mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
Jeremy RuppelandSteven Masley
51a9aa1bfc
`POST /api/v2/authcheck` evaluated every check with a full policy evaluation in a serial loop. A subject in many organizations (100+) produced hundreds of full evaluations, taking seconds on a cold cache (DEVEX-608). Group the checks by `(action, resource type)` and authorize each group with the existing `rbac.Filter`, which amortizes a single partial evaluation across the group once it is large enough. Each check is wrapped in a small value struct that carries its response key, so `Filter`'s returned subset maps back to keys by reading a field rather than relying on element identity. `Filter` now takes an explicit `prepareThreshold`; existing callers pass the new `rbac.DefaultFilterThreshold` (10), and `checkAuthorization` passes 50, above the ~35-group crossover measured for this workload, so subjects with few objects of a given type keep the per-object path and cannot regress. ## Stacking This is stacked on top of #27244. `Filter` runs `Prepare` (partial evaluation), and those residuals are only compact once #27244's set-membership residuals land. On plain `main` the existing O(N) residual fanout means batching can regress at high org counts, so this change should land with or after #27244. <details> <summary>Decision log</summary> ### Bottleneck - `site/src/modules/permissions/organizations.ts` defines ~14 permission checks per org; `organizationsPermissions()` flattens them across all orgs into one `POST /api/v2/authcheck`. A 100-org request is ~1400 checks. - `checkAuthorization` looped serially, calling `Authorizer.Authorize` (full eval) once per check. - The endpoint's `maxFetch = 10` only caps checks that carry a `resource_id`, not total checks, so it does not bound this workload. ### Approach - Group checks by `(action, resource type)` and run each group through `rbac.Filter`, which does one partial evaluation (`Prepare`) and reuses it across the group. - Carry the response key as data in a small value struct implementing `RBACObject()`, so allowed results map back to keys without pointer identity: ```go type authorizeCheck struct { key string object rbac.Object } func (c authorizeCheck) RBACObject() rbac.Object { return c.object } ``` - `Filter` takes a required `prepareThreshold int` (no functional options). Generic callers pass `rbac.DefaultFilterThreshold = 10`; `/authcheck` passes 50 because the measured crossover for this workload is ~35 groups. ### Alternatives rejected - **Bounded `errgroup` parallelism**: reduced wall time at high org counts but not aggregate work (allocations flat). Discarded in favor of reducing work via partial evaluation. - **Symmetric-deny Rego simplification** (on the #27244 branch): replacing the known-org deny-fold with symmetric `org := -1` / `scope_org := -1` rules failed existing SQL-compile tests. A `-1` known-org vote gated by `not org = -1` produces a negated membership test over the unknown org id, which OPA emits as an unconvertible support rule. #27244's fold (`member_allow - org_deny`, a positive set-difference membership test) is therefore load-bearing, not incidental. </details> --- Authored with Coder Agents. --------- Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package coderd_test
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/coder/coder/v2/coderd/coderdtest"
|
|
"github.com/coder/coder/v2/codersdk"
|
|
"github.com/coder/coder/v2/testutil"
|
|
)
|
|
|
|
// TestCheckPermissionsAnyOrg demonstrates that batching authcheck permissions
|
|
// through rbac.Filter breaks checks with any_org=true: partial evaluation
|
|
// denies AnyOrgOwner objects that full evaluation allows. A single any_org
|
|
// check (below the batching threshold) returns true, while the same check
|
|
// repeated 55 times (pushing the group over the threshold) returns false.
|
|
func TestCheckPermissionsAnyOrg(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
|
t.Cleanup(cancel)
|
|
|
|
adminClient := coderdtest.New(t, nil)
|
|
adminUser := coderdtest.CreateFirstUser(t, adminClient)
|
|
memberClient, _ := coderdtest.CreateAnotherUser(t, adminClient, adminUser.OrganizationID)
|
|
|
|
check := codersdk.AuthorizationCheck{
|
|
Object: codersdk.AuthorizationObject{
|
|
ResourceType: codersdk.ResourceWorkspace,
|
|
OwnerID: "me",
|
|
AnyOrgOwner: true,
|
|
},
|
|
Action: "create",
|
|
}
|
|
|
|
// Below the batching threshold: full evaluation, allowed.
|
|
single, err := memberClient.AuthCheck(ctx, codersdk.AuthorizationRequest{
|
|
Checks: map[string]codersdk.AuthorizationCheck{"can-create-workspace": check},
|
|
})
|
|
require.NoError(t, err)
|
|
require.True(t, single["can-create-workspace"], "single any_org check should be allowed")
|
|
|
|
// Same check, 55 copies: the (create, workspace) group crosses the
|
|
// batching threshold and is evaluated with a prepared partial query,
|
|
// which denies AnyOrgOwner objects.
|
|
grouped := make(map[string]codersdk.AuthorizationCheck)
|
|
for i := 0; i < 55; i++ {
|
|
grouped[fmt.Sprintf("can-create-workspace-%d", i)] = check
|
|
}
|
|
groupedResp, err := memberClient.AuthCheck(ctx, codersdk.AuthorizationRequest{Checks: grouped})
|
|
require.NoError(t, err)
|
|
for key, allowed := range groupedResp {
|
|
require.True(t, allowed, "grouped any_org check %q should be allowed but was denied", key)
|
|
}
|
|
}
|