Improve RBAC sub system to improve memory efficiency

server/.env.example

@@ -220,6 +220,66 @@
 # Default: <no value>
 # RBAC_LOG=<no value>
 
+###############################################################################
+# Limit the number of resources to keep in the in-memory index.
+# When set to -1, max size is used.
+# When set to 0, the in memory index is not used.
+# Type:    int
+# Default: <no value>
+# RBAC_MAX_INDEX_SIZE=<no value>
+
+###############################################################################
+# Synchronous lets us make all the procedures synchronous for ease of testing
+# This should always be false in production
+# Type:    bool
+# Default: <no value>
+# RBAC_SYNCHRONOUS=<no value>
+
+###############################################################################
+# Reindex strategy defines what strategy we should use.
+# The available options are:
+# 
+# . `memory`: prioritize memory consumption which reduces performance during reindexing.
+# . `speed`: prioritize speed during reindexing; memory consumption will be 2n where n is the current index size.
+# 
+# If you wish to prioritize memory and speed, consider using `speed` with a lower max index size
+# Type:    string
+# Default: 
+# RBAC_REINDEX_STRATEGY=
+
+###############################################################################
+# Decay factor controls how long an item should be kept in the index while not in use.
+# Type:    float64
+# Default: <no value>
+# RBAC_DECAY_FACTOR=<no value>
+
+###############################################################################
+# Decay interval controls how fast the decay factor is applied to the index key.
+# Type:    time.Duration
+# Default: <no value>
+# RBAC_DECAY_INTERVAL=<no value>
+
+###############################################################################
+# Cleanup interval controls when unused/low-scored index items should be yanked out of the index counter.
+# Type:    time.Duration
+# Default: <no value>
+# RBAC_CLEANUP_INTERVAL=<no value>
+
+###############################################################################
+# Reindex interval controls when the index should be re-calculated.
+# Type:    time.Duration
+# Default: <no value>
+# RBAC_REINDEX_INTERVAL=<no value>
+
+###############################################################################
+# [IMPORTANT]
+# ====
+# Unused, will be added when state preservation is implemented.
+# ====
+# Type:    time.Duration
+# Default: <no value>
+# RBAC_INDEX_FLUSH_INTERVAL=<no value>
+
 ###############################################################################
 # Type:    string
 # Default: <no value>

server/app/boot_levels.go

@@ -1,53 +1,53 @@
 package app
 
 import (
-    "context"
-    "crypto/tls"
-    "fmt"
-    "net/url"
-    "os"
-    "regexp"
-    "strings"
-    "time"
-
-    authService "github.com/cortezaproject/corteza/server/auth"
-    "github.com/cortezaproject/corteza/server/auth/saml"
-    authSettings "github.com/cortezaproject/corteza/server/auth/settings"
-    autService "github.com/cortezaproject/corteza/server/automation/service"
-    cmpService "github.com/cortezaproject/corteza/server/compose/service"
-    cmpEvent "github.com/cortezaproject/corteza/server/compose/service/event"
-    discoveryService "github.com/cortezaproject/corteza/server/discovery/service"
-    fedService "github.com/cortezaproject/corteza/server/federation/service"
-    "github.com/cortezaproject/corteza/server/pkg/actionlog"
-    "github.com/cortezaproject/corteza/server/pkg/apigw"
-    apigwTypes "github.com/cortezaproject/corteza/server/pkg/apigw/types"
-    "github.com/cortezaproject/corteza/server/pkg/auth"
-    "github.com/cortezaproject/corteza/server/pkg/corredor"
-    "github.com/cortezaproject/corteza/server/pkg/eventbus"
-    "github.com/cortezaproject/corteza/server/pkg/healthcheck"
-    "github.com/cortezaproject/corteza/server/pkg/http"
-    "github.com/cortezaproject/corteza/server/pkg/id"
-    "github.com/cortezaproject/corteza/server/pkg/locale"
-    "github.com/cortezaproject/corteza/server/pkg/logger"
-    "github.com/cortezaproject/corteza/server/pkg/mail"
-    "github.com/cortezaproject/corteza/server/pkg/messagebus"
-    "github.com/cortezaproject/corteza/server/pkg/monitor"
-    "github.com/cortezaproject/corteza/server/pkg/options"
-    "github.com/cortezaproject/corteza/server/pkg/provision"
-    "github.com/cortezaproject/corteza/server/pkg/rbac"
-    "github.com/cortezaproject/corteza/server/pkg/scheduler"
-    "github.com/cortezaproject/corteza/server/pkg/sentry"
-    "github.com/cortezaproject/corteza/server/pkg/valuestore"
-    "github.com/cortezaproject/corteza/server/pkg/version"
-    "github.com/cortezaproject/corteza/server/pkg/websocket"
-    "github.com/cortezaproject/corteza/server/store"
-    "github.com/cortezaproject/corteza/server/system/service"
-    sysService "github.com/cortezaproject/corteza/server/system/service"
-    sysEvent "github.com/cortezaproject/corteza/server/system/service/event"
-    "github.com/cortezaproject/corteza/server/system/types"
-    "github.com/lestrrat-go/jwx/jwt"
-    "go.uber.org/zap"
-    gomail "gopkg.in/mail.v2"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net/url"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+
+	authService "github.com/cortezaproject/corteza/server/auth"
+	"github.com/cortezaproject/corteza/server/auth/saml"
+	authSettings "github.com/cortezaproject/corteza/server/auth/settings"
+	autService "github.com/cortezaproject/corteza/server/automation/service"
+	cmpService "github.com/cortezaproject/corteza/server/compose/service"
+	cmpEvent "github.com/cortezaproject/corteza/server/compose/service/event"
+	discoveryService "github.com/cortezaproject/corteza/server/discovery/service"
+	fedService "github.com/cortezaproject/corteza/server/federation/service"
+	"github.com/cortezaproject/corteza/server/pkg/actionlog"
+	"github.com/cortezaproject/corteza/server/pkg/apigw"
+	apigwTypes "github.com/cortezaproject/corteza/server/pkg/apigw/types"
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/corredor"
+	"github.com/cortezaproject/corteza/server/pkg/eventbus"
+	"github.com/cortezaproject/corteza/server/pkg/healthcheck"
+	"github.com/cortezaproject/corteza/server/pkg/http"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	"github.com/cortezaproject/corteza/server/pkg/locale"
+	"github.com/cortezaproject/corteza/server/pkg/logger"
+	"github.com/cortezaproject/corteza/server/pkg/mail"
+	"github.com/cortezaproject/corteza/server/pkg/messagebus"
+	"github.com/cortezaproject/corteza/server/pkg/monitor"
+	"github.com/cortezaproject/corteza/server/pkg/options"
+	"github.com/cortezaproject/corteza/server/pkg/provision"
+	"github.com/cortezaproject/corteza/server/pkg/rbac"
+	"github.com/cortezaproject/corteza/server/pkg/scheduler"
+	"github.com/cortezaproject/corteza/server/pkg/sentry"
+	"github.com/cortezaproject/corteza/server/pkg/valuestore"
+	"github.com/cortezaproject/corteza/server/pkg/version"
+	"github.com/cortezaproject/corteza/server/pkg/websocket"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/service"
+	sysService "github.com/cortezaproject/corteza/server/system/service"
+	sysEvent "github.com/cortezaproject/corteza/server/system/service/event"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/lestrrat-go/jwx/jwt"
+	"go.uber.org/zap"
+	gomail "gopkg.in/mail.v2"
 )
 
 const (
@@ -258,15 +258,10 @@ func (app *CortezaApp) Provision(ctx context.Context) (err error) {
 		// @todo envoy should be decoupled from RBAC and import directly into store,
 		//       w/o using any access control
 
-		var (
-			ac  = rbac.NewService(zap.NewNop(), app.Store)
-			acr = make([]*rbac.Role, 0)
-		)
-		for _, r := range auth.ProvisionUser().Roles() {
-			acr = append(acr, rbac.BypassRole.Make(r, auth.BypassRoleHandle))
-		}
-		ac.UpdateRoles(acr...)
-		rbac.SetGlobal(ac)
+		rbac.SetGlobal(rbac.NoopSvc(rbac.Allow, rbac.Config{
+			RuleStorage: app.Store,
+			RoleStorage: app.Store,
+		}))
 		defer rbac.SetGlobal(nil)
 	}
 
@@ -355,10 +350,30 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 		}
 
 		// Initialize RBAC subsystem
-		ac := rbac.NewService(log, app.Store)
-
-		// and (re)load rules from the storage backend
-		ac.Reload(ctx)
+		// @todo add state management
+		// @todo potentially add .Activate like other services?
+		ac, err := rbac.NewService(ctx, log, app.Store, rbac.Config{
+			MaxIndexSize:       app.Opt.RBAC.MaxIndexSize,
+			Synchronous:        app.Opt.RBAC.Synchronous,
+			ReindexStrategy:    rbac.ReindexStrategy(app.Opt.RBAC.ReindexStrategy),
+			DecayFactor:        app.Opt.RBAC.DecayFactor,
+			DecayInterval:      app.Opt.RBAC.DecayInterval,
+			CleanupInterval:    app.Opt.RBAC.CleanupInterval,
+			IndexFlushInterval: app.Opt.RBAC.IndexFlushInterval,
+			ReindexInterval:    app.Opt.RBAC.ReindexInterval,
+			RuleStorage:        app.Store,
+			RoleStorage:        app.Store,
+
+			PullInitialState: func(ctx context.Context, n int) ([]string, error) {
+				return nil, nil
+			},
+			FlushIndexState: func(ctx context.Context, s []string) error {
+				return nil
+			},
+		})
+		if err != nil {
+			return fmt.Errorf("failed to initialize RBAC service: %w", err)
+		}
 
 		rbac.SetGlobal(ac)
 	}
@@ -504,8 +519,6 @@ func (app *CortezaApp) Activate(ctx context.Context) (err error) {
 
 	monitor.Watcher(ctx)
 
-	rbac.Global().Watch(ctx)
-
 	if err = sysService.Activate(ctx); err != nil {
 		return fmt.Errorf("could not activate system services: %w", err)
 
@@ -562,9 +575,9 @@ func (app *CortezaApp) Activate(ctx context.Context) (err error) {
 
 	app.AuthService.Watch(ctx)
 
-    updateSassInstallSettings(ctx, sysService.DefaultStylesheet.SassInstalled(), app.Log)
+	updateSassInstallSettings(ctx, sysService.DefaultStylesheet.SassInstalled(), app.Log)
 	//Generate CSS for webapps
-    if err = sysService.DefaultStylesheet.GenerateCSS(sysService.CurrentSettings, app.Opt.Webapp.ScssDirPath, app.Log); err != nil {
+	if err = sysService.DefaultStylesheet.GenerateCSS(sysService.CurrentSettings, app.Opt.Webapp.ScssDirPath, app.Log); err != nil {
 		return fmt.Errorf("could not generate css for webapps: %w", err)
 	}
 

server/app/options/RBAC.cue

@@ -13,6 +13,83 @@ RBAC: schema.#optionsGroup & {
 			type:        "bool"
 			description: "Log RBAC related events and actions"
 		}
+
+		max_index_size: {
+			type:         "int"
+			defaultGoExpr: "-1"
+			description: """
+				Limit the number of resources to keep in the in-memory index.
+				When set to -1, max size is used.
+				When set to 0, the in memory index is not used.
+				"""
+		}
+
+		synchronous: {
+			type:         "bool"
+			defaultGoExpr: "false"
+			description: """
+				Synchronous lets us make all the procedures synchronous for ease of testing
+				This should always be false in production
+				"""
+		}
+
+		reindex_strategy: {
+			type:         "string"
+			defaultValue: ""
+			description: """
+				Reindex strategy defines what strategy we should use.
+				The available options are:
+
+				. `memory`: prioritize memory consumption which reduces performance during reindexing.
+				. `speed`: prioritize speed during reindexing; memory consumption will be 2n where n is the current index size.
+
+				If you wish to prioritize memory and speed, consider using `speed` with a lower max index size
+				"""
+		}
+
+		decay_factor: {
+			type:         "float64"
+			defaultGoExpr: "0.9"
+			description: """
+				Decay factor controls how long an item should be kept in the index while not in use.
+				"""
+		}
+
+		decay_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute * 30"
+			description: """
+				Decay interval controls how fast the decay factor is applied to the index key.
+				"""
+		}
+
+		cleanup_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute * 31"
+			description: """
+				Cleanup interval controls when unused/low-scored index items should be yanked out of the index counter.
+				"""
+		}
+
+		reindex_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute * 10"
+			description: """
+				Reindex interval controls when the index should be re-calculated.
+				"""
+		}
+
+		index_flush_interval: {
+			type:          "time.Duration"
+			defaultGoExpr: "time.Minute * 35"
+			description: """
+				[IMPORTANT]
+				====
+				Unused, will be added when state preservation is implemented.
+				====
+				"""
+		}
+
 		service_user: {}
 		bypass_roles: {
 			defaultValue: "super-admin"

server/app/resources.cue

@@ -22,7 +22,12 @@ resources: { [key=_]: {"handle": key, "component": "system", "platform": "cortez
 		identPlural: "rules"
 		expIdent: "Rule"
 
-		features: _allFeaturesDisabled
+		features: {
+			sorting: true
+			labels: false
+			paging: false
+			checkFn: false
+		}
 
 
 		model: {
@@ -32,6 +37,7 @@ resources: { [key=_]: {"handle": key, "component": "system", "platform": "cortez
 					goType: "uint64",
 					ident: "roleID",
 					storeIdent: "rel_role"
+					sortable: true,
 					dal: { type: "Ref", refModelResType: "corteza::system:role" }
 				}
 				resource:  {
@@ -51,6 +57,17 @@ resources: { [key=_]: {"handle": key, "component": "system", "platform": "cortez
 			}
 		}
 
+		filter: {
+			struct: {
+				resource: {goType: "[]string", ident: "resource", storeIdent: "resource"}
+				operation: {goType: "string", ident: "operation", storeIdent: "operation"}
+				role_id: {goType: "uint64", ident: "roleID", storeIdent: "rel_role"}
+			}
+
+			byValue: ["resource", "operation", "role_id"]
+			rawFilter: true
+		}
+
 		store: {
 			ident: "rbacRule"