From 108cc5b6a57113732d61304fded4c9c5b26889b2 Mon Sep 17 00:00:00 2001
From: Weiko <corentin@twenty.com>
Date: Thu, 25 Jun 2026 13:53:58 +0200
Subject: [PATCH] API key creation triggers unnecessary ORMEntityMetadatas
 cache recomputation (#22168)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Context

Creating an API key only changes role/apiKey-related data, but the
workspace migration runner was also invalidating and recomputing the
metadata caches (`ORMEntityMetadatas` and `graphQLResolverNameMap`) on
it.

The root cause is a single `if` block in
`getLegacyCacheInvalidationPromises` that gated **all** caches with an
`||` condition combining the metadata and role/permission conditions:

```ts
if (
  shouldIncrementMetadataGraphqlSchemaVersion ||
  shouldInvalidateRoleMapCache ||
  shouldInvalidateRolesPermissionsCache
) {
  // recomputes role caches AND ORMEntityMetadatas + graphQLResolverNameMap
}
```

So any role-only change (such as API key creation, which sets
`shouldInvalidateRoleMapCache`) also recomputed `ORMEntityMetadatas` —
an expensive recomputation that does not depend on role data.

## Fix

Split the combined block into two independent blocks, each gated by its
own condition:

- `shouldIncrementMetadataGraphqlSchemaVersion` → invalidate/recompute
only the metadata-derived caches: `ORMEntityMetadatas` and
`graphQLResolverNameMap`
- `shouldInvalidateRoleMapCache ||
shouldInvalidateRolesPermissionsCache` → invalidate/recompute only the
role/permissions caches

`graphQLResolverNameMap` is built from `flatObjectMetadataMaps` (see
`WorkspaceResolverNameMapCacheService`), so it is grouped with
`ORMEntityMetadatas` in the metadata block rather than the role block.

## Result

- Role-only changes (e.g. API key creation) no longer trigger
unnecessary `ORMEntityMetadatas` / `graphQLResolverNameMap`
recomputation.
- Metadata-only changes no longer recompute the role/permissions caches.
---
 .../workspace-migration-runner.service.ts       | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/packages/twenty-server/src/engine/workspace-manager/workspace-migration/workspace-migration-runner/services/workspace-migration-runner.service.ts b/packages/twenty-server/src/engine/workspace-manager/workspace-migration/workspace-migration-runner/services/workspace-migration-runner.service.ts
index de4902d64b..a36516dba1 100644
--- a/packages/twenty-server/src/engine/workspace-manager/workspace-migration/workspace-migration-runner/services/workspace-migration-runner.service.ts
+++ b/packages/twenty-server/src/engine/workspace-manager/workspace-migration/workspace-migration-runner/services/workspace-migration-runner.service.ts
@@ -93,20 +93,23 @@ export class WorkspaceMigrationRunnerService {
       flatMapsKeysSet.has('flatFieldPermissionMaps') ||
       flatMapsKeysSet.has('flatRolePermissionFlagMaps');
 
-    if (
-      shouldIncrementMetadataGraphqlSchemaVersion ||
-      shouldInvalidateRoleMapCache ||
-      shouldInvalidateRolesPermissionsCache
-    ) {
+    if (shouldIncrementMetadataGraphqlSchemaVersion) {
+      asyncOperations.push(
+        this.workspaceCacheService.invalidateAndRecompute(workspaceId, [
+          'ORMEntityMetadatas',
+          'graphQLResolverNameMap',
+        ]),
+      );
+    }
+
+    if (shouldInvalidateRoleMapCache || shouldInvalidateRolesPermissionsCache) {
       asyncOperations.push(
         this.workspaceCacheService.invalidateAndRecompute(workspaceId, [
           'rolesPermissions',
           'userWorkspaceRoleMap',
           'flatRoleTargetMaps',
           'apiKeyRoleMap',
-          'ORMEntityMetadatas',
           'flatRoleTargetByAgentIdMaps',
-          'graphQLResolverNameMap',
         ]),
       );
     }