Make opt-in flag

cmd/access_test.go

@@ -7,7 +7,6 @@ import (
 	"heckel.io/ntfy/v2/server"
 	"heckel.io/ntfy/v2/test"
 	"testing"
-	"time"
 )
 
 func TestCLI_Access_Show(t *testing.T) {
@@ -44,12 +43,6 @@ user * (role: anonymous, tier: none)
 `
 	require.Equal(t, expected, stdout.String())
 
-	// The CLI commands above ran against a separate Manager instance (their own
-	// process-equivalent), so the server's ACL cache hasn't seen the new grants
-	// yet. Wait for the server's background reloader (interval set in
-	// newTestServerWithAuth) to pick them up.
-	time.Sleep(150 * time.Millisecond)
-
 	// See if access permissions match
 	app, _, _, _ = newTestApp()
 	require.Error(t, app.Run([]string{

cmd/user.go

@@ -378,11 +378,11 @@ func createUserManager(c *cli.Context) (*user.Manager, error) {
 		ProvisionEnabled:    false, // Hack: Do not re-provision users on manager initialization
 		BcryptCost:          user.DefaultUserPasswordBcryptCost,
 		QueueWriterInterval: user.DefaultUserStatsQueueWriterInterval,
-		// CLI Managers are short-lived; the background ACL cache poller would only
-		// spam "database is closed" warnings after the subcommand returns. Mutations
-		// still refresh the local cache synchronously; the running server (if any)
-		// picks them up via its own poller.
-		AccessCacheReloadInterval: -1,
+		// CLI subcommands never serve authorizeTopicAccess and are short-lived,
+		// so the cache (and its background poller) would be wasted work. Mutations
+		// hit the DB directly; the running server, if any, picks them up via its
+		// own poller when the cache is enabled there.
+		AccessCacheEnabled: false,
 	}
 	if databaseURL != "" {
 		host, dbErr := pg.Open(databaseURL)

cmd/user_test.go

@@ -9,7 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-	"time"
 )
 
 func TestCLI_User_Add(t *testing.T) {
@@ -129,10 +128,8 @@ func newTestServerWithAuth(t *testing.T) (s *server.Server, conf *server.Config,
 	conf.File = configFile
 	conf.AuthFile = filepath.Join(t.TempDir(), "user.db")
 	conf.AuthDefault = user.PermissionDenyAll
-	// Tight interval so cross-process writes from the `ntfy access`/`ntfy user`
-	// CLI commands (which run via a separate Manager) propagate to the server's
-	// ACL cache within tens of ms instead of the default 5s.
-	conf.AuthAccessCacheReloadInterval = 25 * time.Millisecond
+	// Cache is off by default (matches self-hoster setup), so the server reads
+	// authorizations directly from the DB and sees CLI mutations immediately.
 	s, port = test.StartServerWithConfig(t, conf)
 	return
 }