Incident Dossier

Cache mutation leaks across tenants

Two tenants share a user with the same numeric ID. Tenant A's request handler adds an 'admin' permission to the cached user object; tenant B's next request sees the mutated permission list.

Initial failing signalMutating a returned value rewrites the cached valueExpected behavior: A fresh read retains its original roles after another caller mutates the returned value. · actual behavior: A fresh read includes the previous caller's added admin permission.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the read path to see whether callers receive a reference or a copy.
Trace where two callers can end up sharing the same stored object.
Return an independent value on each read.

Focus Mode

Start

src/cache.js

Likely area

src/cache.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicCaching & Performance

DifficultyEasy

Est. time14 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace