permission: cache user info and parallelize resolution

The permission backend previously resolved userInfo and minted a plugin
request token sequentially for every authorize request with user
credentials. On high-traffic endpoints this meant two serial internal
HTTP round-trips per request, even when the same user made many
requests in quick succession.

This change:

1. Adds a 5-second TTL cache to DefaultUserInfoService so that repeated
   getUserInfo() calls for the same user return the cached result
   without an HTTP call to the auth backend.

2. Parallelises the getUserInfo() and getPluginRequestToken() calls in
   the permission backend's handleRequest via Promise.all, saving one
   sequential round-trip on cache misses.

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>

plugins/permission-node/src/policy/types.ts

@@ -18,7 +18,6 @@ import {
   Permission,
   PolicyDecision,
 } from '@backstage/plugin-permission-common';
-import { BackstageUserIdentity } from '@backstage/plugin-auth-node';
 import {
   BackstageCredentials,
   BackstageUserInfo,
@@ -44,27 +43,6 @@ export type PolicyQuery = {
  * @public
  */
 export type PolicyQueryUser = {
-  /**
-   * The token used to authenticate the user within Backstage.
-   *
-   * @deprecated User the `credentials` field in combination with `coreServices.auth` to generate a request token instead.
-   */
-  token: string;
-
-  /**
-   * The number of seconds until the token expires. If not set, it can be assumed that the token does not expire.
-   *
-   * @deprecated This field is deprecated and will be removed in a future release.
-   */
-  expiresInSeconds?: number;
-
-  /**
-   * A plaintext description of the identity that is encapsulated within the token.
-   *
-   * @deprecated Use the `info` field instead.
-   */
-  identity: BackstageUserIdentity;
-
   /**
    * The credentials of the user making the request.
    */
@@ -72,6 +50,8 @@ export type PolicyQueryUser = {
 
   /**
    * The information for the user making the request.
+   *
+   * @deprecated This field is deprecated and will be removed in a future release.
    */
   info: BackstageUserInfo;
 };