v1.0.25

src/lib/server/auth.ts

@@ -44,6 +44,7 @@ import {
 import { Client as LdapClient } from 'ldapts';
 import { isEnterprise } from './license';
 import { secureRandomBytes } from './crypto-fallback';
+import { invalidateTokenCacheForUser } from './token-cache';
 
 // Session cookie name
 const SESSION_COOKIE_NAME = 'dockhand_session';
@@ -735,6 +736,9 @@ async function tryLdapAuth(
 			}
 		}
 
+		// Clear cached token permissions after role sync
+		invalidateTokenCacheForUser(user.id);
+
 		if (!user.isActive) {
 			return { success: false, error: 'Account is disabled' };
 		}
@@ -1449,6 +1453,9 @@ export async function handleOidcCallback(
 			}
 		}
 
+		// Clear cached token permissions after role sync
+		invalidateTokenCacheForUser(user.id);
+
 		if (!user.isActive) {
 			return { success: false, error: 'Account is disabled' };
 		}