refactor(auth): correct a drifted docstring and two cache nits

- `getSessionPolicy`'s docstring still said the CREATE hook allows the sign-in
  on a failed read. It has refused when the governing org is known since the
  fail-closed split; say so.
- `SECURITY_POLICY_VERSION_CACHE_TTL_MS` had no consumer outside this module,
  and exporting one of the two sibling TTLs but not the other was arbitrary.
- Pass an explicit `ttl` for both membership outcomes instead of relying on
  `undefined` to mean the constructor default, so the positive/negative
  asymmetry is visible at the call site.

Author: waleedlatif1

apps/sim/lib/auth/security-policy.ts

@@ -21,7 +21,7 @@ const logger = createLogger('SecurityPolicy')
  * never cached; it is read fresh at enforcement time (see `session-policy.ts`),
  * which is what keeps a stale version from ever pairing with a stale policy.
  */
-export const SECURITY_POLICY_VERSION_CACHE_TTL_MS = 60 * 1000
+const SECURITY_POLICY_VERSION_CACHE_TTL_MS = 60 * 1000
 const SECURITY_POLICY_VERSION_CACHE_MAX_ENTRIES = 5_000
 
 const MEMBERSHIP_CACHE_TTL_MS = 60 * 1000
@@ -155,7 +155,7 @@ export async function getMemberOrganizationId(
   membershipCache.set(
     userId,
     { organizationId },
-    organizationId ? undefined : { ttl: NEGATIVE_MEMBERSHIP_CACHE_TTL_MS }
+    { ttl: organizationId ? MEMBERSHIP_CACHE_TTL_MS : NEGATIVE_MEMBERSHIP_CACHE_TTL_MS }
   )
   return organizationId
 }

apps/sim/lib/auth/session-policy.ts

@@ -63,7 +63,9 @@ async function isEntitledToEnforce(organizationId: string): Promise<boolean> {
  * than trying to keep two caches coherent.
  *
  * Throws if the read fails. Callers pick their own failure posture: the session
- * UPDATE hook refuses to extend, the CREATE hook allows the sign-in.
+ * UPDATE hook keeps the current expiry rather than extending it, and the CREATE
+ * hook refuses the sign-in when the governing org is known but allows it when
+ * membership itself could not be resolved.
  */
 export async function getSessionPolicy(
   organizationId: string | null | undefined