@palbase/backend 14.1.0 → 14.2.0

package/docs/auth.md

@@ -45,6 +45,8 @@ admin users API); `role` is the **database** role RLS reads and is always
 `emailVerified` is likewise read from the verified profile rather than a JWT
 claim: a claim is only true as of when the token was minted, so a user who
 verifies mid-session would keep reporting `false` until their token expired.
+Profile reads are cached for ~30 seconds, so a change shows up within that
+window, not on the very next request.
 
 ## Roles
 
@@ -60,8 +62,12 @@ export default class AdminController {
 
 Not signed in → `401`. Signed in with a different (or missing) role → `403`. A
 role gate implies authentication, so the caller is resolved even on a route with
-no `@User()` parameter. The role is read from the verified profile per request,
-so revoking it takes effect on the next call rather than at token expiry.
+no `@User()` parameter.
+
+The role is read from the verified profile, not from a claim baked into the
+token, so revoking it takes effect **within ~30 seconds** — the runtime caches a
+verified identity for that long — rather than whenever the token happens to
+expire.
 
 ## Email verification
 

package/docs/llms-full.txt

@@ -689,6 +689,8 @@ admin users API); `role` is the **database** role RLS reads and is always
 `emailVerified` is likewise read from the verified profile rather than a JWT
 claim: a claim is only true as of when the token was minted, so a user who
 verifies mid-session would keep reporting `false` until their token expired.
+Profile reads are cached for ~30 seconds, so a change shows up within that
+window, not on the very next request.
 
 ## Roles
 
@@ -704,8 +706,12 @@ export default class AdminController {
 
 Not signed in → `401`. Signed in with a different (or missing) role → `403`. A
 role gate implies authentication, so the caller is resolved even on a route with
-no `@User()` parameter. The role is read from the verified profile per request,
-so revoking it takes effect on the next call rather than at token expiry.
+no `@User()` parameter.
+
+The role is read from the verified profile, not from a claim baked into the
+token, so revoking it takes effect **within ~30 seconds** — the runtime caches a
+verified identity for that long — rather than whenever the token happens to
+expire.
 
 ## Email verification
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@palbase/backend",
-  "version": "14.1.0",
+  "version": "14.2.0",
   "description": "Palbase Backend SDK — class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
   "license": "MIT",
   "repository": {