From 68bd8290e55e6024cffe7183337cbb0a2dffdc0b Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Mon, 8 Jun 2026 18:17:14 +0530
Subject: [PATCH] fix: bump agent cache when custom role changes

Editing or deleting a custom role left warm IDB caches showing stale
embedded role details and permissions in the agent list, since the
account_user cache key only tracked custom_role_id on the account user.
Bump the account_user cache key from the custom role lifecycle so clients
refetch the agent list. The destroy bump is needed because dependent:
nullify updates account_users via update_all and skips their callbacks.
---
 enterprise/app/models/custom_role.rb       |  7 +++++++
 spec/enterprise/models/custom_role_spec.rb | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/enterprise/app/models/custom_role.rb b/enterprise/app/models/custom_role.rb
index 666f91378..5b3ec8f85 100644
--- a/enterprise/app/models/custom_role.rb
+++ b/enterprise/app/models/custom_role.rb
@@ -39,4 +39,11 @@ class CustomRole < ApplicationRecord
 
   validates :name, presence: true
   validates :permissions, inclusion: { in: PERMISSIONS }
+
+  # CustomRole details are embedded into the cached account_user payload via
+  # api/v1/models/_account_user.json.jbuilder, so bump that cache key on any
+  # change. `dependent: :nullify` updates account_users via update_all (which
+  # skips their callbacks), so the deletion is bumped here directly.
+  after_update_commit -> { account.update_cache_key('account_user') }
+  after_destroy_commit -> { account.update_cache_key('account_user') }
 end
diff --git a/spec/enterprise/models/custom_role_spec.rb b/spec/enterprise/models/custom_role_spec.rb
index f63f3c2dd..e6222d6ad 100644
--- a/spec/enterprise/models/custom_role_spec.rb
+++ b/spec/enterprise/models/custom_role_spec.rb
@@ -9,4 +9,19 @@ RSpec.describe CustomRole, type: :model do
   describe 'validations' do
     it { is_expected.to validate_presence_of(:name) }
   end
+
+  describe 'account_user cache invalidation' do
+    let(:custom_role) { create(:custom_role) }
+
+    it 'bumps the account_user cache key after update' do
+      expect(custom_role.account).to receive(:update_cache_key).with('account_user')
+      custom_role.update(name: 'New Name')
+    end
+
+    it 'bumps the account_user cache key after destroy' do
+      custom_role
+      expect(custom_role.account).to receive(:update_cache_key).with('account_user')
+      custom_role.destroy
+    end
+  end
 end