Phase 7

src/lib/auth/permissions.ts

@@ -1,3 +1,4 @@
+import { cache } from "react";
 import { prisma } from "@/lib/db/prisma";
 import type { Permission } from "@/generated/prisma/enums";
 
@@ -8,8 +9,14 @@ import type { Permission } from "@/generated/prisma/enums";
  * without waiting for the token to expire. See
  * docs/implementation-plan.md §11 ("Permission enforcement happens AGAIN
  * at the server-action/service layer — never trust the route group alone").
+ *
+ * `cache()`-wrapped (same request-dedup pattern as getActingStaff/
+ * getPrimaryBusiness) — every (owner) page checks 1-2 permissions across
+ * its layout and the page itself, which without this repeated the same
+ * StaffProfile+Role+RolePermission join 2-3× per request (see the Phase 7
+ * performance pass).
  */
-export async function getStaffPermissions(userId: string): Promise<Set<Permission>> {
+export const getStaffPermissions = cache(async (userId: string): Promise<Set<Permission>> => {
   const staffProfile = await prisma.staffProfile.findUnique({
     where: { userId },
     include: { role: { include: { permissions: true } } },
@@ -17,7 +24,7 @@ export async function getStaffPermissions(userId: string): Promise<Set<Permissio
 
   if (!staffProfile) return new Set();
   return new Set(staffProfile.role.permissions.map((rolePermission) => rolePermission.permission));
-}
+});
 
 export async function hasPermission(userId: string, permission: Permission): Promise<boolean> {
   const permissions = await getStaffPermissions(userId);