yuqi1129 opened a new pull request, #12174: URL: https://github.com/apache/gravitino/pull/12174
### What changes were proposed in this pull request? Privilege probes on the JCasbin authorization hot path no longer call `enforcer.enforce`. They resolve against a per-role index instead: - `loadedRoles` now caches `roleId → CachedRolePolicies` (a `role_meta.updated_at` version sentinel plus a `Map<PolicyKey, Effect>` index), built in `loadPolicyByRoleEntity`. - `authorizeByJcasbin` / the new `resolveRoleEffect`, the active-role narrowing path, and `hasDenyPolicy` all resolve via index lookups over the roles the caller holds (`indexEffect`). - The enforcer keeps only the user/group→role grouping graph (`g` rows); it no longer stores privilege (`p`) policies. The now-redundant second (`deny`) enforcer, `clearRolePolicies`, and the `deleteRole` removal listener in `JcasbinLoadedRolesCache` are removed. - New types: `PolicyKey`, `Effect`, `CachedRolePolicies`. Semantics preserved: DENY wins within a role and globally across the caller's roles; active-role narrowing (role assumption) still narrows allows while deny stays global; `role_meta.updated_at` version validation is unchanged; OWNER still short-circuits to the owner cache. ### Why are the changes needed? In jcasbin 1.99.0, `enforce` linearly scans **every** policy line loaded in the enforcer and evaluates the aviator matcher per line — `O(total_policies)` per probe — and the enforcer accumulates policies for up to `roleCacheSize` (default 10000) roles across all metalakes on a node. A benchmark against the real `jcasbin_model.conf` (one user, one role, one object) shows the scan is over all policies regardless of the user's bindings: | roles | p-rules | `enforce` avg | |---|---|---| | 1,000 | 60,000 | ~12.8 ms | | 10,000 | 600,000 | ~106 ms | The index makes each probe `O(roles_per_user)` hash lookups (sub-microsecond, flat in total policy count). One `authorize` triggers many probes (schema chain, per-object list checks, allow+deny, per-active-role narrowing), so the saving compounds. Fix: #12173 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? `./gradlew :server-common:test --tests "org.apache.gravitino.server.authorization.jcasbin.TestJcasbinAuthorizer" -PskipITs` — 46 tests pass. Obsolete white-box tests of the removed enforcer/removal-listener mechanism were replaced; added `testPrivilegeProbesUseIndexNotEnforcerPolicies`, which asserts the index carries the granted privilege and the enforcer holds no `p` policies (guarding against reintroducing `enforce` on the hot path). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
