feature(request-context): implement request-scoped memoization for optimized DB reads

[victorvhs017]

Context

Adds request-scoped memoization so repeated read-only work in a single HTTP request (permissions, project/user/identity lookups) hits the database once instead of many times—especially on batch secret paths.

Before: Each call path could repeat getProjectPermission / getOrgPermission, projectDAL.findById, and actor lookups independently within the same request.

After:

• Introduces RequestMemoizer (getOrSet with in-flight deduplication) stored on @fastify/request-context as memoizer (wired in app.ts per existing pattern in the branch).
• Adds requestMemoize(key, fetcher) which uses the memoizer when present and falls back to a direct fetch when there is no request context (e.g. workers).
• Centralizes memo key strings in src/lib/request-context/memo-keys.ts and request-context string keys in request-context-keys.ts (kept in sync with RequestContextData in fastify.d.ts).
• Permission service: getOrgPermission wrapped with requestMemoize; getProjectPermission uses memoizer.getOrSet for full-function memoization (key includes actorOrgId) and defers requestContext.set for projectDetails / identityPermissionMetadata until after the memoized load completes. DAL reads use requestMemoize for projectFindById, userFindById, and identityFindById.
• Replaces raw requestContext.get("…") / set string literals with requestContextKeys in touched files (logger, audit log, SAML/OIDC telemetry, assume-privilege router, permission service).
• Documents the pattern in backend/CLAUDE.md (Request-Scoped Memoization section).
• Unit tests in request-memoizer.test.ts for caching, in-flight coalescing, error behavior, and cross-request isolation.

Steps to verify the change

1. Knex query logging (temporary): Enable SQL logging (e.g. Knex debug against the dev DB) while exercising a hot path that previously repeated lookups (e.g. batch secret read/list for one project).

backend/src/db/instance.ts

2. API call: Issue the same request shape you use in production or staging (same projectId, same auth) and compare number of SELECT statements (or log lines) before vs after—project load, permission resolution, and actor lookups should collapse to a single round-trip per distinct key within one request.

For example:

# Create a machine identity + access token if you don't have one
# Then fetch a single secret:
curl -H "Authorization: Bearer <identity-access-token>" \
  http://localhost:8080/api/v3/secrets/raw/<secretName>?workspaceId=<projectId>&environment=dev

# List all secrets (triggers getProjectPermission once, reused for all):
curl -H "Authorization: Bearer <identity-access-token>" \
  "http://localhost:8080/api/v3/secrets/raw?workspaceId=<projectId>&environment=dev"

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
  Suggested title: perf(backend): request-scoped memoization for permissions and project lookups
• Tested locally
• Updated docs (if needed) — backend/CLAUDE.md updated for memoization
• Updated CLAUDE.md files (if needed)
• Read the contributing guide

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0c0b7521b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[linear]

ENG-4818 Request-scoped memoization (permissions + hot DAL lookups)

[akhilmhdh]

Overall looking good! Some questions

Pending application testing

[akhilmhdh]

Is permission a big hitter? Generally i feel like this only called once per endpoint

[akhilmhdh]

My reasoning is - permission is a big object, so storing it in context may not be desirable

[victorvhs017]

I did some search and we have this pattern mostly on secret v3 endpoints and secrets overview, which would be enough reason to use it. But, I also find it good to have as a safeguard, because it's used a lot and we may miss a duplicated call here and there.

We can track the memory usage after the change, if the footprint rises too much, we remove it from here and fix the places we know directly

[akhilmhdh]

Application testing looking good. Just need to check on the above comments