CalvinKirs opened a new pull request, #70391: URL: https://github.com/apache/doris/pull/70391
### Data structures Share equal single-value resource descriptors within each policy payload. Publish an immutable read snapshot bound to the native engine, policy version and configuration: - `user -> possible parent-scope mask` skips impossible parent checks. - `(catalog, database, table) -> TableAccess` locates a user's resource blocks. Each bucket stores sorted `int[] userIds`, `byte[] actions` and native matcher references. Broad resources use a separate bucket; dynamic/Unicode resources retain native fallback. Column definitions remain in native matchers; no SQL authorization-result cache is added. Full and copy-on-write policy updates rebuild the index. Explicit opt-in: `ranger.plugin.doris.read.resource.index.enabled=true`, default `false`. ### Large-policy measurements 5,000 tables, 800 resource blocks/user, three columns/check, 50% allowed/denied; median P50 of three fresh JVM runs. Local authorization checks, excluding SQL execution. | Users | Resource blocks | Parent pruning, no table/user index | With table/user index | P50 ratio | |---:|---:|---:|---:|---:| | 500 | 400,000 | 103.289 ms | 0.024710 ms | 4,180x | | 3,000 | 2,400,000 | 689.887 ms | 0.014330 ms | 48,143x | Measured at `6f6fcbc6472`, before the explicit-switch refactor. Both variants include descriptor sharing and parent-scope pruning; this is the incremental benefit of the table/user index. ### Memory With compressed references, binding-array payload is approximately 9 bytes/binding; 2.4 million bindings require approximately 20.6 MiB before map/array overhead. Measured index-related retained-heap increase: **19.92–22.67 MiB**, with a paired-run median of **22.48 MiB**. Total policy-related retained heap with the index: **3,128 MiB**. Full-refresh observed heap peak: **8.40–8.85 GiB**. Native policy engines and their refresh overlap remain in memory. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
