Permission Revocation and Active Sessions

Working case

Reviewer 29 is removed from organization 6 during an open editing session. The browser still shows case 47 and an already connected event stream. A stale role claim in a long-lived token would let the user save or continue receiving notes. The API checks the current permission version for each sensitive request, the live channel closes or filters messages when membership changes, and private browser caches are cleared on account switch. An export job accepted before revocation follows a documented policy: it either stops before artifact creation or completes only for an already authorized, short-lived recipient grant.

Implementation boundary

function grantIsCurrent(session, account) {
  return session.permissionVersion === account.permissionVersion && session.tenantId === account.tenantId;
}
console.log(grantIsCurrent({ permissionVersion: 3, tenantId: 6 }, { permissionVersion: 4, tenantId: 6 }));
// Output: false

The version comparison is a simple model; run it against trusted current account state. Increment a permission version when role or membership changes and make sensitive requests compare it before reading protected data. If checking central state for every static request is too expensive, separate public assets from private actions and bound the refresh interval deliberately. Close or reauthorize subscriptions after membership changes. Invalidate caches that vary by role, deny old signed download grants when feasible, and document queued-job behavior. A tab notification helps clear local data promptly but cannot replace server enforcement, since the tab may be asleep or offline.

Cost and boundaries

A central version lookup can add O(1) read work to each protected request and can become a hot path under high traffic. A short-lived cache reduces reads but extends the revocation delay by its lifetime. Streaming connections need periodic or event-driven permission reevaluation; frequent checks cost more but limit unauthorized data after removal. The number of cached variants also grows with permission versions until expiry. Measure the longest observed revocation delay from admin action to denied read, write, live event, and download—not only the time until buttons disappear.

Failure trace

An administrator removes reviewer 29, and the visible button vanishes after a refresh, but an old tab can still POST to the API with a stale signed role claim. Frontend removal is not a policy change. The server must reject the request. Another failure clears API cache yet leaves a live event stream delivering private updates for an hour. Test revocation against every channel and artifact. Do not assume a broadcast message reaches suspended tabs; permission checks must remain server-owned.

Verification

• A revoked user cannot write with an old active session.
• Live and cached private data stop after the defined revocation bound.
• Queued jobs and downloads have an explicit revocation rule.

Practice drill

Open two tabs and a live stream for reviewer 29, then remove the reviewer from organization 6. Time the first denied detail read, update, stream event, and artifact download. Keep one tab suspended and retry on wake. Start an export immediately before revocation and verify its documented continuation rule. Re-add the reviewer with a new permission version and check that old cache entries are not reused across the change. Include a second tenant to prove tenant switching cannot revive stale grants.

Decision note

Bound authorization staleness on the server and test revocation across every private delivery channel.

Common Mistakes

• Treating hidden controls as permission enforcement.
• Keeping long-lived role claims without a freshness check.
• Forgetting live streams and export artifacts during revocation.

Connected lessons

Authorization and Tenant Boundaries; Object-Level Authorization for Reads and Writes; Tenant Scope in Cache and Background Work; Private Export Authorization and Artifact Scope; Account Recovery and Session Revocation; Live Update Reconnect and Event Ordering; Cross-Tab Invalidation and Version Checks.

Apply and check

Build Project: tenant-safe case export and review Web Development: authorization and data lifecycle decisions quiz.

Further connections

Push Subscription Account Binding and Rotation; Private Notification Payload and Click Routing.

Further connections

Refresh Token Rotation and App Session Boundary.