I'm ingesting 150 objects that each require an user capabilities check, the function
isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper checks and so on. It'd be really, really nice if I could cache this stuff so I don't have to check for 150 objects.
I'd like to, before anything loads, determine who the user is and set up things that in practice, don't change -- or do they? Assume a super admin changes the privileges of an admin user mid-request but I've already set his privilege information, so, assume this
admin has the capability to delete other users, he's running a request to do that, but during that time, the
superadmin says "nope, can't do that anymore", but because on that request I already set that user's permissions, this will not take effect and the
admin will still be able to delete users.
What's the fix here? Setting information pre-emptively is basically dangerous in an async-by-proxy environment (which everything is) but not doing this makes me perform the same check 150 times in a row.
I feel like this is a chicken & egg problem and every time I'm faced with such issue, I'm not seeing a vital angle. What am I missing?