fix(centralui-auth): memoize non-authoritative circuit auth-state reads for 10 s (review 2026-10-21 07/P-3)

GetAuthenticationStateAsync (display reads: current username, nav role checks) used
to force a full revalidation + DB role re-map on every call. It now reuses the
circuit's last revalidation for NonAuthoritativeRefreshInterval (10 s);
GetAuthoritativeStateAsync (mutation gates, UI-13) still re-maps every time and
fails closed. The revocation regression test now asserts through the authoritative
read, which is what every gate uses.

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/CircuitRevocationRegressionTests.cs

@@ -66,7 +66,10 @@ public class CircuitRevocationRegressionTests
         var sites = new SiteScopeService(auth);
         Assert.True(await sites.IsSiteAllowedAsync(1));
         mapping = new RoleMappingResult([Roles.Viewer], ["2"], false);
-        var refreshed = await auth.GetAuthenticationStateAsync();
+        // Authoritative read: a non-authoritative read may reuse the circuit's last
+        // revalidation for CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval
+        // (review 2026-10-21 07/P-3); every gate below is authoritative.
+        var refreshed = await auth.GetAuthoritativeStateAsync();
         Assert.DoesNotContain(Roles.Deployer, refreshed.User.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value));
         Assert.False(await sites.IsSiteAllowedAsync(1));
         Assert.True(await sites.IsSiteAllowedAsync(2));

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/CookieAuthenticationStateMemoTests.cs

@@ -0,0 +1,91 @@
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using NSubstitute;
+using ZB.MOM.WW.Auth.Abstractions.Roles;
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
+using ZB.MOM.WW.ScadaBridge.Security;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;
+
+/// <summary>
+/// Review 2026-10-21 07/P-3: a non-authoritative <see cref="CookieAuthenticationStateProvider.GetAuthenticationStateAsync"/>
+/// no longer re-runs the role mapping on every read — it reuses the circuit's last revalidation
+/// for <see cref="CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval"/> — while
+/// <see cref="CookieAuthenticationStateProvider.GetAuthoritativeStateAsync"/> (mutation gates)
+/// still re-maps every time.
+/// </summary>
+public class CookieAuthenticationStateMemoTests
+{
+    private sealed class MutableClock : TimeProvider
+    {
+        public DateTimeOffset Now { get; set; } = DateTimeOffset.UtcNow;
+
+        public override DateTimeOffset GetUtcNow() => Now;
+    }
+
+    private static (CookieAuthenticationStateProvider Auth, IGroupRoleMapper<string> Mapper, MutableClock Clock, ServiceProvider Provider) Create()
+    {
+        var clock = new MutableClock();
+        var mapping = new RoleMappingResult([Roles.Designer], [], false);
+        var mapper = Substitute.For<IGroupRoleMapper<string>>();
+        mapper.MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>())
+            .Returns(_ => new GroupRoleMapping<string>(mapping.Roles, Scope: mapping));
+        var initial = SessionClaimBuilder.Build("alice", "Alice", ["group"], mapping, clock.Now);
+        var services = new ServiceCollection().AddLogging();
+        services.AddSingleton(mapper);
+        services.AddSingleton<TimeProvider>(clock);
+        services.AddSingleton(Options.Create(new SecurityOptions()));
+        services.AddScoped<CookieSessionValidator>();
+        services.AddSingleton<IHttpContextAccessor>(new HttpContextAccessor { HttpContext = new DefaultHttpContext { User = initial } });
+        services.AddScoped<AuthenticationStateProvider, CookieAuthenticationStateProvider>();
+        var provider = services.BuildServiceProvider();
+        var auth = (CookieAuthenticationStateProvider)provider.CreateScope().ServiceProvider.GetRequiredService<AuthenticationStateProvider>();
+        return (auth, mapper, clock, provider);
+    }
+
+    /// <summary>Repeated display reads within the window run the role mapping once.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task NonAuthoritativeReads_WithinWindow_MapOnce()
+    {
+        var (auth, mapper, _, provider) = Create();
+        using var _p = provider;
+
+        for (var i = 0; i < 5; i++)
+            Assert.Equal("alice", (await auth.GetCurrentUsernameAsync()));
+
+        await mapper.Received(1).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
+    }
+
+    /// <summary>After the window the next display read revalidates again.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task NonAuthoritativeRead_AfterWindow_Revalidates()
+    {
+        var (auth, mapper, clock, provider) = Create();
+        using var _p = provider;
+
+        await auth.GetAuthenticationStateAsync();
+        clock.Now += CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval + TimeSpan.FromSeconds(1);
+        await auth.GetAuthenticationStateAsync();
+
+        await mapper.Received(2).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
+    }
+
+    /// <summary>Authoritative reads (mutation gates) always re-map, even inside the window.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task AuthoritativeReads_AlwaysRemap()
+    {
+        var (auth, mapper, _, provider) = Create();
+        using var _p = provider;
+
+        await auth.GetAuthenticationStateAsync();
+        await auth.GetAuthoritativeStateAsync();
+        await auth.GetAuthoritativeStateAsync();
+
+        await mapper.Received(3).MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
+    }
+}