perf(auth): memoize getAuthToken and refreshToken row read (CLI-13V)

[BYK]

Summary

Fixes CLI-13V — N+1 Query detector flagged sentry.issue.view on every run, culprit getAuthToken.

Every outgoing API request hit the SQLite auth row three times:

1. tryCacheHit → authHeaders(getAuthToken()) — cache-key build
2. fetchWithRetry → refreshToken() — its own raw SELECT * FROM auth WHERE id = 1
3. cacheResponse(..., authHeaders(getAuthToken())) — on cache miss

Each getAuthToken() was wrapped by withDbSpan plus the traced-statement proxy, producing paired db.operation/db spans. With 12 offender spans per pattern repetition, the performance detector flagged it.

Repeating pattern in the trace before this fix:

http.client  - GET /api/0/organizations/.../shortids/EVA-B7V/
  db.operation - getAuthToken
    db         - SELECT * FROM auth WHERE id = 1
  cache.get    - ...

Approach

Mirror the existing cachedFingerprint memo-and-reset pattern (src/lib/db/auth.ts:290+):

• Add cachedAuthToken memo for getAuthToken().
• Add cachedAuthRow memo for refreshToken()'s full-row read.
• Both use { value: T | undefined } | undefined wrapper objects to distinguish "not cached" from "cached as undefined" (logged-out) — avoids re-querying on every call in the logged-out case.
• Invalidation hooks (resetAuthTokenCache, resetAuthRowCache) wired into both mutation points (setAuthToken, clearAuth) alongside the existing resetIdentityFingerprintCache().

Safe under OAuth token rotation and 401 force-refresh because both paths route writes through setAuthToken, which now invalidates all three auth caches.

Net Impact

• Per API request: 3 auth-row SQL reads → 1 (on first call), 0 on subsequent calls within the command.
• Per command: getAuthToken span appears at most once, not per API request.

Testing

• test/lib/db/auth.test.ts — new getAuthToken memoization suite (5 tests: cache hit, logged-out caching, setAuthToken invalidation, clearAuth invalidation, env-var contract) and refreshToken row-read memoization suite (2 tests).
• test/helpers.ts — useTestConfigDir now invalidates both caches in beforeEach/afterEach so module-scoped memos can't leak across test files.
• test/lib/db/auth.property.test.ts — resetAuthCaches() helper called at the top of each property iteration (env-var mutations bypass the internal invalidation hooks).
• test/lib/db/model-based.test.ts — env-var commands and test setup invalidate the caches; this actually fixed one previously-flaky assertion (clearAuth also clears pagination cursors).

All 56 auth-related tests pass. Full suite has the same number of pre-existing flaky failures as baseline (minus one this PR fixed).

Verification

bun test test/lib/db/auth.test.ts test/lib/db/auth.property.test.ts test/lib/db/model-based.test.ts

Manual trace verification: run bun run dev -- issue view <id> with SENTRY_DSN set and confirm the getAuthToken span appears at most once per command in the resulting trace.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-828/
Built to branch gh-pages at 2026-04-23 11:21 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Codecov Results 📊

✅ 138 passed | Total: 138 | Pass Rate: 100% | Execution Time: 0ms

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	—
Failed Tests	—
Skipped Tests	—

✨ No test changes detected

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 1944 uncovered lines.
✅ Project coverage is 95.28%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    95.27%    95.28%    +0.01%
==========================================
  Files          284       284         —
  Lines        41152     41183       +31
  Branches         0         0         —
==========================================
+ Hits         39206     39239       +33
- Misses        1946      1944        -2
- Partials         0         0         —

---

Generated by Codecov Action