perf(api): кэш профиля и конфигурации, лимитер argon2, SHA-256 для client secret, trust proxy

apps/api/src/lib/issue-access-token.ts

@@ -12,17 +12,20 @@ import {
   type UserRow,
 } from '@authportal/db'
 import { toMe } from '../plugins/auth-guards.js'
+import { getUserProfile } from './user-profile.js'
 
 /** Mint access JWT + Me from current DB state (login / reissue). */
 export function issueAccessToken(
   app: FastifyInstance,
   user: UserRow,
 ): LoginResponse {
-  const apps = getUserApps(app.db, user.id)
-  let permissions = normalizePermissionKeys(getUserPermissions(app.db, user.id))
-  if (user.isAdmin) {
-    permissions = allPermissionKeys()
-  }
+  // Профиль из кэша (инвалидируется записями в users/доступ); user — свежая строка вызывающего.
+  const profile = getUserProfile(app.db, user.id)
+  const apps = profile?.apps ?? getUserApps(app.db, user.id)
+  const permissions = user.isAdmin
+    ? allPermissionKeys()
+    : (profile?.permissions ??
+      normalizePermissionKeys(getUserPermissions(app.db, user.id)))
   const switcher = getAppSwitcherConfig(app.db)
   const tenants = tenantsClaimForUser(switcher, apps)
   const me = toMe(user, apps, permissions)