Expire RBAC cache earlier on watches

pkg/subscribe/handler.go

@@ -113,7 +113,6 @@ func handler(apiContext *types.APIContext) error {
 			if schema != nil {
 				buffer := &bytes.Buffer{}
 
-				apiContext.ExpireAccessControl(schema)
 				if err := jsonWriter.VersionBody(apiContext, &schema.Version, buffer, item); err != nil {
 					cancel()
 					continue

store/proxy/proxy_store.go

@@ -271,6 +271,7 @@ func (s *Store) Watch(apiContext *types.APIContext, schema *types.Schema, opt *t
 	}
 
 	return convert.Chan(c, func(data map[string]interface{}) map[string]interface{} {
+		apiContext.ExpireAccessControl(schema)
 		return apiContext.AccessControl.Filter(apiContext, schema, data, s.authContext)
 	}), nil
 }