- Ya
- 3 Septemba 2026, 04:28 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 8dc3ea4
SecurityService answers /api/security/entitlements/me out of Redis with a 15-minute TTL, invalidated by messages on kamo.entitlements.invalidate. Every self-serve billing path publishes there when it changes a subscription; provisionCompSubscription never did. So a freshly comped organization went on being served its pre-comp answer for up to fifteen minutes, and the browser's own ~60s cache on top of that. The nav trial chip kept counting down, the upgrade offer kept advertising a discount, and the feature grants stayed on the trial's catalogue — all of it describing a subscription that no longer existed. The row was right; everything reading it was stale. Publish both keys. They answer different questions: SUBSCRIPTION reaches the licence holders, ORG reaches every member of the organization — and the trial banner is deliberately org-level, so a member holding no seat has a stale answer of their own to drop. The template is injected optionally and the publish never throws. A comp that provisioned correctly must not report failure because a cache could not be notified, and a service embedding this library without Redis must still be able to sell a subscription.