cost(P4): cache folder grants on the per-op access check (REST-scoped, not WS) #37

Priority: P4 (cost) — Tier 1 #4. Part of the 2026-07-11 DynamoDB query-cost review.

Problem

routes/documents.rs:780 fetch_folder_grants runs on every doc operation (inside check_doc_access) and does a sequential folder_repo.get + folder_repo.get_member per folder. The folder-metadata get (inherit_mode) repeats on every access check for every user and rarely changes.

Fix

Short-TTL in-memory cache of folder inherit_mode → eliminates a GetItem on the hottest path.

CRDT impact: THIS is the one that touches collab — handle with care

check_doc_access is called by the WebSocket live-sync path at connection setup (ws.rs:65) to bake the session's write authority (View/Edit) into the server-authored token. A stale grant cache would let a just-revoked user open a fresh editing session and keep exchanging yrs updates for the TTL.

• Recommended: scope the cache to cheap, high-frequency REST reads only; leave WS connect uncached/authoritative (it's connection-frequency, so the cost of not caching it is negligible).
• If caching everywhere: short TTL plus explicit invalidation on the folder membership / inherit-mode mutations in routes/folders.rs.

Depends on / complements #P6 (parallelize the per-folder loop).