lablup / lablup/backend.ai

Introduce Redis cache for RBAC scope chain traversal

Open
#9,358 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
670
Forks
183
Avg merge
15h 13m
Merged PRs (30d)
368

Description

Introduce a Redis caching layer for RBAC scope chain traversal to eliminate expensive recursive CTE queries during permission checks.

## Background

Current permission checks (`check_permission_with_scope_chain()`) use a recursive CTE on `association_scopes_entities` to walk AUTO edges upward and discover all ancestor scopes for a target entity. This recursive traversal is performed on every permission check, even though the scope chain is purely structural data that rarely changes.

## Approach: Cache the scope chain, not the permission check result

The recursive CTE produces a list of ancestor scopes for a given entity. This scope chain:

- Is determined solely by `association_scopes_entities` (no user/role dependency)

- Is identical for all users — it's structural, not user-specific

- Changes only when entities are created or deleted (via entity_creator/entity_purger)

By caching the scope chain in Redis, the permission check flow changes from:

```
(before) recursive CTE → JOIN permissions/roles/user_roles → result
(after) Redis lookup for scope chain → simple SELECT ... WHERE scope_id IN (...) → result
```

## Cache design

- Cache key: `(element_type, element_id)` → set of `(scope_type, scope_id)` ancestor scopes

- Cache store: Redis

- Invalidation: Hook into entity_creator and entity_purger, which already centralize all association_scopes_entities mutations

- On entity association create/delete → invalidate that entity's cache

- On parent scope association change → invalidate affected child entities

## Related epics

- BA-4179: Implement RBAC Entity Relationship Model (BEP-1048)

- BA-4475: Implement RBAC action validator

- BA-4359: Enforce RBAC Entity Relationship Model in resolvers

JIRA Issue: BA-4698

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.