Package: fastbin
#FastbinFastbinis a drop in replacement ofpycasbinthe python implementation of the
great authorization managementcasbin.Fastbinis designed to address the primary concern when working with large sets of rules; Performance.The root cause of working with large rule sets is the following:https://github.com/casbin/pycasbin/blob/88bcf96eb0586acd5a2cf3d3bd22a7802a0bfb27/casbin/core_enforcer.py#L238Iterating over 10,000 rules to get a yes or no answer takes time, there really isn't a way around the fact. This limitation
comes from the generalization that casbin attempts to support. Independent on the format of your request, or policy definition
casbin if able to support your authorization mechanism.Fastbinmakes a minimal set of assumptions to allow efficient filtering of the model so that the number of rules you
are iterating over to get a result is much smaller and performance can be maintained. UsingFastbinwhen working with
rule sets of any size, it is possible to keep resolution of enforcement sub millisecond.UsageAssuming your model and policies meet the requirements discussedbelow, to useFastbinit takes the same arguments as the standard enforcer with additionally taking an ordered list of integers
representing the index position for a rule that should used to enable the cache.Fastbinused a nested dictionary structure to manage its cache, it based on the assumption that keys are exact matches
and can be used to filter on. For example, if you have rules that follow a similar format to["/user99", "/obj99999", "read"],
and a matcher ofm = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.actwe can say that if we pre-filtered out all rules
that the objects or the action didn't match we would have a much smaller ruleset to manage.Rather iterating on all the rules knowing the majority will not pass ther.obj == p.obj && r.act == p.actof the matcher,
we can tellFastbinto cache the rules based onobjand then theaction. Then when it comes to enforcing a rule,Fastbinuses the incoming data to filter down the policies down to the minimal number based on the cache and
then then rest of the normal casbin enforcement logic takes place."""# Request definition[request_definition]r = sub, obj, act# Policy definition[policy_definition]p = sub, obj, act"""importtimefromfastbinimportFastEnforceradapter="/path/to/adapter"# or adapter of your choiceenforcer=FastEnforcer([1,2],"/path/to/model",adapter)forxinrange(100):foryinrange(100000):enforcer.add_policy(f"/user{x}",f"/obj{y}","read")s=time.time()# this is the absolute worst case last entry and should require iterating 10M rows and be very slowa=enforcer.enforce("/user99","/obj99999","read")print(a,(time.time()-s)*1000)# Output:# True 0.8349418640136719Required AssumptionsThe two assumptions that are
required are:The order of the fields in the request and the policy to be used in the cache are at the same index positionValid Rule Sets:# Request definition
[request_definition]
r = sub, obj, act

# Policy definition
[policy_definition]
p = sub, obj, act# Request definition
[request_definition]
r = sub, obj, act

# Policy definition
[policy_definition]
p = sub, obj, act, protected, beforeInvalid Rul Sets:# Request definition
[request_definition]
r = sub, obj, act

# Policy definition
[policy_definition]
p = sub, act, obj  # Not the act, obj have been swapped# Request definition
[request_definition]
r = sub, obj, act

# Policy definition
[policy_definition]
p = sub, obj, protected, before, act # There are extra keys between the valuesThe keys being used to cache do not require processing to extract from the cache.Some people attempt to shrink the size of their rule sets but combing rules by using patterns in their rules such as setting
the action to beread,writeand using a regex to split and match these values. This is not supported byFastbinand
is actually an anti-pattern now as you will be loosing performance.Why Not Filtered Policies?Filtered policies are highly recommended and should be used in conjunction withFastbin.Fastbinis great at helping
working with large rule sets, but it cannot aid in the loading of those large policies from disk. This is where
loading filter policies really helps. If you can take you 1 million entry rule set, and shrink down the possible rules
you care about down to 1-10 thousand rules that can load in a reasonable amount of time,Fastbinwill then help
ensure enforcement against these rules is fast as well.Contributingpoetry run pre-commit install -t pre-commit -t commit-msg && poetry run pre-commit autoupdate && poetry run pre-commit run --all