Denormalize bearer role onto token

app/models/license.rb

@@ -4,7 +4,7 @@ class License < ApplicationRecord
   include Envented::Callbacks
   include Keygen::PortableClass
   include AsyncTouchable
-  include Denormalizable
+  include Denormalizable::Model
   include Environmental
   include Accountable
   include Limitable

app/models/machine.rb

@@ -7,7 +7,7 @@ class ResurrectionExpiredError < StandardError; end
   include Envented::Callbacks
   include Keygen::PortableClass
   include AsyncTouchable
-  include Denormalizable
+  include Denormalizable::Model
   include Environmental
   include Accountable
   include Limitable

app/models/policy.rb

@@ -7,7 +7,7 @@ class UnsupportedPoolError < StandardError; end
   class EmptyPoolError < StandardError; end
 
   include Keygen::PortableClass
-  include Denormalizable
+  include Denormalizable::Model
   include Environmental
   include Accountable
   include Limitable

app/models/role.rb

@@ -3,6 +3,7 @@
 class Role < ApplicationRecord
   include Keygen::EE::ProtectedMethods[:permissions=, entitlements: %i[permissions]]
   include Keygen::PortableClass
+  include Denormalizable::Model
   include Accountable
   include Dirtyable
 
@@ -39,6 +40,11 @@ def actions = loaded? ? collect(&:action) : super
   # NB(ezekg) we're using account over account_id here because it may not be persisted
   has_account default: -> { resource&.account }
 
+  # NB(ezekg) an explicit :inverse_of is required because Environment#tokens is
+  #           scoped to the environment, not to the environment as a bearer
+  denormalizes :name,
+    to: :tokens, through: :resource, inverse_of: :bearer, as: :bearer_role
+
   # FIXME(ezekg) replace with accountable concern i.e. an association
   delegate :default_permissions, :default_permission_ids,
     :allowed_permissions, :allowed_permission_ids,
@@ -133,10 +139,16 @@ def pending_permissions
   # permission_ids returns an array of the role's permission IDs,
   # including pending changes.
   def permission_ids
-    if role_permissions_attributes_assigned?
+    case
+    when role_permissions_attributes_assigned?
       role_permissions_attributes.collect { it[:permission_id] }
-    else
+    when role_permissions.loaded?
       role_permissions.collect(&:permission_id)
+    else
+      # NB(ezekg) avoid loading the association just to read ids, since a
+      #           loaded through-association will result in n+1 queries on
+      #           subsequent permission reads
+      role_permissions.pluck(:permission_id)
     end
   end
 
@@ -243,15 +255,17 @@ def autosave_associated_records_for_role_permissions
       if role_permissions_attributes.any?
         # FIXME(ezekg) Can't use role_permissions.upsert_all at this point, because for
         #              some reason role_id ends up being nil. Instead, we'll use the
-        #              class method and then call reload.
+        #              class method and then reset the stale associations.
         RolePermission.upsert_all(
           role_permissions_attributes.map { it.merge(role_id: id) },
           record_timestamps: true,
           on_duplicate: :skip,
         )
       end
 
-      reload
+      # reset stale associations after the bulk upsert
+      role_permissions.reset
+      permissions.reset
     end
   end
 end

app/models/session.rb

@@ -4,7 +4,7 @@ class Session < ApplicationRecord
   MAX_AGE = 2.weeks
 
   include AsyncUpdatable, AsyncDestroyable
-  include Denormalizable
+  include Denormalizable::Model
   include Environmental
   include Accountable
 

app/models/token.rb

@@ -9,6 +9,7 @@ class Token < ApplicationRecord
   include Environmental
   include Accountable
   include Tokenable
+  include Denormalizable::Model
   include Limitable
   include Orderable
   include Pageable
@@ -46,6 +47,9 @@ def actions = loaded? ? collect(&:action) : super
     # Default to wildcard permission but allow all
     default: %w[*]
 
+  denormalizes :name,
+    from: :role, through: :bearer, as: :bearer_role
+
   accepts_nested_attributes_for :token_permissions
   tracks_nested_attributes_for :token_permissions
 
@@ -181,12 +185,7 @@ def users        = for_bearer_type(:user)
     return none if
       names.empty?
 
-    joins(<<~SQL.squish).where(roles: { name: names })
-      INNER JOIN roles
-        ON roles.account_id    = tokens.account_id
-       AND roles.resource_type = tokens.bearer_type
-       AND roles.resource_id   = tokens.bearer_id
-    SQL
+    where(bearer_role: names)
   }
 
   delegate :role, :role_permissions,
@@ -468,14 +467,16 @@ def autosave_associated_records_for_token_permissions
 
       # FIXME(ezekg) Can't use token_permissions.upsert_all at this point, because for
       #              some reason token_id ends up being nil. Instead, we'll use the
-      #              class method and then call reload.
+      #              class method and then reset the stale associations.
       TokenPermission.upsert_all(
         token_permissions_attributes.map { it.merge(token_id: id) },
         record_timestamps: true,
         on_duplicate: :skip,
       )
 
-      reload
+      # reset stale associations after the bulk upsert
+      token_permissions.reset
+      permissions.reset
     end
   end
 end

config/initializers/denormalizable.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_dependency Rails.root / 'lib' / 'denormalizable'

db/migrate/20260707121852_add_bearer_role_to_tokens.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AddBearerRoleToTokens < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+  verbose!
+
+  def change
+    add_column :tokens, :bearer_role, :string, if_not_exists: true
+
+    add_index :tokens, %i[account_id bearer_role created_at],
+      algorithm: :concurrently,
+      if_not_exists: true
+  end
+end

db/migrate/20260707121856_add_temporary_bearer_role_index_to_tokens.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddTemporaryBearerRoleIndexToTokens < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+  verbose!
+
+  INDEX_NAME = :tmp_idx_tokens_id_bearer_role_null
+
+  # NB(ezekg) temporary index supporting the bearer role seed migration
+  def up
+    add_index :tokens, :id, name: INDEX_NAME, where: 'bearer_role IS NULL', algorithm: :concurrently, if_not_exists: true
+  end
+
+  def down
+    remove_index :tokens, name: INDEX_NAME, algorithm: :concurrently, if_exists: true
+  end
+end