tlyyxjz commented on issue #511: URL: https://github.com/apache/casbin/issues/511#issuecomment-5469261719
Thanks for documenting the numbers so clearly — 55k rules and 1408 shipments is a textbook case of why naive enforce ends up O(all policies). Two things stood out to me: 1. Short-circuit only pays off if the cheap comparison runs FIRST. Your matcher had `eval(p.sub_rule) && r.obj == p.obj`, so for every rule it evaluated the expensive ABAC sub_rule even when `r.obj == p.obj` was already a guaranteed miss. Flipping it to `r.obj == p.obj && eval(p.sub_rule)` turns a full-scan miss into an O(1) fast path on the common case. 2. You actually landed on the real fix: rule indexing. Going from ~1200ms to ~40ms with an inverted index is exactly the ceiling that brute-force enforce hits, and it's the gap we're trying to close in the tool we build — it diagnoses matcher order, flags expensive `g()`/rule lookups on hot paths, and suggests indexed / filtered enforcement instead of scanning everything. Precisely the "why is my enforce slow" cases people silently walk away from, the way you had to here. Nice call on the inverted index, by the way. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
