Setting the file. One moment.
Subchapter 7.19
references/support-topics/auth-preserving-parallelization.mdMarkdown1 KBView on GitHub
Parallelizing awaits is safe only when it does not move private data access ahead of the auth, ownership, tenant, or permission check protecting that data.
List every awaited operation being reordered. If a private lookup currently runs after getSession(), an ownership query, a tenant check, or a redirect guard, prove the lookup itself enforces the same predicate before recommending Promise.all.
Do not parallelize a private record fetch with the ownership check that authorizes that fetch. Instead, recommend combining the guard and data lookup into one query constrained by the authenticated user, tenant, or ownership key.
The fix must preserve the sequential guard or replace it with a single authorized query. Do not promise a latency drop equal to a helper unless that helper duration was measured.