Introduce Redis cache for RBAC scope chain traversal
- Dominant language
- Python
- Stars
- 670
- Forks
- 183
- Avg merge
- 15h 13m
- Merged PRs (30d)
- 368
Description
Introduce a Redis caching layer for RBAC scope chain traversal to eliminate expensive recursive CTE queries during permission checks.
## Background
Current permission checks (`check_permission_with_scope_chain()`) use a recursive CTE on `association_scopes_entities` to walk AUTO edges upward and discover all ancestor scopes for a target entity. This recursive traversal is performed on every permission check, even though the scope chain is purely structural data that rarely changes.
## Approach: Cache the scope chain, not the permission check result
The recursive CTE produces a list of ancestor scopes for a given entity. This scope chain:
- Is determined solely by `association_scopes_entities` (no user/role dependency)
- Is identical for all users — it's structural, not user-specific
- Changes only when entities are created or deleted (via entity_creator/entity_purger)
By caching the scope chain in Redis, the permission check flow changes from:
```
(before) recursive CTE → JOIN permissions/roles/user_roles → result
(after) Redis lookup for scope chain → simple SELECT ... WHERE scope_id IN (...) → result
```
## Cache design
- Cache key: `(element_type, element_id)` → set of `(scope_type, scope_id)` ancestor scopes
- Cache store: Redis
- Invalidation: Hook into entity_creator and entity_purger, which already centralize all association_scopes_entities mutations
- On entity association create/delete → invalidate that entity's cache
- On parent scope association change → invalidate affected child entities
## Related epics
- BA-4179: Implement RBAC Entity Relationship Model (BEP-1048)
- BA-4475: Implement RBAC action validator
- BA-4359: Enforce RBAC Entity Relationship Model in resolvers
JIRA Issue: BA-4698
Contributor guide
Assessment
This issue has not been assessed yet.