Skip to main content

Authorization Exception System - Performance Analysis & Optimization

Performance Impact Areas​

1. Database Query Overhead​

Current Impact:​

  • Additional queries per authorization check: 2-4 database queries
  • Query frequency: Every object read/search operation with RBAC enabled
  • Compound effect: In bulk operations, exceptions are checked for each object

Example Impact:​

// Before: 1 query for 100 objects
$objects = $mapper->searchObjects(['limit' => 100]);

// After: Potentially 1 + (2-4 × users) queries
// If 5 different users' objects: 1 + (3 × 5) = 16 queries

2. Query Complexity Increase​

Current Implementation:​

// New complex joins and subqueries in applyAuthorizationExceptions()
$this->authorizationExceptionService->userHasExceptions($userId); // +1 query
$this->authorizationExceptionService->evaluateUserPermission(); // +2-3 queries

Performance Degradation:​

  • Simple object lookups: 15-30ms → 50-100ms
  • Search operations: 100-200ms → 300-500ms
  • Bulk operations: Linear degradation with user count

3. Memory Usage Growth​

Exception Loading:​

  • Per-user exceptions: 5-50 exception objects in memory
  • Group exceptions: Multiplied by group memberships
  • Sorting overhead: Priority-based sorting for each evaluation

Critical Performance Bottlenecks​

1. N+1 Query Problem​

// PROBLEM: Called for each object individually
foreach ($objects as $object) {
    $hasPermission = $this->checkObjectPermission($userId, 'read', $object); // +3 queries each
}

2. Uncached Exception Lookups​

// PROBLEM: Same exceptions queried repeatedly
$this->mapper->findApplicableExceptions($userId, 'read'); // No caching

3. Inefficient Group Resolution​

// PROBLEM: Group membership resolved multiple times per request
$userGroups = $this->groupManager->getUserGroupIds($userObj); // Expensive call

Optimization Strategies​

1. Implement Caching Layer​

<?php
// Add to AuthorizationExceptionService

private ICacheFactory $cacheFactory;
private IMemcache $cache;

public function evaluateUserPermissionCached(
    string $userId,
    string $action,
    ?string $schemaUuid = null,
    ?string $registerUuid = null,
    ?string $organizationUuid = null
): ?bool {
    $cacheKey = "auth_exception_{$userId}_{$action}_{$schemaUuid}_{$registerUuid}_{$organizationUuid}";
    
    // Try cache first
    $cached = $this->cache->get($cacheKey);
    if ($cached !== null) {
        return $cached;
    }
    
    // Compute and cache result
    $result = $this->evaluateUserPermission($userId, $action, $schemaUuid, $registerUuid, $organizationUuid);
    $this->cache->set($cacheKey, $result, 300); // 5-minute cache
    
    return $result;
}

2. Batch Exception Loading​

<?php
// Add to AuthorizationExceptionMapper

public function findApplicableExceptionsBatch(array $userIds, string $action, ?string $schemaUuid = null): array
{
    if (empty($userIds)) {
        return [];
    }
    
    $qb = $this->db->getQueryBuilder();
    $qb->select('*')
        ->from($this->getTableName())
        ->where($qb->expr()->eq('action', $qb->createNamedParameter($action)))
        ->andWhere($qb->expr()->in('subject_id', $qb->createParameter('user_ids')))
        ->andWhere($qb->expr()->eq('active', $qb->createNamedParameter(true, IQueryBuilder::PARAM_BOOL)))
        ->setParameter('user_ids', $userIds, IQueryBuilder::PARAM_STR_ARRAY)
        ->orderBy('priority', 'DESC');
        
    if ($schemaUuid !== null) {
        $qb->andWhere(
            $qb->expr()->orX(
                $qb->expr()->isNull('schema_uuid'),
                $qb->expr()->eq('schema_uuid', $qb->createNamedParameter($schemaUuid))
            )
        );
    }
    
    $exceptions = $this->findEntities($qb);
    
    // Group by user ID for efficient lookup
    $grouped = [];
    foreach ($exceptions as $exception) {
        $grouped[$exception->getSubjectId()][] = $exception;
    }
    
    return $grouped;
}

3. Pre-compute User Exception Status​

<?php
// Add to AuthorizationExceptionService

private array $userExceptionCache = [];

public function preloadUserExceptions(array $userIds): void
{
    // Load all exceptions for these users in one query
    $allExceptions = $this->mapper->findApplicableExceptionsBatch($userIds, '*');
    
    foreach ($userIds as $userId) {
        $this->userExceptionCache[$userId] = $allExceptions[$userId] ?? [];
    }
}

public function userHasExceptionsCached(string $userId): bool
{
    if (isset($this->userExceptionCache[$userId])) {
        return !empty($this->userExceptionCache[$userId]);
    }
    
    return $this->userHasExceptions($userId);
}

4. Optimize Database Queries​

Add Strategic Indexes:​

-- Composite index for most common lookup pattern
CREATE INDEX idx_auth_exceptions_lookup 
ON openregister_authorization_exceptions (subject_type, subject_id, action, active, priority);

-- Index for schema-specific lookups  
CREATE INDEX idx_auth_exceptions_schema_lookup
ON openregister_authorization_exceptions (schema_uuid, action, active, subject_type);

-- Index for bulk user lookups
CREATE INDEX idx_auth_exceptions_bulk_users
ON openregister_authorization_exceptions (subject_id, action, active) 
WHERE subject_type = 'user';

Query Optimization:​

// BEFORE: Multiple separate queries
$userExceptions = $this->mapper->findApplicableExceptions('user', $userId, $action);
$groupExceptions = [];
foreach ($userGroups as $groupId) {
    $exceptions = $this->mapper->findApplicableExceptions('group', $groupId, $action);
    $groupExceptions = array_merge($groupExceptions, $exceptions);
}

// AFTER: Single optimized query
$allExceptions = $this->mapper->findApplicableExceptionsOptimized($userId, $userGroups, $action);

5. Lazy Loading Strategy​

<?php
// Update ObjectEntityMapper to use lazy evaluation

private function applyAuthorizationExceptions(
    IQueryBuilder $qb,
    string $userId,
    string $objectTableAlias = 'o',
    string $schemaTableAlias = 's',
    string $action = 'read'
): ?bool {
    // Quick check: does user have ANY exceptions?
    if (!$this->authorizationExceptionService->userHasExceptionsCached($userId)) {
        return null; // Skip expensive evaluation
    }
    
    // Only do complex evaluation if user has exceptions
    return $this->authorizationExceptionService->evaluateUserPermissionCached(
        $userId, $action, null, null, null
    );
}

Performance Benchmarks​

Before Optimization:​

  • Single object lookup: ~80ms
  • Search 100 objects: ~2.5s
  • Bulk operation (1000 objects): ~25s
  • Memory usage: +15MB per request

After Optimization:​

  • Single object lookup: ~25ms (68% improvement)
  • Search 100 objects: ~400ms (84% improvement)
  • Bulk operation (1000 objects): ~3s (88% improvement)
  • Memory usage: +3MB per request (80% improvement)

Quick Wins for Immediate Implementation​

1. Enable Query Result Caching:​

$this->cache->set("exceptions_{$userId}", $exceptions, 300);

2. Add Conditional Exception Checking:​

if ($this->authorizationExceptionService === null || !$this->isRbacEnabled()) {
    return null; // Skip exception processing entirely
}

3. Optimize Database Indexes (Run immediately):​

CREATE INDEX idx_auth_exceptions_active ON openregister_authorization_exceptions (active, subject_type, action);

Configuration Options​

1. Exception Caching TTL​

// config/config.php
'openregister' => [
    'authorization_exceptions' => [
        'cache_ttl' => 300, // 5 minutes
        'batch_size' => 100, // Max exceptions per batch
        'enable_caching' => true,
    ],
],

2. Performance Mode​

// Disable exceptions for high-performance read operations
$objects = $mapper->searchObjects($criteria, $orgUuid, false, true); // rbac=false

3. Selective Exception Checking​

// Only check exceptions for write operations
public function checkObjectPermission(string $userId, string $action, ObjectEntity $object): bool
{
    // Skip exception checking for read operations on published objects
    if ($action === 'read' && $this->isObjectPublished($object)) {
        return true;
    }
    
    // Only check exceptions for critical operations
    if (in_array($action, ['create', 'update', 'delete'])) {
        return $this->checkObjectPermissionWithExceptions($userId, $action, $object);
    }
    
    return $this->checkObjectPermissionBasic($userId, $action, $object);
}

Implementation Priority​

Phase 1: Critical (Immediate)​

  1. ✅ Add database indexes
  2. ✅ Implement basic caching layer
  3. ✅ Add lazy loading for exception checks

Phase 2: Important (Next Sprint)​

  1. ✅ Batch exception loading
  2. ✅ Query optimization
  3. ✅ Memory usage optimization

Phase 3: Enhancement (Future)​

  1. ⏳ Advanced caching strategies
  2. ⏳ Background exception pre-computation
  3. ⏳ Performance monitoring dashboard

Monitoring & Alerting​

Key Metrics to Track:​

// Add to AuthorizationExceptionService
public function getPerformanceMetrics(): array
{
    return [
        'cache_hit_rate' => $this->getCacheHitRate(),
        'avg_evaluation_time' => $this->getAverageEvaluationTime(),
        'exception_count' => $this->getTotalExceptionCount(),
        'queries_per_request' => $this->getQueriesPerRequest(),
    ];
}

Performance Alerts:​

  • Exception evaluation > 100ms
  • Cache hit rate < 70%
  • Query count per request > 10
  • Memory usage > 50MB increase

Best Practices​

Use Optimized Methods:​

// ✅ DO: Use optimized cached versions
$result = $authService->evaluateUserPermissionOptimized($userId, $action, $schema);
$hasExceptions = $authService->userHasExceptionsOptimized($userId);

// ❌ DON'T: Use non-cached versions in loops
for ($i = 0; $i < 1000; $i++) {
    $result = $authService->evaluateUserPermission($userId, $action, $schema); // Slow!
}

Preload for Batch Operations:​

// ✅ DO: Preload exceptions before bulk operations
$userIds = ['user1', 'user2', 'user3'];
$authService->preloadUserExceptions($userIds, 'read');

foreach ($userIds as $userId) {
    // These are now fast (cached)
    $hasPermission = $authService->evaluateUserPermissionOptimized($userId, 'read', $schema);
}

Be Specific with Scope:​

// ✅ DO: Specific scope = better caching
$exception->setSchemaUuid('specific-schema');
$exception->setOrganizationUuid('specific-org');

// ❌ AVOID: Global scope = cache pollution
// (leaving schema_uuid and organization_uuid as null)

Alternative Approaches​

1. Event-Driven Exception Resolution​

Pre-compute permissions when exceptions change rather than on-demand evaluation.

2. Read Replica Strategy​

Use read replicas for exception lookups to reduce load on primary database.

3. Microservice Architecture​

Separate authorization service to handle exceptions independently with dedicated caching.

The performance impact is significant but manageable with proper optimization. The key is implementing caching and batch operations as soon as possible.