opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

perf(coderd): cheaper chatd org membership checks (#24361)

Browse Source 
This change reuses the authenticated subject's existing organization
membership information during chat creation instead of issuing an
`OrganizationMembers` query.

The current query is still correct, so this is not required for
correctness. However, `workspaceapps` already answers the same question
more cheaply from the request's RBAC subject. This extracts that logic
into `rbac.Subject.HasOrganizationMembership` and reuses it in both
places, removing an extra database lookup from chat creation without
changing the authorization behavior.

I'm currently debugging a Coder agents scaletest regression where a run
on April 2, 2026 with 4800 concurrent chat creations passed, while the
same run on April 15, 2026 does not. We could stagger chat creation to
reduce the burst, but I'd rather understand why this bottleneck appeared
in the first place so we can keep making small hot-path improvements
like this one instead of only smoothing over the symptom.
This commit is contained in:
Ethan
2026-04-16 00:12:54 +10:00
committed by GitHub
parent 574979a5f3
commit 227f20df6a
3 changed files with 29 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/workspaceapps/db.go
+6 -8
View File
@@ -372,18 +372,16 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *rbac.Subj
return false, warnings, nil
}
// Check if the user is a member of the same organization as the workspace
// Check if the user is a member of the same organization as the workspace.
workspaceOrgID := dbReq.Workspace.OrganizationID
expandedRoles, err := roles.Roles.Expand()
isMember, err := roles.HasOrganizationMembership(workspaceOrgID)
if err != nil {
return false, warnings, xerrors.Errorf("expand roles: %w", err)
return false, warnings, xerrors.Errorf("check organization membership: %w", err)
}
for _, role := range expandedRoles {
if _, ok := role.ByOrgID[workspaceOrgID.String()]; ok {
return true, []string{}, nil
}
if isMember {
return true, []string{}, nil
}
// User is not a member of the workspace's organization
// User is not a member of the workspace's organization.
return false, warnings, nil
case database.AppSharingLevelPublic:
// We don't really care about scopes and stuff if it's public anyways.