[DEFECT] Cache Not Flushed After User Permission Update

Problem Statement

There is a caching problem related to user permission configuration. This issue occurs every time a permission for a user is modified. Upon making a modification, the cache is not flushed, leading the user to perceive that no changes have occurred and that the permissions are not working. This issue is reproducible consistently and impacts any user whose permissions are being managed, leading to confusion and functional blockers when permissions are expected to take immediate effect

Steps to Reproduce

1. Select a user and verify that they do not have a specific permission enabled (e.g., using the /drive/search endpoint as shown in the video)
2. Navigate to Settings -> Users and select the aforementioned user
3. From the 'Permissions' tab, modify the user's permissions to grant access to the resource in question (e.g., the /drive/search endpoint)
4. Verify the permission again by repeating step 1 (e.g., attempt to execute the /drive/search endpoint)

Expected Result: The permission should update correctly, and the endpoint should allow execution by the user
Actual Result: The permission remains outdated due to the cache, preventing the endpoint call

https://github.com/user-attachments/assets/f3126eb8-b908-40b6-bbea-9a395d96b32b

Acceptance Criteria

To resolve this issue, the following objective criteria must be met:

• When a change is made to any user's permissions, the corresponding cache must be updated with that change
• If an attempt is made to access a resource that is under a permission and this access is initially denied, enabling the permission must allow repeating the access attempt successfully without the need for a manual cache flush

dotCMS Version

main

Severity

Medium - Some functionality impacted

Links

NA

Start by tracing the user permission update flow from Settings > Users > Permissions and the authorization check for the /drive/search endpoint, then identify where permission results are cached. Verify the cache is refreshed after permission changes and that a previously denied request succeeds on retry without a manual flush.