yuqi1129 opened a new issue, #11088:
URL: https://github.com/apache/gravitino/issues/11088
### What would you like to be improved?
In `JcasbinAuthorizer.isSelf(EntityType, NameIdentifier)`, the `ROLE` branch
resolves the user's role assignments by going straight to
`EntityStore.relationOperations().listEntitiesByRelation(ROLE_USER_REL, ...)`:
```java
List<RoleEntity> entities =
entityStore
.relationOperations()
.listEntitiesByRelation(
SupportsRelationOperations.Type.ROLE_USER_REL,
userNameIdentifier,
Entity.EntityType.USER);
```
This bypasses the version-validated `userRoleCache` / `groupRoleCache` that
the rest of `loadRolePrivilege` already uses. As a result, `isSelf(ROLE)`
issues an extra DB query for every call, even when the same user's role list
was just resolved a few microseconds earlier on the same request.
### How should we improve?
PR #10996 introduced the version-validated user-role / group-role caches but
intentionally kept `isSelf(ROLE)` on the pre-existing direct-entity-store path
to keep the diff focused. Switching `isSelf(ROLE)` to reuse the cache path
would:
- eliminate the redundant query when role-management APIs are called
frequently;
- keep `isSelf` semantics consistent with `authorize` / `isOwner`.
Suggested refactor for `isSelf(ROLE)`:
1. Call `loadUserInfo` to get the user id (and benefit from per-request
dedup via `AuthorizationRequestContext`).
2. Call `loadUserRoles` for the direct role ids and `loadGroupRoles` per
group for inherited role ids.
3. Check the target role id against the union.
Falls back to deny on any exception, same as today.
Acceptance criteria:
- `isSelf(ROLE)` no longer calls
`entityStore.relationOperations().listEntitiesByRelation` directly.
- Existing `TestJcasbinAuthorizer.testIsSelfRoleViaGroup` and other
`isSelf(ROLE)` tests still pass.
- Add a unit test that asserts repeated `isSelf(ROLE)` calls in the same
request don't trigger redundant role-list DB queries.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
