yuqi1129 opened a new issue, #13612: URL: https://github.com/apache/gravitino/issues/13612
### What would you like to be improved? `JcasbinAuthorizer.versionCheckAndLoadRoles` has no per-role single-flight. When a loaded role is evicted or its privileges change, every concurrent request that needs the role (new requests in `loadRole`, and in-flight requests revalidating per #13605) reads the role entity and resolves all of its securable objects independently. Only the final policy replacement is serialized by `rolePolicyLock`, so one eviction of a large role can turn into a burst of duplicate entity and metadata-id reads. ### How should we improve? Coalesce loads per role id: the first request to find a role stale starts the load, and concurrent requests for the same role and version wait for its result (e.g. a `ConcurrentHashMap<Long, CompletableFuture<...>>` keyed by role id, removed on completion). Keep the existing failure semantics: a failed load must still be reported to every waiter so that revalidation can fail closed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
