v1.5.0: Permission query performance and reverse inheritance
Total logical reads across the 21 permission query variants drop from 89,158 to 4,933 — a 94% reduction.
Full notes: 1.5.0 on GitHub.
What changed
The recursive CTE view for group membership is replaced by a trigger-maintained RecursiveGroupMembers table managed through EF Core, eliminating repeated CTE evaluation and worktable spills on every permission check.
Composite covering indexes were added across all role assignment tables and GroupMembers, with filtered indexes on StackRoleAssignments and NamespaceRoleAssignments split by principal type. GroupMembers joins now pre-filter by principal inside the subquery rather than in the outer clause.
Reverse inheritance
A role assignment on a Module or Namespace now grants read access to the parent Namespace or Stack, so a principal granted access to a module can see the hierarchy containing it.
StackSecuredRepository gains a complete query implementation with eight read branches covering direct and group-derived assignments at organization, stack, namespace and module level.
Stack-level checks
Stack-level permission checks were missing from StackSecuredRepository entirely — it previously consulted only organization-level roles. Those now apply.
Intelligent GitOps for Infrastructure as Code. Automate, orchestrate, and scale your infrastructure deployments with confidence.
© 2026 Snap CD. All rights reserved.