Currently, the CentralAuthUser class stores information about the global groups that the user is member of, as well as data about the groups itself, i.e. what permissions they give and what wikisets they are active on. The latter is an additional responsibility, which should be extracted to a separate class, e.g. GlobalPermissionManager (or integrate into GlobalGroupLookup, but maybe not if the class will also check disabled groups).

The current setup makes it so that changes into a global group configuration (e.g., rights or wikiset) require invalidating caches for all users who are members of the changed group. Even though it's not that bad on itself (the largest global groups on Wikimedia are 1.5k and 3k members), that's still something that could be avoided.

Instead, we could have a separate service which is responsible for resolving rights for a global group, with its own cache that would be reused for all users (as group-rights mapping is universal). Such a separate service would make it also easier to implement the disabled global groups (in a separate task).

Acceptance criteria

• CentralAuthUser is still responsible for listing global groups the user is member of.
• Resolving groups into rights is done in a separate class.
• There's no longer need to invalidate cache for all members of a global group if the group's properties (rights, wikiset) change.