From 3f8a8c93a7fc1fa17078057b14d932f4a2d23f88 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Fri, 21 Aug 2026 02:16:24 +0200 Subject: [PATCH] fix(critical): permission cache returns None causing 500 on every authenticated API call - get_cached_permissions() returned None when _get_current_permission_version failed - deps.py get_current_user() crashed with AttributeError: NoneType.get() - Fix: fall through to DB resolution instead of returning None - Fix: add None guard in deps.py as safety net --- app/core/permissions.py | 2 +- app/deps.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/app/core/permissions.py b/app/core/permissions.py index e453ad7..ef72db1 100644 --- a/app/core/permissions.py +++ b/app/core/permissions.py @@ -340,7 +340,7 @@ async def get_cached_permissions( exc_info=True, ) await redis.delete(cache_key) - return None # Fall through to re-resolution from DB + # Fall through to re-resolution from DB (don't return None) if cached_version == current_version: return data diff --git a/app/deps.py b/app/deps.py index 964ff06..1323fa7 100644 --- a/app/deps.py +++ b/app/deps.py @@ -125,6 +125,8 @@ async def get_current_user( user_id = uuid.UUID(session_data["user_id"]) resolved = await get_cached_permissions(db, redis, user_id, tenant_id) + if not resolved: + resolved = {"permissions": [], "denied": [], "field_permissions": {}, "is_system_admin": False} session_data["permissions"] = resolved.get("permissions", []) session_data["denied_permissions"] = resolved.get("denied", []) session_data["field_permissions"] = resolved.get("field_permissions", {})