Permission change propagation

Group membership and account detail changes take effect on the next request, typically within a few seconds..

Automation orchestrator uses a token version counter to signal that a refresh is needed:

  1. When a user's account or group membership changes, automation orchestrator increments the token version for that user.
  2. On each API request, the StaleTokenMiddleware compares the token_ver claim in the access token against the current version in the database. Automation orchestrator caches this lookup for 5 seconds.
  3. If the token version is outdated, automation orchestrator rejects the request with a 401 TOKEN_STALE error. The response is retryable and sets the X-Auth-Failure-Type: stale_token header.

When a client receives a 401 TOKEN_STALE error, it must use the refresh token to get a new access token. The client then retries the request. Automation orchestrator does not provide a grace period for the old access token.

The /api/v1/auth/refresh and /api/v1/auth/logout endpoints are exempt from the stale-token check so that clients can refresh the token or complete logout.