yuqi1129 opened a new issue, #13261:
URL: https://github.com/apache/gravitino/issues/13261
### Version
main branch (`8094542c01`)
### Describe what's wrong
With authorization and the entity cache enabled, listing users or groups
preloads owner relations even though USER/GROUP are not metadata objects and
their visibility expressions do not inspect per-user/group owners.
`MetadataAuthzHelper.preloadOwner()` calls
`OwnerMetaService.batchGetOwner()`, which resolves every listed identifier
separately. Each entry causes a metalake ID lookup and a user/group ID lookup,
followed by two batch owner queries. A list of 10,000 users therefore adds
20,000 unnecessary ID lookups. Both name-only and detailed lists are affected.
Role lists also perform per-role preloading/filtering when a metalake
ownership or management grant already makes the entire list visible.
### Error message and/or stacktrace
No exception is required. Repeated queries include:
```sql
SELECT metalake_id AS metalakeId FROM metalake_meta
WHERE metalake_name = ? AND deleted_at = 0;
SELECT user_id AS userId FROM user_meta
WHERE metalake_id = ? AND user_name = ? AND deleted_at = 0;
```
### How to reproduce
1. Enable authorization and the entity cache with a relational metadata
store.
2. Create a metalake containing 1,003 or 10,000 users; grant the caller
metalake management access.
3. Call `GET /api/metalakes/{metalake}/users`, with and without
`?details=true`, while recording metadata-store queries.
4. Repeat for groups and roles. The ID-lookup count grows with the number of
returned entries.
### Additional context
Skip owner preloading for entities that cannot have owners, and reuse the
existing parent-scope list optimization for users, groups, and roles while
retaining the per-object fallback.
Related performance report: #9164. This issue identifies the concrete
per-entry owner-preload path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
