Problem

The RBAC middleware held database sessions open for the entire request duration via Depends(get_db), causing critical performance degradation under high load:

Load test results (4000 concurrent users, 10 workers):

Root cause:
get_current_user_with_permissions() opened a session at request start and kept it open until response completion, even though database access was only needed briefly for user lookup. Under high load, sessions accumulated faster than they could be released.

Impact:
All 346 authenticated endpoints were affected.

Solution

Remove long-lived database sessions from RBAC middleware and use fresh_db_session() context manager for short-lived, on-demand database access:

Before:

async def get_current_user_with_permissions(
    request: Request,
    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
    jwt_token: Optional[str] = Cookie(default=None),
    db: Session = Depends(get_db)  # ← Held for entire request
):
    user = db.execute(select(EmailUser).where(...))  # Brief DB use
    db.commit()
    db.close()  # Manual cleanup (ineffective with Depends)
    return {"email": user.email, "db": db, ...}  # Passes session downstream

After:

async def get_current_user_with_permissions(
    request: Request,
    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
    jwt_token: Optional[str] = Cookie(default=None)
    # ← No db parameter
):
    with fresh_db_session() as db:  # ← Short-lived, auto-cleanup
        user = db.execute(select(EmailUser).where(...))
    return {"email": user.email, ...}  # ← No db in context

Changes Made

1. mcpgateway/middleware/rbac.py

   • ✅ Removed db: Session = Depends(get_db) parameter from get_current_user_with_permissions()
   • ✅ Replaced with fresh_db_session() context manager for EmailUser lookup
   • ✅ Removed "db": None from all user context return dictionaries
   • ✅ Removed manual db.commit() and db.close() calls (context manager handles this)
   • ✅ Updated all permission decorators (require_permission, require_admin_permission, require_any_permission) to use fresh_db_session() when no endpoint session exists
   • ✅ Updated PermissionChecker class to use fresh_db_session() pattern
   • ✅ Added deprecation warnings to get_db() and get_permission_service() functions

2. Test Files Updated

   • Updated all test mocks to match new function signature (removed db parameter):
     • ✅ tests/unit/mcpgateway/middleware/test_rbac.py
     • ✅ tests/unit/mcpgateway/middleware/test_auth_method_propagation.py
     • ✅ tests/unit/mcpgateway/utils/test_proxy_auth.py (8 test methods)
     • ✅ tests/unit/mcpgateway/test_main.py
     • ✅ tests/unit/mcpgateway/test_main_extended.py
     • ✅ tests/unit/mcpgateway/test_admin_catalog_htmx.py

Benefits

1. No session accumulation: Sessions created only when needed, closed immediately after use
2. Better performance under load: Prevents idle-in-transaction bottleneck
3. Reduced connection pool pressure: Sessions released 100-1000x faster (milliseconds vs seconds)
4. Backward compatible: Existing endpoints continue to work; decorators fall back to fresh_db_session() automatically
5. Cleaner code: Context manager pattern is more explicit and less error-prone than manual cleanup

Expected Impact

After this fix, under 4000 concurrent users:

• ✅ idle_in_tx count should stay < 50 with max age < 5s
• ✅ RPS should remain stable over time (no degradation)
• ✅ No session accumulation pattern
• ✅ Query execution times stay consistent

Related Issues

• Closes [BUG]: RBAC middleware holds database sessions for entire request duration #2340
• Part of [BUG]: Apply fresh_db_session() to remaining 271 endpoints using Depends(get_db) #2334 - Parent issue for endpoint handler session lifetime
• Related to [BUG]: Apply fresh_db_session() to admin.py endpoints (135 usages) #2335 - admin.py session lifetime (135 endpoints)
• Related to [BUG]: Apply fresh_db_session() to remaining 52 REST endpoints in main.py #2336 - main.py REST session lifetime (52 endpoints)

Testing

Run the test suite to verify all RBAC tests pass with new session management:

make test