From dd9d8280186d9bb228dafe3479b570da38b471e3 Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Fri, 12 Jun 2026 19:08:31 +0200 Subject: [PATCH] docs(audit-2026-06-11/tier3): fix stale principal_cache field comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review nit — the field is a non-optional Arc; the old '`None` for tests' note was stale. Clarify that it's one shared Arc so revocation-side evictions are visible to the middleware's resolve-side lookup. Co-Authored-By: Claude Opus 4.8 (1M context) --- crates/manager-core/src/auth_middleware.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/crates/manager-core/src/auth_middleware.rs b/crates/manager-core/src/auth_middleware.rs index 551e37b..bd0cf9a 100644 --- a/crates/manager-core/src/auth_middleware.rs +++ b/crates/manager-core/src/auth_middleware.rs @@ -138,8 +138,9 @@ pub struct AuthState { pub keys: Arc, pub ttl: Duration, /// F-P-009 — shared cache of resolved Principals. Constructed once - /// at startup; cloned cheaply into every router state. `None` for - /// tests / harnesses that don't wire it. + /// at startup and cloned (same `Arc`) into every router state that + /// resolves or revokes credentials, so a revocation-side eviction is + /// visible to this resolve-side lookup. pub principal_cache: Arc, /// Audit 2026-06-11 H-B1 — per-`(remote_ip, username)` + per-`username` /// burst limiter for `/auth/login`. Cheap to clone (Arc).