Permission Performance Optimizations - #2341
Conversation
Moved PermissionsDTO to PermissionManager Removed GSON to use the app-wide ObjectMapper from Jackson
anthonysena
left a comment
There was a problem hiding this comment.
Looks good from review on the Atlas WG call - just one comment for review to make sure we've removed the com.google.code.gson reference.
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.fasterxml.jackson.databind.node.ArrayNode; | ||
| import com.google.gson.JsonArray; | ||
| import com.google.gson.JsonObject; |
There was a problem hiding this comment.
com.google.gson was removed from pom.xml
There was a problem hiding this comment.
This was partially addressed: there is a gson import related to google http client, somehow related to GoogleBigQuery. The confusion is: there's a install-file goal to include httpclient-gson, but then also a maven dependency to the same library, but different version. Probably redundant or something was missed, but we should minimize install-file goals as they complicate the build process. Will not address in this PR.
| return permissions; | ||
| } | ||
|
|
||
| public PermissionsDTO queryUserPermissions(final String login) { |
There was a problem hiding this comment.
@chrisknoll should getUserPermissions be deprecated in favor of this method?
There was a problem hiding this comment.
Depends:
the getuserPermissions is returning PermissionEntity...which is the JPA Entity Bean that represents the row of data in the DB, and fetchign permissions this way involves getting the roles from the user, iterating through each role and adding each permission from those roles into a final Set of PermissionEntity. The use of Set de-dupes permissions across roles.
queryUserPermissions provides more of a 'view' of distinct permissions associated with a user bypassing the JPA interface of sweeping through roles. It also structures the result to be 'indexed' such that you can quickly navigate to specific permissions that begin with a certain term.
The inputs to each of these are a bit different too: the former wants a ID or UserEntity, the latter works off of a login, and this is just based on the use-case of when you'd use one or the other. When we get to the point that we can clean up the API/object model in the 3.x release we can normalize and simplify a lot of this to a more simple, straight forward implementation.
| user.login = currentUser.getLogin(); | ||
| user.name = currentUser.getName(); | ||
| user.permissions = convertPermissions(permissions); | ||
| user.permissionIdx = authorizer.queryUserPermissions(currentUser.getLogin()).permissions; |
There was a problem hiding this comment.
does this mean user.permissions will no longer be needed?
There was a problem hiding this comment.
It's unclear. When I added the code, I was concerned with not breaking backwards compatibility. While I did do a search on where the user.permissions field was referenced, it doesn't find those uses by downstream apps like Atlas (ie: the value is populated, returned to Atlas via webAPI call, so removing it will break it there).
When we move into the 3.0 WebAPI changes, ( #2354) we can be more aggressive about removing obsolete/unused code.
* Start version 2.15.0 Bump to version 2.15.0 Updated Milestones for Atlas and WebAPI * Permission Performance Optimizations (#2341) * Implemented permission lookup to bypass hibernate. * Moved PermissionsDTO to PermissionManager * Removed GSON to use the app-wide ObjectMapper from Jackson * Removed unused imports to GSON. * Add Databricks profile (#2339) * Create new webapi-databricks profile * Check for spark and databricks connection string info * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * Updated for MDACA Migration to SB 3 * Updates for MDACA Migration to SB 3 * MDACA Spring boot 3 migration * changes for MDACA Migration to SB 3 * MDACA Spring boot 3 migration * updates for MDACA migration to SB 3 * updates for MDACA Migration to SB 3 * changes for MDACA Migration to SB 3 * MDACA Spring Boot 3 migration, deprecated @typedefs & @typedef replaced * updates for MDACA migration to SB 3 * MDACA Spring Boot 3 migration comment out jerey classes that need refactoring due to deprecation * MDACA Spring Boot 3 migration * Updates for MDACA Migration for SB 3 * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * Updates for MDACA Migration to SB 3 * MDACA Spring Boot 3 migration * fix merge fix * updates for MDACA Migration to SB3 * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration * increased log4j version for MDACA Migration to SB 3 * Updates for MDACA Migration to SB 3 * MDACA Spring Boot 3 migration * MDACA Spring Boot 3 migration compilation issue * Updated config for MDACA Migration to SB 3 * MDACA Spring Boot 3.2.5 migration, other recipes * MDACA Spring Boot 325 migration pom cleanup * MDACA Spring Boot 325 migration pom update security versions * MDACA Spring Boot 3 migration * changes for MDACA Migration to SB 3 * updates for MDACA Migration to SB 3 * updates for MDACA Migration to SB 3 * docker workaround to upload to harbor * Updated paging for MDACA Upgrade to SB 3 * security scan 2 dependency chnages * additional changes for MDACA migration to SB 3, shiro and pac4j changes * Fixed permissionIdx that was removed during upgrade * Added exlusion to Buji for Pac4j javaee, got it working with tomcat embedded (11), and checked-in script for DB upgrade * cleanup pre-pull request * Updated dockerfile & pom for MDACA containers * Updated job execution SQL for updated batch params table fields * Fixed Redshift dependency in pom * patched pom for grype secuiryt scan * Updated dockerfile & adding WebAPI.war * Track .war files with Git LFS * removed war * Delete .github/workflows/release.yaml * Update ci.yaml * Update pom.xml * Create settings.xml * Create Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update ci.yaml * Update pom.xml * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * Update Dockerfile-mvn-no-local * updated telemetry version for security scan * Update Dockerfile-mvn-no-local * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update ci.yaml * Update Dockerfile-mvn-no-local * Update ci.yaml * Update Dockerfile-mvn-no-local * security scan version fix * Update ci.yaml * updated xmlsec dependency version for security scan. cleaned up pom of old migration comments * update dependency for security scan * remove bcprov 1.63 from cas-core dependency * Update ci.yaml * Update ci.yaml * add local mvn dockerfile * refactored commons after removing older spring batch admin mgr * Completed refactoring of jobs to Spring Batch 5, reverted changes to migration script * Update ci.yaml Updated ci.yaml to push to ECR version 3.0.2.2 * fixed pom security setting * Fixed transactionManager on stepBuilders for tasklet, addresses cohortanalysis post and other endpoints. * updated DynamicEntityGraph paths * Added missing transactionManagers * Added missing transactionManagers * fixes for FeAnalysisEntity to properly map design column, fixed enum in aggregate analysis * add transactionmanager, and jobrepository to fix delete cohort errors * added PlatformTransactionManager for previous fix not in previous commit * updated tomcat version for cve-2024-56337 * updated spring dependencies for security scans: CVE-2024-38816, CVE-2024-38819, CVE-2024-38809, and CVE-2024-38827 * updated spring dependencies for security scans: CVE-2024-47554 * update dependencies for secuity scan: CVE-2024-47554 * update for security scan: CVE-2022-24615 and CVE-2023-22899 * update for security scan: CVE-2024-38829 * update for security scan: CVE-2024-47554 * update for security scan: CVE-2024-47554 * update for security scan: CVE-2024-47554 * update for security scan: CVE-2024-47554 * update velocity-engine-core for security scan: CVE-2024-47554 * update velocity-engine-core for new CVEs * Updated tag from 3.20.3 to 3.20.6 for alpine patch and updated ci.yml for only run when specific folder/files are updated as well updated 4th octet from .2 to .3 * Updated tag 3.0.2.2 to 3.0.2.3 * changed logging from debug to error * update dependency version for security scan: cve-2024-57699 --------- Co-authored-by: Chris Knoll <[email protected]> Co-authored-by: Anthony Sena <[email protected]> Co-authored-by: SSStanleyZ <[email protected]> Co-authored-by: Mike Peterson <[email protected]> Co-authored-by: stevensrtw <[email protected]> Co-authored-by: Richard Stevens <[email protected]>
Implemented permission lookup to bypass hibernate.
Moved PermissionsDTO to PermissionManager
Removed GSON to use the app-wide ObjectMapper from Jackson
Required for OHDSI/Atlas#2912.