feat(cache): shared two-tier (L1+L2) read-through cache for singleton config

[valentijnscholten]

What

Adds a small in-process (L1) read-through cache for global, low-cardinality singleton config (System_Settings & friends): each request/task reads a singleton from the DB at most once instead of on every access.

In processes that handle many findings this repeated reading was a real cost — a hash_code recalculation of 35,000 findings went from 24s to 12s just by memoizing the singleton read per request/task.

The cache stores plain dicts, not pickled model instances.

End result:

• Authorization queries: cached per request (and thus per user) with @cache_for_request — a small pre-existing in-memory thread-local, proven in OS for a while. Reduces per-request query counts.

• System settings singletons: cached in-process (L1) with a short TTL, reset at every request and task boundary. Obvious savings in multi-finding processing such as imports, hash_code calc, tag inheritance, dedupe. Now also works in celery tasks — the per-task reset keeps a reused worker from serving stale config.

New primitive — dojo/caching.py

• dojo_settings_cache(key) — read-through over a per-thread in-process L1 cache. Resolves L1 → getter; a None result is treated as "no value" and is never cached.
• L1 is reset at each request start (middleware) and each task start (celery), so it is effectively request/task-scoped: a reused worker/uwsgi thread never serves a value cached during a prior request/task (e.g. a since-changed System_Settings).
• invalidate_dojo_settings_cache(key) drops this thread's L1 entry (called on save).
• model_to_cache_dict / cache_dict_to_model — store/rebuild plain dicts, never pickled model instances.

Single tier, configured by one env (→ settings.dist.py):

• DD_SETTINGS_CACHE_L1_TTL (seconds, default 30, -1 makes the decorator a pass-through).

Why there is no shared/L2 (Redis) tier

An earlier iteration layered a shared django.core.cache (Redis) L2 under L1. It was removed:

• Not needed for correctness. The one hard requirement is that a celery worker sees current config (e.g. enable_deduplication) promptly. The per-task L1 reset already guarantees that by re-reading the DB each task — a shared L2 + cross-process invalidation is not required.
• Cost outweighed benefit for these singletons. L2 brought a Redis dependency, pickled-vs-dict storage with .v2 version-keying, cross-process invalidation, and Redis-down fragility. The headline win (avoiding repeated reads inside a bulk loop) comes from L1, not L2.
• Trade-off: one small indexed DB read per singleton per request/task instead of amortising across processes via Redis — fine for low-cardinality, signal-invalidated config.

DD_CACHE_URL and the Redis default django.core.cache backend remain for general framework caching; the singleton cache no longer reads or writes it.

System_Settings reads through L1

System_Settings.objects.get() is served from L1 as a dict rebuilt into a read-only instance per call. Write paths (objects.get(no_cache=True)) are unchanged. Busted on save via an import-time @receiver(post_save) so it fires in requests, Celery, commands and tests. The legacy per-request manager middleware is slimmed to just L1-reset + the load-error banner and renamed DojoSettingsManagerMiddleware.

Tests

• unittests/test_caching.py covers L1 memoization, -1 pass-through, None-not-cached, and invalidation.
• Query-count tests (test_metrics_queries, test_false_positive_history_logic, test_tag_inheritance_perf, test_importers_performance) pin the cache via @override_settings(SETTINGS_CACHE_L1_TTL=30) so counts are deterministic and reflect one DB read per request/task; counts were updated where the per-task reset legitimately changes them (e.g. eager imports re-read per task, as a real async worker would).

No behavior change on non-cache paths. No new dependencies (RedisCache, if used for the default backend, is built into Django).