cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

perf: eliminate N+1 hot-path queries, cache immutable lookups, stop re-compressing compressed bytes

Browse Source 
Every change is benchmark-verified (harness + before/after numbers in
benches/, measured on this branch; reproduction commands in each doc):

DAV / sync-client hot paths
- PROPFIND dead-properties: one = ANY($1) query per 500-child page instead
  of one sequential query per child, and indexable `=` predicates instead
  of IS NOT DISTINCT FROM (seq scans). 2,000-child folder: 1.07-4.54 s of
  DB chatter -> 4-6 ms (258-773x). Applied to native + NC PROPFIND and
  both NC REPORT handlers. [benches/DEAD-PROPS.md]
- Folder paging: keyset cursor (name > $last) + new partial index
  (folder_id, name) replaces LIMIT/OFFSET full-folder rescan per page.
  Full 20k-file walk: 1266 ms -> 77 ms (16.5x). New migration
  20260917000000. [benches/PROPFIND-PAGING.md]
- NC chroot / default-drive resolution: moka caches (30 s TTL, explicit
  invalidation on drive mutations) for find_default_for_user and the
  markerless chroot FolderDto. 2 uncached queries + 2 pool checkouts per
  NC/WebDAV/WOPI request -> sub-us moka hit (p50 0.7-3.6 ms -> ~1 us).
  [benches/CHROOT-CACHE.md]
- Quota: PROPFINDs whose prop list never names a quota prop skip the
  2-query resolution entirely (wants_quota()); the remaining lookups read
  2 columns instead of the full auth.users row with its <=512 KiB avatar
  (11-16x, p50 3.4 ms -> 0.29 ms). Same narrow read now gates every
  upload quota check. [benches/QUOTA-PATH.md]

CPU on the request path
- ZIP exports (folder download, share ZIP, batch download): entries whose
  MIME says already-compressed (JPEG/MP4/zip/pdf/...) are Stored instead
  of Deflate - deflate ran inline on the tokio writer task at ~41 MB/s
  for ~0% size gain. Mixed media corpus: 4.31x wall and CPU, archive size
  unchanged. Shared predicate in common::mime_detect. [benches/ZIP-MEDIA.md]
- Compression layers: tower-http's default maps to Brotli QUALITY 11
  (verified in brotli-8.0.2 source and empirically: 90 ms per 64 KiB JSON
  response, 1.3 s per 700 KiB bundle). Both layers pinned to Precise(4):
  99x less CPU for ~15% more bytes. SPA assets are now precompressed at
  build time (scripts/precompress.mjs, 77% smaller) and served via
  ServeDir::precompressed_br/gzip: 2016x less per-request work, and
  clients get the better q11 bytes. [benches/STATIC-PRECOMPRESSED.md]

Batched / cached backend paths [benches/NPLUS1-AND-CACHES.md]
- Content-search ReBAC re-verification: new
  AuthorizationEngine::check_files_read_batch (default = old loop;
  PgAclEngine override batches drive resolution + reuses role cache).
  200 sequential point SELECTs per search -> 1-2 queries.
- Batch-ZIP subtree downloads: drop per-file re-authz + per-file Recent
  recording (2 writes/file) for subtree entries already authorized at the
  root - mirrors the native folder-download path. ~6,000 statements
  removed from a 2,000-file archive.
- CDC chunk manifests: immutable by content address, now moka-cached
  (weight-bounded 32 MiB, 60 s TTL, positive-only, invalidated on delete)
  - removes one manifest query (p50 0.44-4.4 ms) from every stream,
  range and full blob read.
- People tab: grouped COUNT + batched cover lookup instead of dragging
  every face row with its 2 KiB embedding (10k faces: 30.4 ms & 21 MB ->
  3.8 ms & 1.3 KB, 8.1x); merge() is one set-based UPDATE.
  [benches/PEOPLE-LIST.md]
- Photos timeline cursor: raw timestamptz comparison instead of
  EXTRACT(EPOCH ...) wrapper + IS NULL OR disjunction - cursor is an
  index boundary again, deep scroll stops re-scanning skipped rows.
- Public share landing: one atomic UPDATE ... access_count + 1 (was
  SELECT + full-row write-back: racy, lost updates, clobbered concurrent
  owner edits) - 3 round-trips -> 2 per visit.
- move_to_trash: dead full-entity SELECT feeding a documented no-op
  removed from both branches; dead fields dropped from TrashService.
- NFC normalization: is_nfc_quick fast path skips the decompose/recompose
  state machine for the ~100% already-NFC case (every row loaded from PG).

Frontend
- Large folders paint after page one (~200 items) via fetchFolderListing's
  new onPage hook instead of waiting for every sequential page.
- Tested-and-reverted (kept for the record): cached Intl.Collator for name
  sorts - vitest showed it 2x SLOWER than V8's argument-less localeCompare
  fast path (5.6 ms vs 12.1 ms / 5k names). Sort order untouched.

New bench harnesses under examples/ (bench feature): zip_media,
dead_props, chroot_cache, quota_path, people_list, propfind_paging,
static_precompress.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBK1RdtzyP6759Muqe1K1w
This commit is contained in:
Claude
2026-07-16 14:20:20 +00:00
parent b69c18b934
commit aba89c4f5d
52 changed files with 3262 additions and 444 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/application/services/batch_operations.rs
+38 -11
View File
@@ -734,7 +734,13 @@ impl BatchOperationService {
{
Ok(file_dto) => {
match self
.add_file_entry_streamed(&mut zip, file_id, &file_dto.name, user_id)
.add_file_entry_streamed(
&mut zip,
file_id,
&file_dto.name,
&file_dto.mime_type,
Some(user_id),
)
.await
{
Ok(_) => items_added += 1,
@@ -758,7 +764,7 @@ impl BatchOperationService {
{
Ok(root_folder) => {
match self
.add_folder_subtree_to_zip(&mut zip, folder_id, &root_folder, user_id)
.add_folder_subtree_to_zip(&mut zip, folder_id, &root_folder)
.await
{
Ok(_) => items_added += 1,
@@ -803,24 +809,44 @@ impl BatchOperationService {
}
/// Streams a single file into an async ZIP entry (~64 KB peak RAM per file).
///
/// Already-compressed content (per its MIME type) is `Stored` — deflating
/// JPEG/MP4/… burns ~a CPU core per download for ~0 % size gain.
///
/// `caller_id = Some(uid)` enforces the per-file Read check and records
/// the access in Recents (explicitly-selected top-level files).
/// `None` = the file was enumerated from a folder subtree whose ROOT the
/// caller already passed `get_folder_with_perms` for — per-file
/// re-authorization and per-file Recent spam (2 writes/file via the
/// recent hook) are skipped, mirroring `ZipService::create_folder_zip`
/// on the native folder-download path (benches/ZIP-BATCH-AUTHZ.md).
async fn add_file_entry_streamed(
&self,
zip: &mut ZipFileWriter<tokio_util::compat::Compat<BufWriter<tokio::fs::File>>>,
file_id: &str,
entry_name: &str,
caller_id: Uuid,
mime_type: &str,
caller_id: Option<Uuid>,
) -> Result<(), BatchOperationError> {
let entry = ZipEntryBuilder::new(entry_name.to_string().into(), Compression::Deflate);
let compression = crate::common::mime_detect::zip_entry_compression(mime_type);
let entry = ZipEntryBuilder::new(entry_name.to_string().into(), compression);
let mut writer = zip
.write_entry_stream(entry)
.await
.map_err(|e| BatchOperationError::Internal(format!("zip entry start: {}", e)))?;
let stream = self
.file_retrieval
.get_file_stream_with_perms(file_id, caller_id)
.await
.map_err(BatchOperationError::Domain)?;
let stream = match caller_id {
Some(uid) => self
.file_retrieval
.get_file_stream_with_perms(file_id, uid)
.await
.map_err(BatchOperationError::Domain)?,
None => self
.file_retrieval
.get_file_stream(file_id)
.await
.map_err(BatchOperationError::Domain)?,
};
let mut stream = std::pin::Pin::from(stream);
while let Some(chunk) = stream.next().await {
@@ -849,7 +875,6 @@ impl BatchOperationService {
zip: &mut ZipFileWriter<tokio_util::compat::Compat<BufWriter<tokio::fs::File>>>,
folder_id: &str,
root_folder: &FolderDto,
caller_id: Uuid,
) -> Result<(), BatchOperationError> {
// Bulk-fetch folder tree (small — one entry per folder)
let all_folders = self
@@ -903,8 +928,10 @@ impl BatchOperationService {
if let Some(files) = files_by_folder.get(&folder.id) {
for file in files {
let file_path = format!("{}{}", zip_dir, file.name);
// Subtree pre-authorized at the root folder — see
// `add_file_entry_streamed` docs for why `None`.
if let Err(e) = self
.add_file_entry_streamed(zip, &file.id, &file_path, caller_id)
.add_file_entry_streamed(zip, &file.id, &file_path, &file.mime_type, None)
.await
{
info!("Could not add file {} to ZIP: {}", file.name, e);
src/application/services/file_retrieval_service.rs
+4 -4
View File
@@ -451,12 +451,12 @@ impl FileRetrievalUseCase for FileRetrievalService {
async fn list_files_batch(
&self,
folder_id: Option<&str>,
offset: i64,
after_name: Option<&str>,
limit: i64,
) -> Result<Vec<FileDto>, DomainError> {
let files = self
.file_read
.list_files_batch(folder_id, offset, limit)
.list_files_batch(folder_id, after_name, limit)
.await?;
Ok(files.into_iter().map(FileDto::from).collect())
}
@@ -465,7 +465,7 @@ impl FileRetrievalUseCase for FileRetrievalService {
&self,
folder_id: Option<&str>,
owner_id: Uuid,
offset: i64,
after_name: Option<&str>,
limit: i64,
) -> Result<Vec<FileDto>, DomainError> {
// Post-D0: every file lives in a folder — `storage.files.folder_id`
@@ -482,7 +482,7 @@ impl FileRetrievalUseCase for FileRetrievalService {
.await?;
let files = self
.file_read
.list_files_batch(folder_id, offset, limit)
.list_files_batch(folder_id, after_name, limit)
.await?;
Ok(files.into_iter().map(FileDto::from).collect())
}
src/application/services/people_service.rs
+21 -14
View File
@@ -166,18 +166,23 @@ impl PeopleService {
}
/// People (non-empty clusters), most-photographed first.
///
/// Counts come from a grouped-COUNT query and cover photos from one
/// batched lookup of just the cover face ids — the previous
/// `faces_for_user` shipped every face row (2 KiB embedding included)
/// only to count them: ~20 MB of BYTEA per request on a 10k-face
/// library (benches/PEOPLE-LIST.md).
pub async fn list_people(&self, caller_id: Uuid) -> Result<Vec<PersonDto>, DomainError> {
let persons = self.repo.persons_for_user(caller_id).await?;
let faces = self.repo.faces_for_user(caller_id).await?;
let mut count: HashMap<Uuid, i64> = HashMap::new();
let mut face_file: HashMap<Uuid, Uuid> = HashMap::new();
for f in &faces {
if let Some(pid) = f.person_id {
*count.entry(pid).or_default() += 1;
}
face_file.insert(f.id, f.file_id);
}
let count: HashMap<Uuid, i64> = self
.repo
.person_face_stats(caller_id)
.await?
.into_iter()
.collect();
let cover_ids: Vec<Uuid> = persons.iter().filter_map(|p| p.cover_face_id).collect();
let face_file: HashMap<Uuid, Uuid> =
self.repo.file_ids_for_faces(caller_id, &cover_ids).await?;
let mut out: Vec<PersonDto> = persons
.into_iter()
@@ -245,11 +250,13 @@ impl PeopleService {
/// Merge `from` into `into` by reassigning all of `from`'s faces. The
/// now-empty `from` person is hidden by `list_people`.
///
/// One set-based UPDATE — the previous shape loaded every face row
/// (embeddings included) and issued one UPDATE per matching face.
pub async fn merge(&self, caller_id: Uuid, into: Uuid, from: Uuid) -> Result<(), DomainError> {
let faces = self.repo.faces_for_user(caller_id).await?;
for f in faces.into_iter().filter(|f| f.person_id == Some(from)) {
self.repo.assign_person(f.id, Some(into)).await?;
}
self.repo
.reassign_person_faces(caller_id, from, into)
.await?;
Ok(())
}
src/application/services/search_service.rs
+33 -27
View File
@@ -260,7 +260,7 @@ impl SearchService {
user_id: Uuid,
) -> Vec<ContentHitDto> {
use crate::application::ports::authorization_ports::AuthorizationEngine;
use crate::domain::services::authorization::{Permission, Resource, Subject};
use crate::domain::services::authorization::Subject;
let Some(index) = &self.content_index else {
return Vec::new();
@@ -316,36 +316,42 @@ impl SearchService {
// drive the caller doesn't otherwise have. The Tantivy
// filter is drive-only; this re-check restores per-file
// resolution.
// Failures degrade conservatively (drop the hit, log it) —
// never leak.
let mut verified = Vec::with_capacity(hits.len());
for hit in hits {
let file_uuid = match Uuid::parse_str(&hit.file_id) {
Ok(u) => u,
// Failures degrade conservatively (drop the hit / the page,
// log it) — never leak. Batched: one drive-resolution query for
// the whole page instead of up to CONTENT_HITS_LIMIT sequential
// point SELECTs (benches/SEARCH-REBAC.md).
let mut hit_ids = Vec::with_capacity(hits.len());
for hit in &hits {
match Uuid::parse_str(&hit.file_id) {
Ok(u) => hit_ids.push(u),
Err(_) => {
tracing::warn!("Content-index hit had non-UUID file_id: {}", hit.file_id);
continue;
}
}
}
let allowed = match authz
.check_files_read_batch(Subject::User(user_id), &hit_ids)
.await
{
Ok(set) => set,
Err(e) => {
tracing::warn!("ReBAC re-check failed for content hits: {e}");
return Vec::new();
}
};
let mut verified = Vec::with_capacity(hits.len());
for hit in hits {
let Ok(file_uuid) = Uuid::parse_str(&hit.file_id) else {
continue; // already warned above
};
match authz
.check(
Subject::User(user_id),
Permission::Read,
Resource::File(file_uuid),
)
.await
{
Ok(true) => verified.push(hit),
Ok(false) => {
tracing::debug!(
target: "oxicloud::search",
file_id = %file_uuid,
"dropping content-index hit: ReBAC denies Read after Tantivy filter",
);
}
Err(e) => {
tracing::warn!("ReBAC re-check failed for {file_uuid}: {e}");
}
if allowed.contains(&file_uuid) {
verified.push(hit);
} else {
tracing::debug!(
target: "oxicloud::search",
file_id = %file_uuid,
"dropping content-index hit: ReBAC denies Read after Tantivy filter",
);
}
}
verified
src/application/services/share_service.rs
+11 -22
View File
@@ -510,29 +510,18 @@ impl ShareUseCase for ShareService {
}
async fn register_shared_link_access(&self, token: &str) -> Result<(), DomainError> {
// Find the shared link by its token
let share = self
.share_repository
.find_share_by_token(token)
.await
.map_err(|e| {
ShareServiceError::NotFound(format!("Share with token {} not found: {}", token, e))
})?;
// Check if it has expired
if share.is_expired() {
return Err(ShareServiceError::Expired.into());
// One atomic UPDATE (see `ShareStoragePort::increment_access_count`).
// 0 rows = missing or expired — collapsed into NotFound, same
// response shape either way (anti-enumeration; the landing handler
// discards this result regardless).
let updated = self.share_repository.increment_access_count(token).await?;
if updated == 0 {
return Err(ShareServiceError::NotFound(format!(
"Share with token {} not found or expired",
token
))
.into());
}
// Increment the access counter
let updated_share = share.increment_access_count();
// Save the changes
self.share_repository
.update_share(&updated_share)
.await
.map_err(|e| ShareServiceError::Repository(e.to_string()))?;
Ok(())
}
}
src/application/services/storage_usage_service.rs
+6 -6
View File
@@ -1,4 +1,3 @@
use crate::application::ports::auth_ports::UserStoragePort;
use crate::application::ports::storage_ports::StorageUsagePort;
use crate::common::errors::DomainError;
use crate::infrastructure::repositories::pg::UserPgRepository;
@@ -512,9 +511,9 @@ impl StorageUsagePort for StorageUsageService {
user_id: Uuid,
additional_bytes: u64,
) -> Result<(), DomainError> {
let user = self.user_repository.get_user_by_id(user_id).await?;
let quota = user.storage_quota_bytes();
let used = user.storage_used_bytes();
// Narrow 2-column read — the full user row carries the up-to-512 KiB
// avatar `image` column, paid on every upload quota check otherwise.
let (used, quota) = self.user_repository.get_storage_usage(user_id).await?;
// Quota of 0 means unlimited
if quota <= 0 {
@@ -548,8 +547,9 @@ impl StorageUsagePort for StorageUsageService {
}
async fn get_user_storage_info(&self, user_id: Uuid) -> Result<(i64, i64), DomainError> {
let user = self.user_repository.get_user_by_id(user_id).await?;
Ok((user.storage_used_bytes(), user.storage_quota_bytes()))
// Narrow 2-column read (avatar-free) — runs on every folder PROPFIND
// that reports quota. See benches/QUOTA-PATH.md.
Ok(self.user_repository.get_storage_usage(user_id).await?)
}
async fn add_drive_storage_usage_delta(
src/application/services/trash_service.rs
+22 -118
View File
@@ -14,7 +14,7 @@ use crate::application::dtos::trash_dto::{
};
use crate::application::ports::authorization_ports::AuthorizationEngine;
use crate::application::ports::file_lifecycle::FileLifecycleHook;
use crate::application::ports::storage_ports::{FileReadPort, FileWritePort};
use crate::application::ports::storage_ports::FileWritePort;
use crate::application::ports::trash_ports::TrashUseCase;
use crate::common::errors::{DomainError, ErrorKind, Result};
use crate::domain::entities::file::File;
@@ -24,7 +24,6 @@ use crate::domain::repositories::folder_repository::FolderRepository;
use crate::domain::repositories::trash_repository::TrashRepository;
use crate::domain::services::authorization::ResourceKind;
use crate::domain::services::authorization::{Permission, Resource, Subject};
use crate::infrastructure::repositories::pg::file_blob_read_repository::FileBlobReadRepository;
use crate::infrastructure::repositories::pg::file_blob_write_repository::FileBlobWriteRepository;
use crate::infrastructure::repositories::pg::folder_db_repository::FolderDbRepository;
use crate::infrastructure::repositories::pg::trash_db_repository::TrashDbRepository;
@@ -49,9 +48,6 @@ pub struct TrashService {
/// Repository for trash-specific operations like listing and retrieving trashed items
trash_repository: Arc<TrashDbRepository>,
/// Port for file read operations (get file metadata)
file_read_port: Arc<FileBlobReadRepository>,
/// Port for file write operations (trash, restore, delete)
file_write_port: Arc<FileBlobWriteRepository>,
@@ -75,19 +71,14 @@ pub struct TrashService {
/// so trash listings filter by drive membership instead of the legacy
/// per-user scope.
drive_repo: Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
/// Number of days items should be kept in trash before automatic cleanup
retention_days: u32,
}
impl TrashService {
#[allow(clippy::too_many_arguments)]
pub fn new(
trash_repository: Arc<TrashDbRepository>,
file_read_port: Arc<FileBlobReadRepository>,
file_write_port: Arc<FileBlobWriteRepository>,
folder_storage_port: Arc<FolderDbRepository>,
retention_days: u32,
dedup_service: Arc<DedupService>,
content_cache: Option<Arc<FileContentCache>>,
authz: Arc<PgAclEngine>,
@@ -95,7 +86,6 @@ impl TrashService {
) -> Self {
Self {
trash_repository,
file_read_port,
file_write_port,
folder_storage_port,
dedup_service,
@@ -103,7 +93,6 @@ impl TrashService {
content_cache,
authz,
drive_repo,
retention_days,
}
}
@@ -177,23 +166,17 @@ impl TrashUseCase for TrashService {
// Note: We now verify file/folder ownership BEFORE moving to trash.
// This prevents users from trashing items they do not own (IDOR).
// Parse UUIDs with detailed error handling
// Parse UUIDs with detailed error handling. The parsed value is
// re-derived per branch below; this early check preserves the 400
// (validation) error shape for malformed ids.
debug!("Validating item UUID: {}", item_id);
let item_uuid = match Uuid::parse_str(item_id) {
Ok(uuid) => {
debug!("Valid item UUID: {}", uuid);
uuid
}
Err(e) => {
error!("Invalid item UUID: {} - Error: {}", item_id, e);
return Err(DomainError::validation_error(format!(
"Invalid item ID: {}",
e
)));
}
};
let user_uuid = user_id;
if let Err(e) = Uuid::parse_str(item_id) {
error!("Invalid item UUID: {} - Error: {}", item_id, e);
return Err(DomainError::validation_error(format!(
"Invalid item ID: {}",
e
)));
}
match item_type {
"file" => {
@@ -209,59 +192,13 @@ impl TrashUseCase for TrashService {
)
.await?;
// Authz already passed — use the non-owner-scoped read so that
// grantees with Delete permission can trash files they don't own.
// The file's user_id in storage.files is unchanged, so the item
// will appear in the original owner's trash view.
let file = match self.file_read_port.get_file(item_id).await {
Ok(file) => {
debug!("File found: {} ({})", file.name(), item_id);
file
}
Err(e) => {
error!("Error getting file: {} - {}", item_id, e);
return Err(DomainError::new(
ErrorKind::NotFound,
"File",
format!("Error retrieving file {}: {}", item_id, e),
));
}
};
let original_path = file.storage_path().to_string();
debug!("Original file path: {}", original_path);
debug!("Creating TrashedItem object for the file");
let trashed_item = TrashedItem::new(
item_uuid,
user_uuid,
TrashedItemType::File,
file.name().to_string(),
original_path,
self.retention_days,
);
debug!(
"TrashedItem created successfully: {} -> {}",
file.name(),
trashed_item.id()
);
// First add to trash index to register the item
info!("Adding file {} to trash index", item_id);
match self.trash_repository.add_to_trash(&trashed_item).await {
Ok(_) => {
debug!("File added to trash index successfully");
}
Err(e) => {
error!("Error adding file to trash index: {}", e);
return Err(DomainError::internal_error(
"TrashRepository",
format!("Failed to add file to trash: {}", e),
));
}
};
// Then physically move the file to trash.
// Soft-delete model: the is_trashed flag on the row IS the
// trash membership — there is no separate trash index to
// register into (`TrashRepository::add_to_trash` is a
// documented no-op). The previous shape still fetched the
// full file entity and built a `TrashedItem` only to feed
// that no-op: one wasted SELECT per trash operation.
//
// §14: caller_id stamps `updated_by` on the trashed row.
info!("Physically moving file to trash: {}", item_id);
match self.file_write_port.move_to_trash(item_id, user_id).await {
@@ -293,43 +230,10 @@ impl TrashUseCase for TrashService {
)
.await?;
let folder = self
.folder_storage_port
.get_folder(item_id)
.await
.map_err(|e| {
DomainError::new(
ErrorKind::NotFound,
"Folder",
format!("Error retrieving folder {}: {}", item_id, e),
)
})?;
let original_path = folder.storage_path().to_string();
let trashed_item = TrashedItem::new(
item_uuid,
user_uuid,
TrashedItemType::Folder,
folder.name().to_string(),
original_path,
self.retention_days,
);
// First add to trash index to register the item
debug!("Adding folder {} to trash repository", item_id);
match self.trash_repository.add_to_trash(&trashed_item).await {
Ok(_) => debug!("Successfully added folder to trash repository"),
Err(e) => {
error!("Failed to add folder to trash repository: {}", e);
return Err(DomainError::internal_error(
"TrashRepository",
format!("Failed to add folder to trash: {}", e),
));
}
};
// Then physically move the folder to trash.
// Soft-delete model — same as the file branch above: the
// cascade UPDATE below is the whole operation; no folder
// fetch or trash-index write needed.
//
// §14: caller_id stamps `updated_by` on every cascade-trashed row.
self.folder_storage_port
.move_to_trash(item_id, user_id)