Optimized runtime behavior of index matching during StatefulIndexPrivileges construction (#5471)

Signed-off-by: Nils Bandener <[email protected]>

Author: nibix

CHANGELOG.md

@@ -18,6 +18,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 * Replaced the standard distribution of BouncyCastle with BC-FIPS ([#5439](https://github.com/opensearch-project/security/pull/5439))
 * Introduced setting `plugins.security.privileges_evaluation.precomputed_privileges.enabled` ([#5465](https://github.com/opensearch-project/security/pull/5465))
 * Optimized wildcard matching runtime performance ([#5470](https://github.com/opensearch-project/security/pull/5470))
+* Optimized performance for construction of internal action privileges data structure  ([#5470](https://github.com/opensearch-project/security/pull/5470))
 
 ### Bug Fixes
 

src/main/java/org/opensearch/security/privileges/actionlevel/RoleBasedActionPrivileges.java

@@ -696,28 +696,30 @@ static class StatefulIndexPrivileges extends RuntimeOptimizedActionPrivileges.St
                             continue;
                         }
 
+                        List<IndexAbstraction> matchingIndices = indexMatcher.matching(indices.values(), IndexAbstraction::getName);
+                        if (matchingIndices.isEmpty()) {
+                            continue;
+                        }
+
                         for (String permission : permissions) {
                             WildcardMatcher actionMatcher = WildcardMatcher.from(permission);
                             Collection<String> matchedActions = actionMatcher.getMatchAny(
                                 WellKnownActions.INDEX_ACTIONS,
                                 Collectors.toList()
                             );
 
-                            for (Map.Entry<String, IndexAbstraction> indicesEntry : indexMatcher.iterateMatching(
-                                indices.entrySet(),
-                                Map.Entry::getKey
-                            )) {
+                            for (IndexAbstraction index : matchingIndices) {
                                 for (String action : matchedActions) {
                                     CompactMapGroupBuilder.MapBuilder<
                                         String,
                                         DeduplicatingCompactSubSetBuilder.SubSetBuilder<String>> indexToRoles = actionToIndexToRoles
                                             .computeIfAbsent(action, k -> indexMapBuilder.createMapBuilder());
 
-                                    indexToRoles.get(indicesEntry.getKey()).add(roleName);
+                                    indexToRoles.get(index.getName()).add(roleName);
 
-                                    if (indicesEntry.getValue() instanceof IndexAbstraction.Alias) {
+                                    if (index instanceof IndexAbstraction.Alias) {
                                         // For aliases we additionally add the sub-indices to the privilege map
-                                        for (IndexMetadata subIndex : indicesEntry.getValue().getIndices()) {
+                                        for (IndexMetadata subIndex : index.getIndices()) {
                                             String subIndexName = subIndex.getIndex().getName();
                                             // We need to check whether the subIndex is part of the global indices
                                             // metadata map because that map has been filtered by relevantOnly().
@@ -732,7 +734,7 @@ static class StatefulIndexPrivileges extends RuntimeOptimizedActionPrivileges.St
                                                 log.debug(
                                                     "Ignoring member index {} of alias {}. This is usually the case because the index is closed or a data stream backing index.",
                                                     subIndexName,
-                                                    indicesEntry.getKey()
+                                                    index.getName()
                                                 );
                                             }
                                         }