perf(auth): stop blocking requests on best-effort last-used timestamp writes

The API key lastUsed update and the desktop device lastSeenAt update are
display-only, but every request awaited them. When the primary's commits wait
on synchronous replication, these single-row writes stall for the whole
episode and hold the authenticated request (and the desktop inbox poll) with
them. Concurrent requests on the same key also queued behind the stalled
writer's row lock, each holding a pool connection.

Both writes are now fire-and-forget with logged failures, following the
sandbox image touch precedent. The API key write is additionally debounced
per process with an LRU keyed by key id over the existing staleness window,
so a hot key issues at most one in-flight write per process instead of one
per request.

Author: waleedlatif1

apps/sim/app/api/v1/auth.ts

@@ -74,7 +74,7 @@ export async function authenticateV1Request(request: NextRequest): Promise<AuthR
       }
     }
 
-    await updateApiKeyLastUsed(result.keyId)
+    updateApiKeyLastUsed(result.keyId)
 
     return {
       authenticated: true,

apps/sim/app/api/workflows/middleware.ts

@@ -129,7 +129,7 @@ export async function validateWorkflowAccess(
       }
 
       if (validResult.keyId) {
-        await updateApiKeyLastUsed(validResult.keyId)
+        updateApiKeyLastUsed(validResult.keyId)
       }
     }
     return { workflow }

apps/sim/lib/api-key/service.test.ts

@@ -98,8 +98,8 @@ describe('authenticateApiKeyFromHeader', () => {
 })
 
 describe('updateApiKeyLastUsed', () => {
-  it('only writes when the stored lastUsed is missing or stale', async () => {
-    await updateApiKeyLastUsed('key-1')
+  it('only writes when the stored lastUsed is missing or stale', () => {
+    updateApiKeyLastUsed('key-1')
 
     expect(dbChainMockFns.update).toHaveBeenCalledTimes(1)
     expect(dbChainMockFns.set).toHaveBeenCalledWith({ lastUsed: expect.any(Date) })
@@ -113,12 +113,26 @@ describe('updateApiKeyLastUsed', () => {
     })
   })
 
-  it('swallows database errors instead of failing the request', async () => {
+  it('returns without waiting for a write that has not committed', () => {
+    dbChainMockFns.where.mockReturnValueOnce(new Promise(() => {}))
+
+    expect(updateApiKeyLastUsed('key-stalled')).toBeUndefined()
+    expect(dbChainMockFns.update).toHaveBeenCalledTimes(1)
+  })
+
+  it('writes a key at most once per staleness window in this process', () => {
+    updateApiKeyLastUsed('key-hot')
+    updateApiKeyLastUsed('key-hot')
+
+    expect(dbChainMockFns.update).toHaveBeenCalledTimes(1)
+  })
+
+  it('logs database errors instead of failing the request', async () => {
     dbChainMockFns.update.mockImplementationOnce(() => {
       throw new Error('connection lost')
     })
 
-    await expect(updateApiKeyLastUsed('key-1')).resolves.toBeUndefined()
-    expect(serviceLogger.error).toHaveBeenCalled()
+    expect(() => updateApiKeyLastUsed('key-failing')).not.toThrow()
+    await vi.waitFor(() => expect(serviceLogger.error).toHaveBeenCalled())
   })
 })

apps/sim/lib/api-key/service.ts

@@ -2,6 +2,7 @@ import { db } from '@sim/db'
 import { apiKey as apiKeyTable, user as userTable } from '@sim/db/schema'
 import { createLogger, setRequestAuth } from '@sim/logger'
 import { and, eq, isNull, lt, or } from 'drizzle-orm'
+import { LRUCache } from 'lru-cache'
 import { hashApiKey } from '@/lib/api-key/crypto'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { getWorkspaceBillingSettings, type WorkspaceBillingSettings } from '@/lib/workspaces/utils'
@@ -137,16 +138,34 @@ export async function authenticateApiKeyFromHeader(
 const LAST_USED_STALENESS_WINDOW_MS = 10 * 60 * 1000
 
 /**
- * Update the last used timestamp for an API key.
+ * Keys this process has written `lastUsed` for within the staleness window. The
+ * TTL is the debounce: a still-fresh entry means the stored value is recent, so
+ * concurrent requests on one key never queue behind each other's row lock.
+ */
+const recentLastUsedWrites = new LRUCache<string, true>({
+  max: 10_000,
+  ttl: LAST_USED_STALENESS_WINDOW_MS,
+})
+
+/**
+ * Record that an API key was used, without delaying the request.
  *
- * `lastUsed` is display-only, so the write uses a staleness window: it only
- * fires when the stored value is older than
+ * `lastUsed` is display-only, so the write is fire-and-forget: a commit that
+ * waits on the database (for example on synchronous replication) must never
+ * hold up an authenticated request. It is debounced per process and, across
+ * processes, only fires when the stored value is older than
  * {@link LAST_USED_STALENESS_WINDOW_MS}. High-traffic keys otherwise rewrite
  * the same row on every request, serializing concurrent requests behind row
  * locks. The 10-minute window matches GitLab's personal-access-token
  * last-used tracking.
  */
-export async function updateApiKeyLastUsed(keyId: string): Promise<void> {
+export function updateApiKeyLastUsed(keyId: string): void {
+  if (recentLastUsedWrites.has(keyId)) return
+  recentLastUsedWrites.set(keyId, true)
+  void writeLastUsed(keyId)
+}
+
+async function writeLastUsed(keyId: string): Promise<void> {
   try {
     const staleBefore = new Date(Date.now() - LAST_USED_STALENESS_WINDOW_MS)
     await db

apps/sim/lib/api/server/routes/v2-api-key-auth.ts

@@ -120,7 +120,7 @@ async function authenticateApiKey(apiKeyHeader: string): Promise<V2ApiKeyAuthCon
     .limit(1)
   const row = requireValidRow(candidate)
 
-  await updateApiKeyLastUsed(row.id)
+  updateApiKeyLastUsed(row.id)
   logger.debug('Authenticated v2 API key', { keyId: row.id, keyType: row.type })
 
   if (row.type === 'personal') {

apps/sim/lib/auth/hybrid.ts

@@ -230,7 +230,7 @@ export async function checkHybridAuth(
             keyId: result.keyId,
           }
         }
-        await updateApiKeyLastUsed(result.keyId)
+        updateApiKeyLastUsed(result.keyId)
         return {
           success: true,
           userId: result.userId,

apps/sim/lib/desktop/application/executor.ts

@@ -169,10 +169,12 @@ export const listDesktopInbox = defineAuthorizedCredentialUserUseCase({
     input: DeviceInput
   }): Promise<{ items: DesktopInboxEntry[] }> {
     await requireBoundDevice(principal, input.deviceId)
+    void touchDesktopDevice(input.deviceId).catch((error) =>
+      logger.warn('Failed to record desktop device last seen', { deviceId: input.deviceId, error })
+    )
     const [rows] = await Promise.all([
       listDesktopInboxRows({ deviceId: input.deviceId, userId: principal.userId }),
       markDesktopPresent(input.deviceId),
-      touchDesktopDevice(input.deviceId),
     ])
     return { items: classifyDesktopInbox(rows) }
   },

apps/sim/lib/workflows/api/route-policies.ts

@@ -103,7 +103,7 @@ async function authenticateWorkflowApiKey(rawApiKey: string): Promise<WorkflowAp
   if (!result.success || !result.keyId || !result.keyType) {
     throw new InternalUnauthenticatedError('Unauthorized')
   }
-  await updateApiKeyLastUsed(result.keyId)
+  updateApiKeyLastUsed(result.keyId)
 
   if (result.keyType === 'workspace') {
     if (!result.workspaceId) throw new Error('Workspace API key is missing its workspace scope')