cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

perf: round 23 — Postgres query-shape pass: typed JSONB decode, drive-policy borrow-deserialize, user-profile join!, subject-group CTE reuse, dedup unzip

Browse Source 
Benchmark-gated, same rule as ROUND2-22: BEFORE/AFTER with a value-equivalence
gate and rollback-on-regression. Two harnesses — bench_round23_micro (no
Postgres; deterministic allocation gate) and bench_round23_queries (live
Postgres; p50 latency + strict equivalence gate against seeded fixtures). See
benches/ROUND23.md.

- J1: contact_pg_repository::row_to_contact (+ the inlined contact_group sibling)
  decode the 3 JSONB columns via sqlx::types::Json<T> (one from_slice pass)
  instead of row.get::<serde_json::Value> + from_value (a throwaway Value DOM
  per column, walked a second time). Per contact row of every list / multiget /
  CardDAV sync. Micro 84 -> 33 allocs/op (2.15x); PG 3794 -> 2360 ns/contact
  (1.61x) on 500 real rows.
- J2: DrivePolicies::from_value deserializes straight from the borrow
  (T::deserialize(&Value)) instead of from_value(value.clone()) — dropping the
  full-DOM clone on every drive-policy read (move/copy, share, grant); one-line
  body change, all 7 callers unchanged. Micro 5 -> 0 allocs/op (11.51x).
- P1: get_user_profile overlaps the two independent caller+target reads with
  tokio::join! (self-case still a single fetch; caller-error precedence
  preserved via caller_res? first) instead of two serial round-trips. PG
  577 -> 312 us/call (1.85x).
- G1: subject_group remove_member computes the child's transitive-user recursive
  CTE once and reuses it for both the would-empty pre-check and the cache
  invalidation, instead of running the identical CTE twice (the edge delete is
  above the child, so its descendants can't change). PG 829 -> 412 us/removal
  (2.01x).
- U1: dedup_service (store_loose_chunks final registration + the ingest
  run_rollback) reshapes the owned, dead-after Vec<(String,i64)> via
  into_iter().unzip() instead of cloning every 64-byte hash for the
  sync_blobs(&[String]) + UNNEST bind. Micro 256 -> 0 hash clones.

Verified: cargo clippy --features bench --all-targets -D warnings clean, cargo
fmt --all --check clean, cargo test --lib --features bench = 529 passed / 0
failed. The PG benches run against a local PostgreSQL 16 (schema applied from
migrations/); every equivalence gate passes.

The download_zip per-item N+1 (the audit's highest raw-latency candidate) is
deferred to a dedicated pass: its fix moves the sole authorization inside the
stream call, so it needs an AuthZ-ordering + anti-enumeration proof, not a perf
banner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DKyQ4AnYtgp1JtjzweyMeo
This commit is contained in:
Claude
2026-07-20 15:25:42 +00:00
parent 992bdae898
commit 1ec7030cc7
10 changed files with 1107 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/application/services/subject_group_service.rs
+32 -12
View File
@@ -477,6 +477,23 @@ impl SubjectGroupService {
// user is still reachable via another path after this remove,
// they stay in the set on the post-state, so the check would
// pass on the next remove instead.
// For a nested child-group removal the child's transitive user set is
// needed twice: by the would-empty pre-check below AND, after the
// remove, as the cache-invalidation set. The edge delete is ABOVE the
// child, so it cannot change the child's descendants — compute the
// recursive CTE ONCE here and reuse it, instead of the identical query
// running twice (the second was hidden inside `invalidation_targets`).
// (benches/ROUND23.md §G1)
let child_users: Option<Vec<uuid::Uuid>> = match member {
GroupMember::Group(child_id) => Some(
self.repo
.list_transitive_users(child_id)
.await
.map_err(map_repo_err)?,
),
GroupMember::User(_) => None,
};
let users_before = self
.repo
.list_transitive_users(group_id)
@@ -485,17 +502,12 @@ impl SubjectGroupService {
if !users_before.is_empty() {
let would_be_empty = match member {
GroupMember::User(uid) => users_before.len() == 1 && users_before.contains(&uid),
GroupMember::Group(child_id) => {
// For child-group removal: would this drop the
// parent's transitive user set to 0? Look up the
// child's transitive users — if every user in the
// parent's set comes through the child, removing the
// child empties the parent.
let child_users = self
.repo
.list_transitive_users(child_id)
.await
.map_err(map_repo_err)?;
GroupMember::Group(_) => {
// Would removing this child drop the parent's transitive
// user set to 0? Reuse the child's transitive users
// computed above — if every user in the parent's set comes
// through the child, removing the child empties the parent.
let child_users = child_users.as_deref().unwrap_or(&[]);
// Set probe instead of an O(|before|·|child|) slice scan
// (benches/ROUND11.md §13: 5.7x at 500×500).
let child_set: std::collections::HashSet<&uuid::Uuid> =
@@ -535,7 +547,15 @@ impl SubjectGroupService {
// ancestor. Without this, a removed-from-group user keeps
// appearing as a transitive member in `expand_subject_for_listing`
// for up to 30 s, surfacing grants they no longer have.
for uid in self.invalidation_targets(member).await? {
//
// Reuse the child's transitive users computed above (unchanged by the
// edge delete) as the invalidation set — no second recursive CTE. For a
// `User` member it's just that user. (benches/ROUND23.md §G1)
let invalidation: Vec<uuid::Uuid> = match member {
GroupMember::User(uid) => vec![uid],
GroupMember::Group(_) => child_users.unwrap_or_default(),
};
for uid in invalidation {
self.engine.invalidate_user_groups_cache(uid).await;
self.drive_repo.invalidate_readable_for_user(uid).await;
}