TireSwingSoftware/openassign-server — Issue #50: Authorizer performance improvements
Author: jc0n
Created: 2011-11-29 07:07:45+00:00
State: open
Labels: performance

I'm still coming up to speed on how the authorization system works but I had some thoughts:

From what I can tell it seems that every authorization check (which there are of course many) runs with O(n) complexity where n is the number of ACL method checks required for any of the crud operations. This also does not include what appears to be a lot of time spent filtering ACLs to those actually required for the check.

I admit that I have not profiled this, but I think we could dramatically improve the performance by building 4 maps for each of c, r, u, and d operations which would map from type objects to a set of ACL objects.

The same should be done when selecting only relevant ACLs for those which are attribute specific. We can create a map from attribute names to a set of ACL objects. For r and u operations we can then set intersect x and y where x is the set of ACL objects given by looking up ACLs by object type and y is the set union of ACLs given by looking up each requested attribute name. I would expect the extra memory overhead to be minimal since we're only storing pointers to existing objects.

Further gains come from this computation being done once (ie building the dictionaries). A lot of the work filtering ACLs is currently done in every check `Authorizer._get_relevant_acls_for_attributes` and appears to be O(nm) where n is the number of ACLs and m is the number of requested fields.

It also looks like we **could** support using the class object as the actee for create operations. Which would provide an easy fix for authorizing #40.