1.5.0
Permission query performance and reverse inheritance
2026-06-27 · #10 · closes #8, #9
Total logical reads across the 21 permission query variants drop from 89,158 to 4,933 — a 94% reduction.
- The recursive CTE view for group membership is replaced by a trigger-maintained
RecursiveGroupMemberstable, eliminating repeated CTE evaluation and worktable spills on every permission check. - Composite covering indexes across all role assignment tables and GroupMembers, with filtered indexes split by principal type.
- Reverse inheritance — a role assignment on a Module or Namespace now grants read access to its parent Namespace or Stack, so someone granted access to one module can see where it lives.
- Adds Stack-level permission checks that were missing from
StackSecuredRepository, which previously consulted only organization-level roles.