feat(utilities/group_permissions): improve performance

Author: stakach

shard.lock

@@ -163,7 +163,7 @@ shards:
 
   office365:
     git: https://github.com/placeos/office365.git
-    version: 1.27.1
+    version: 1.27.2
 
   openai:
     git: https://github.com/spider-gazelle/crystal-openai.git
@@ -215,15 +215,15 @@ shards:
 
   placeos-frontend-loader:
     git: https://github.com/placeos/frontend-loader.git
-    version: 2.7.1+git.commit.693b47914d40284458518503be7441dfc7ff98aa
+    version: 2.7.1+git.commit.4d12eb11b0b381f4d7927b3d7086cbc5b42f21c9
 
   placeos-log-backend:
     git: https://github.com/place-labs/log-backend.git
     version: 0.13.0
 
   placeos-models:
     git: https://github.com/placeos/models.git
-    version: 9.98.3
+    version: 9.98.4
 
   placeos-resource:
     git: https://github.com/place-labs/resource.git
@@ -275,7 +275,7 @@ shards:
 
   search-ingest:
     git: https://github.com/placeos/search-ingest.git
-    version: 2.11.3+git.commit.f3e14c701667f3fb185a82b352d4e053c7f082d2
+    version: 2.11.3+git.commit.57d54cc34bece9abf2c2704f76358b3cd4a3199a
 
   secrets-env: # Overridden
     git: https://github.com/spider-gazelle/secrets-env.git

src/placeos-rest-api/utilities/group_permissions.cr

@@ -15,9 +15,21 @@ module PlaceOS::Api
   # GroupUser entry wins). A Manage grant on a group implicitly covers
   # that group's descendants.
   module Utils::GroupPermissions
+    # Per-request memo caches. Controllers are per-request `ActionController::Base`
+    # instances, so these are request-scoped and cannot serve stale authz (gates
+    # run in before_actions, before any mutation). Never cache across requests.
+    @group_memberships_cache : Hash(String, Hash(UUID, ::PlaceOS::Model::Permissions))?
+    @subsystem_perms_cache : Hash(String, Hash(String, ::PlaceOS::Model::Permissions))?
+
     # Effective per-group Permissions for the user, keyed by group id.
     # Groups where the user has no transitive membership are absent.
+    # Memoised per request (called repeatedly across gates/reads).
     def group_memberships(user : ::PlaceOS::Model::User) : Hash(UUID, ::PlaceOS::Model::Permissions)
+      cache = (@group_memberships_cache ||= {} of String => Hash(UUID, ::PlaceOS::Model::Permissions))
+      cache[user.id.as(String)] ||= compute_group_memberships(user)
+    end
+
+    private def compute_group_memberships(user : ::PlaceOS::Model::User) : Hash(UUID, ::PlaceOS::Model::Permissions)
       user_id = user.id.as(String)
 
       # Direct GroupUser rows, scoped to the user's authority.
@@ -186,16 +198,25 @@ module PlaceOS::Api
     # `subsystems`) include `required`, or Manage (a superset). The model
     # resolver already ANDs the user's group perms with the GroupZone
     # grants, so a non-zero result means both sides agree.
+    # Memoised `{zone_id => Permissions}` map for the current user within
+    # `subsystem`, resolved once per request (then reused by every gate /
+    # scoping query for that subsystem).
+    def subsystem_zone_permissions(subsystem : String) : Hash(String, ::PlaceOS::Model::Permissions)
+      cache = (@subsystem_perms_cache ||= {} of String => Hash(String, ::PlaceOS::Model::Permissions))
+      cache[subsystem] ||= ::PlaceOS::Model::Group.resolve_subsystem_permissions(
+        current_user.authority_id.as(String), subsystem, current_user.id.as(String),
+      )
+    end
+
     def subsystem_grants_on_zones?(
       subsystems : Array(String),
       zones : Array(String),
       required : ::PlaceOS::Model::Permissions,
     ) : Bool
       return false if zones.empty?
-      authority_id = current_user.authority_id.as(String)
-      user_id = current_user.id.as(String)
       subsystems.any? do |subsystem|
-        perms = ::PlaceOS::Model::Group.effective_permissions(authority_id, subsystem, user_id, zones)
+        perms_map = subsystem_zone_permissions(subsystem)
+        perms = zones.reduce(::PlaceOS::Model::Permissions::None) { |acc, z| acc | (perms_map[z]? || ::PlaceOS::Model::Permissions::None) }
         perms.manage? || (perms & required) != ::PlaceOS::Model::Permissions::None
       end
     end
@@ -268,11 +289,11 @@ module PlaceOS::Api
     end
 
     # Zone ids reachable by the current user via the "support" subsystem.
-    # Useful for scoping index/list queries.
+    # Useful for scoping index/list queries. Served from the per-request memo.
     def support_accessible_zone_ids : Array(String)
-      authority_id = current_user.authority_id.as(String)
-      user_id = current_user.id.as(String)
-      ::PlaceOS::Model::Group.accessible_zone_ids(authority_id, SUPPORT_SUBSYSTEM, user_id)
+      subsystem_zone_permissions(SUPPORT_SUBSYSTEM).compact_map do |zid, perms|
+        zid if perms != ::PlaceOS::Model::Permissions::None
+      end
     end
   end
 end