apache / apache/gravitino

[Improvement] make Jcasbin enforcer stateless

Open
#7,770 2 comments 0 reactions 0 assignees View on GitHub
improvement
Dominant language
Java
Stars
3.2k
Forks
935
Avg merge
1d 16h
Merged PRs (30d)
298

Description

### What would you like to be improved?

Currently we keep all Gravitino privileges in Jcasbin enforcer, and use a event system to keep consistent the privilege with Gravitino entity store. There are some cons:
1. The Jcasbin enforcer information are not syced in multi Gravitino server enviroments.
2. It is hard to maintain the correctness of the privilege by event
3. In a concurrent environment, could it work well?

### How should we improve?

Create a new `enforcer` for each authorizer request, maybe an extra performance decrease for creating `enforcer` object.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the authorizer request path and how the Jcasbin enforcer is synchronized with the Gravitino entity store through the event system. Examine the current privilege handling and assess the proposed per-request enforcer against concurrent and multi-server use. Done means privilege state no longer depends on shared enforcer synchronization and remains consistent across Gravitino servers.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, backend
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.