Local implementation of caching user permissions

[BrekiTomasson]

I've got a project that relies quite heavily on permissions when it comes to routing, which elements to show in navigation, which options to return in <select> boxes on forms, etc, etc. Needless to say, any user navigating around the website will be creating dozens of Permission-related calls every minute, with Debug Bar regularly showing me things like this for a single page's load:

Now; I know that part of the problem is that I'm doing permission checks in multiple places - some in Controllers, some in Middleware, some in Blade views using @can/@endcan or my own @admin/@endadmin, but I still feel like there's some optimization that could be done here. I've read many of the conversations on the topic that have been held in the past, so I understand the problems inherent in this kind of thing being offered by the package itself, so I've been playing around with an implementation of my own that plays nicely with the setup that I've got, a Redis-based cache relying heavily on tags.

Here's a method that I built on my User model:

    public function cachedCan(iterable|string $abilities, mixed $arguments = []) : bool
    {
        if (is_iterable($abilities)) {
            return $this->can($abilities, $arguments);
        }

        return Cache::tags(['users', 'user:' . $this->id])->remember(
            'permission:' . Str::kebab($abilities),
            now()->addMinutes(10),
            fn () => $this->can($abilities, $arguments)
        );
    }

As you can see, I'm just returning the base value for iterables rather than attempting to cache them, mainly because calling can() on iterables are fairly rare in my implementation. However, when using a string, I'm caching the value for ten minutes, using a generic users tag and a user:61 tag (if the user in question has users.id = 61, of course). I've already got Event Listeners that Cache::tags('user:' . $user->id)->flush() whenever a user logs in and whenever a user's permissions or roles are changed, so I'm not expecting the cache to return stale results here.

... That said; am I missing something here? Can I expect this to come back and bite me in the ass in some unexpected way? Happy to hear your thoughts and ideas on this one.

[erikn69]

am I missing something here? Can I expect this to come back and bite me in the ass in some unexpected way?

Only time can answer that

I also tried something similir without problems

#1833 (comment)
#1760 (comment)

[BrekiTomasson]

I like your idea of abstracting it out behind a Trait like that! I might do the same once I've given this a run. For now, I've just built the two cachedCan() and cachedCannot() methods to try it out, but making a Trait out of it seems like the logical next step.

[erikn69]

With a trait, it's easier to remove code and revert to previous functionality if something goes wrong

Also, you could overwrite checkPermissionTo or you could make your own custom register_permission_check_method for avoid using cachedCan/cachedCannot, and use the default can/cannot

laravel-permission/src/PermissionServiceProvider.php

Lines 26 to 29 in 67e54e2

	if ($this->app->config['permission.register_permission_check_method']) {
	$permissionLoader->clearClassPermissions();
	$permissionLoader->registerPermissions();
	}

laravel-permission/src/PermissionRegistrar.php

Lines 137 to 146 in 67e54e2

	public function registerPermissions(): bool
	{
	app(Gate::class)->before(function (Authorizable $user, string $ability) {
	if (method_exists($user, 'checkPermissionTo')) {
	return $user->checkPermissionTo($ability) ?: null;
	}
	});
	return true;
	}

[BrekiTomasson]

With a trait, it's easier to remove code and revert to previous functionality if something goes wrong

Yeah, I use traits all over the place in my code, to the point that the guy I pair with has started complaining about how my classes start with a bunch of use HasCountry and use CreatesModelCaches etc. ;)

Also, you could make your own custom register_permission_check_method for avoid using cachedCan/cachedCannot, and use the default can/cannot

Yeah, this is something that I've been looking at. I just didn't want to jump the gun on something like that until I've had time to evaluate whether or not a cachedCan version works as intended. Thanks for the code sample, though, that'll save me a bunch of time! :)

[BrekiTomasson]

Just had another thought, @erikn69 - if I were to overwrite the methods as you suggest, how would that affect Laravel's native uses of can(), such as in Policy checks? Would their results get cached too, or would it only affect those queries that go via the laravel-permission logic?