User.refresh_from_db() does not clear Permission cache.

[Johannes Maron]

User.refresh_from_db() does not clear the Permission cache.

ModelBackend implements a cache for the Permission. This cache is not cleared or rebuild when calling refresh_from_db().

I find this very confusing and somewhat unexpected behavior. This should ether be documented or better the cache gets flushed when refresh_from_db() is called.

[Tim Graham]

The ​refresh_from_db() documentation says, "Note that only fields of the model are reloaded from the database. Other database dependent values such as annotations are not reloaded."

I don't find this unclear, but perhaps you'd like to suggest some clarification?

[Johannes Maron]

I think the refresh_from_db documentation is fine. It's the permissions cache that could be better documented and maybe even extended.

It is somewhat unexpected, that you can add or set User.user_permissions but that this will have no effect unless you allocate a new instance of User.
Strictly speaking an m2m relationship is called a "field" in Django, or is it not? Since the permissions are depended on such a relation, I naturally presumed the permissions cache would be covered.

It would be a good thing to have a public API to clear the permissions cache. As a plus it would be great if the cache handles invalidation itself.

[Tim Graham]

The ModelBackend cache ​is documented. I suppose it wouldn't hurt to add a sentence there like "refresh_from_db() won't clear this cache."

The value of user_permissions isn't actually cached. The cache is stored in a private attribute user._per_cache. I'm weary of heading down the road of adding custom refresh_from_db() methods to all models that have similar behavior.

[Johannes Maron]

Maybe it's only me. So a line more of documentation seems to be good enough.

[Tim Graham <timograham@…>]

In 2c4c67af:

Fixed #26514 -- Documented that User.refresh_from_db() doesn't clear the permission cache.

[Tim Graham <timograham@…>]

In 12606d2:

[1.9.x] Fixed #26514 -- Documented that User.refresh_from_db() doesn't clear the permission cache.

Backport of 2c4c67af94318b15df7d9d37b936e07e8168bc73 from master

[Johannes Maron]

Thanks :)