perf: reduce per-assignment Casbin calls in visible assignments fast path#278
perf: reduce per-assignment Casbin calls in visible assignments fast path#278mariajgrimaldi wants to merge 2 commits intomainfrom
Conversation
…path Three changes to cut latency in get_visible_role_assignments_for_user: 1. Pre-filter by org/scope/role before the authorization pass so Casbin never evaluates assignments that would be filtered out anyway. 2. Replace the per-assignment enforcer.enforce() loop in _filter_allowed_assignments with a single batch_enforce() call. 3. Memoize get_permissions_for_single_role within get_role_assignments so the same role key is not expanded multiple times in one call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
openedx-webhooks
added
open-source-contribution
|
Thanks for the pull request, @mariajgrimaldi! This repository is currently maintained by Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review. 🔘 Get product approvalIf you haven't already, check this list to see if your contribution needs to go through the product review process.
🔘 Provide contextTo help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:
🔘 Get a green buildIf one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green. 🔘 Update the status of your PRYour PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate. Where can I find more information?If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources: When can I expect my changes to be merged?Our goal is to get community contributions seen and reviewed as efficiently as possible. However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:
💡 As a result it may take up to several weeks or months to complete a review and merge your PR. |
… assignments Bypass Casbin enforce() entirely in _filter_allowed_assignments: - Check staff/superuser once via Django User query (early return) - Call get_scopes_for_subject_and_permission once per distinct permission type (typically 1-2 calls total) instead of N enforce() calls - Filter in Python using key_match_func for glob scope support This eliminates the is_admin_or_superuser_check overhead (ScopeData/UserData construction per item, RequestCache lookups) that dominated the previous batch_enforce path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2 participants
Description
Three changes to cut latency in get_visible_role_assignments_for_user:
Pre-filter by org/scope/role before the authorization pass so Casbin never evaluates assignments that would be filtered out anyway.
Replace the per-assignment enforcer.enforce() loop in _filter_allowed_assignments with a single batch_enforce() call.
Memoize get_permissions_for_single_role within get_role_assignments so the same role key is not expanded multiple times in one call.
Merge checklist:
Check off if complete or not applicable: