AAP-53611 Introduce a bulk re-computation context manager for RBAC #840
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AlanCoding
changed the title
AlanCoding
commented
Sep 17, 2025
test_app/views.py
Outdated
| user = User.objects.create(username=str(uuid4())) | ||
| org, _ = Organization.objects.get_or_create(name='Default') | ||
| rd.give_permission(user, org) | ||
|
|
AlanCoding
force-pushed
the
bulk_rbac
branch
from
371a33d to
d6769a4
Compare
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
DVCS PR Check Results: PR appears valid (JIRA key(s) found) |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR implements a bulk_rbac_caching context manager to optimize performance during bulk RBAC permission
operations. Currently, each call to give_permission or remove_permission triggers expensive cache updates via
update_after_assignment, which calls compute_team_member_roles() and compute_object_role_permissions(). During
migration processes or other bulk operations, this results in excessive resource consumption as these expensive
functions are called repeatedly for each individual permission change.
The new context manager defers these cache updates during bulk operations by collecting update parameters in
thread-local storage and performing a single global update when exiting the context. This maintains all existing
functionality and correctness while providing significant performance improvements for bulk scenarios. The
implementation includes comprehensive tests covering deferred updates, parameter collection, nested contexts,
exception handling, and performance verification. Usage is simple: wrap bulk operations with with
bulk_rbac_caching(): and cache updates will be automatically batched and executed once at the end.
Type of Change