yuqi1129 opened a new issue, #11403: URL: https://github.com/apache/gravitino/issues/11403
### What would you like to be improved? In `JcasbinAuthorizer.ownerMatchesUserOrGroups()`, when the owner type is `GROUP`, the method calls `resolveCurrentUserGroups(metalake, entityStore)` which directly invokes `entityStore.batchGet(groupIdents, GROUP, GroupEntity.class)`. This call is not protected by either the per-request cache (`requestContext.groupInfoCache`) or the shared Caffeine cache (`groupRoleCache`), so every GROUP owner check issues a DB round trip regardless of how warm the caches are. The problem is amplified in `hasSetOwnerPermission`, which walks the full parent-chain in a loop calling `isOwner` repeatedly — meaning multiple DB queries for group entities can fire within a single request when the owner is a group. The method also loads full `GroupEntity` objects, but only uses `groupEntity.id()` for comparison, making it heavier than necessary. ### How should we improve? Replace the `resolveCurrentUserGroups()` call with `currentPrincipalGroupNames()` + `loadGroupInfo()`, which routes through `requestContext.groupInfoCache` (per-request dedup) and only queries `group_meta.group_id / updated_at` when the cache is cold. Remove the now-unused `resolveCurrentUserGroups()` method. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
