => {
  const { userId, tenantId } = JSON.parse(msg);
  permCache.delete(`${userId}:${tenantId}`);
});

// Rule of thumb for the interview: cache reads, invalidate on writes, and for
// anything irreversible go to the source of truth. A TTL is a guess about how
// much staleness is acceptable; an invalidation is an answer.