perf(server): низковисящие бэкенд-оптимизации — индексы, auth-дедуп, коалесинг эмбеда, CTE short-circuit (#348) #364

Open

agent_coder wants to merge 3 commits from perf/348-backend-lowhanging into develop

Author	SHA1	Message	Date
agent_coder	fd42e975b9	fix(#348 review round-2 F5-F6): index page_access(workspace_id) + test the workspace-cache bust Both are direct consequences of the round-1 F1 fix (uncaching hasRestrictedPagesInWorkspace): - F5: that EXISTS(SELECT 1 FROM page_access WHERE workspace_id=?) now runs per-request on every whole-workspace list endpoint (global search + suggest, favorites, notifications, recent, created-by), and page_access only had a space_id index → a seq scan in the common zero-restriction case. Added idx_page_access_workspace_id to the perf migration (up + down) so it's an index-only existence probe. - F6: the DomainMiddleware workspace cache invalidation was untested — the int-spec passed `{}` for cacheManager, so bustWorkspaceCache's `del` threw into its own try/catch and never ran. Added a Map-backed cache double with a working del and two tests: updateSetting busts WORKSPACE_SELF_HOSTED; updateSharingSettings busts WORKSPACE_SELF_HOSTED + WORKSPACE_BY_HOST(hostname). A missed/mismatched bust key now fails the suite instead of letting a stale security-relevant workspace row (enforceSso/status) outlive the mutation. Gate: server tsc 0; workspace-repo-update-setting + page-permission-workspace-filter int-specs pass on real Postgres (the new index applies via global-setup). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 02:52:02 +03:00
agent_coder	321a0d3229	fix(#348 review F1-F4): uncache the workspace-restriction gate + int-spec + docs - F1 [medium — the substantive one]: hasRestrictedPagesInWorkspace is now UNCACHED (a plain EXISTS per call, like its sibling hasRestrictedPagesInSpace). Caching it (even 5s) reintroduced an access-control leak the space path never had: a concurrent whole-workspace read in the insert->commit window of the FIRST restricted page could re-populate `false` under withCache (read-then-set, no del-during-read guard) and override the insert-time bust, leaking that page to unauthorized users for up to the TTL. Uncaching removes both the DB/cache asymmetry and the TOCTOU race; the space path already accepts this per-call cost. Reverted the now-unnecessary insertPageAccess cache-bust and removed the dead HAS_RESTRICTED_PAGES_IN_WORKSPACE cache key. - F2 [test]: page-permission-workspace-filter.int-spec.ts (real PG) — the short-circuit returns the full input set with zero restrictions AND filters out the page the user can't reach when a restriction is present (proving the authz behavior is unchanged), the 0->1 transition flips immediately, and the flag is per-workspace scoped. - F3 [doc]: documented the deploy-time write-lock in the migration header — the non-CONCURRENT GIN trigram builds take a SHARE lock that blocks writes on pages/users/… for minutes on a large tenant; run in a maintenance window or build CONCURRENTLY out-of-band for big installs. - F4 [doc]: corrected the jwt.strategy comment — the reused req.raw.workspace is the middleware's selectAll superset (not "the exact row this query returns"), harmless because AuthWorkspace already preferred that object. Gate: server tsc 0; the new int-spec 3/3 on real Postgres. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 02:19:42 +03:00
agent_coder	24cfb158bf	perf(server): low-hanging backend wins — indexes, auth dedup, embed coalescing, CTE short-circuit (#348 ) One migration + targeted hot-path fixes. API behavior 1:1 (schema change = added indexes + a byte-identical f_unaccent function-body swap, see below). - Trigram + composite indexes (20260705T120000-perf-indexes.ts): GIN trigram on LOWER(f_unaccent(title/name)) for pages/users/groups (the /search/suggest leading-wildcard LIKE did a seq scan per keystroke — EXPLAIN now confirms Bitmap Index Scan on idx_pages_title_trgm), + page_history(page_id,id DESC), comments(page_id,id). DEVIATION (verified byte-identical): PG18 cannot inline the two-arg f_unaccent body during index creation, so up() swaps it to the schema-qualified single-arg `SELECT public.unaccent($1)` — same dictionary, identical output for all inputs, so the tsvector trigger + main @@ search stay consistent with NO reindex; down() restores the exact two-arg body. - Auth path: jwt.strategy reuses req.raw.workspace when workspaceId matches (the middleware already validated it) instead of re-querying; domain.middleware caches the workspace lookup (withCache 15s, invalidated in all 8 WorkspaceRepo mutators, with a Date reviver for the JSON-serialized cache). USER + SESSION caching DEFERRED — the invalidation surface (role change doesn't revoke sessions; revocation includes background jobs) can't be safely covered, and a missed hook on a security path is worse than the win. - AI re-embed coalescing: aiQueue.add gets {jobId: embed-<id>, delay: 30s} so active editing collapses to one job (worker reads current page state). - filterAccessiblePageIds: hasRestrictedPagesInWorkspace short-circuit skips the recursive-ancestor CTE when a workspace has zero restricted pages (wired from search/favorites/notifications/recent/created-by). EXISTS on the same pageAccess table the CTE anti-joins → no false-positive / no access leak. Busts the cache on insertPageAccess so a 0->1 restricted transition takes effect immediately (review F1). - Small: syncTransclusion guarded by a family-node probe (both old+new content, so the removal path is preserved); mention notifications enqueue only when the set gained a member; redis maintainLock clears a prior interval (leak fix). Skipped as risky (flagged): global ValidationPipe transform change; a pool-wide statement_timeout (would kill long CREATE INDEX migrations on the same pool). NOTE: kept the trash query's `content` select — the trash UI reads page.content for its preview modal (review F3, would have regressed). Gate: server tsc 0; jest page-permission/auth/search/persistence 15 suites pass; migration up+down+idempotency verified on real PG18 with EXPLAIN confirming index use. No new deps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 01:31:35 +03:00

Author

SHA1

Message

Date

agent_coder

fd42e975b9

fix(#348 review round-2 F5-F6): index page_access(workspace_id) + test the workspace-cache bust

Both are direct consequences of the round-1 F1 fix (uncaching
hasRestrictedPagesInWorkspace):

- F5: that EXISTS(SELECT 1 FROM page_access WHERE workspace_id=?) now runs
  per-request on every whole-workspace list endpoint (global search + suggest,
  favorites, notifications, recent, created-by), and page_access only had a
  space_id index → a seq scan in the common zero-restriction case. Added
  idx_page_access_workspace_id to the perf migration (up + down) so it's an
  index-only existence probe.
- F6: the DomainMiddleware workspace cache invalidation was untested — the
  int-spec passed `{}` for cacheManager, so bustWorkspaceCache's `del` threw into
  its own try/catch and never ran. Added a Map-backed cache double with a working
  del and two tests: updateSetting busts WORKSPACE_SELF_HOSTED; updateSharingSettings
  busts WORKSPACE_SELF_HOSTED + WORKSPACE_BY_HOST(hostname). A missed/mismatched
  bust key now fails the suite instead of letting a stale security-relevant
  workspace row (enforceSso/status) outlive the mutation.

Gate: server tsc 0; workspace-repo-update-setting + page-permission-workspace-filter
int-specs pass on real Postgres (the new index applies via global-setup).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-05 02:52:02 +03:00

agent_coder

321a0d3229

fix(#348 review F1-F4): uncache the workspace-restriction gate + int-spec + docs

- F1 [medium — the substantive one]: hasRestrictedPagesInWorkspace is now UNCACHED
  (a plain EXISTS per call, like its sibling hasRestrictedPagesInSpace). Caching it
  (even 5s) reintroduced an access-control leak the space path never had: a
  concurrent whole-workspace read in the insert->commit window of the FIRST
  restricted page could re-populate `false` under withCache (read-then-set, no
  del-during-read guard) and override the insert-time bust, leaking that page to
  unauthorized users for up to the TTL. Uncaching removes both the DB/cache
  asymmetry and the TOCTOU race; the space path already accepts this per-call cost.
  Reverted the now-unnecessary insertPageAccess cache-bust and removed the dead
  HAS_RESTRICTED_PAGES_IN_WORKSPACE cache key.
- F2 [test]: page-permission-workspace-filter.int-spec.ts (real PG) — the
  short-circuit returns the full input set with zero restrictions AND filters out
  the page the user can't reach when a restriction is present (proving the authz
  behavior is unchanged), the 0->1 transition flips immediately, and the flag is
  per-workspace scoped.
- F3 [doc]: documented the deploy-time write-lock in the migration header — the
  non-CONCURRENT GIN trigram builds take a SHARE lock that blocks writes on
  pages/users/… for minutes on a large tenant; run in a maintenance window or
  build CONCURRENTLY out-of-band for big installs.
- F4 [doc]: corrected the jwt.strategy comment — the reused req.raw.workspace is
  the middleware's selectAll superset (not "the exact row this query returns"),
  harmless because AuthWorkspace already preferred that object.

Gate: server tsc 0; the new int-spec 3/3 on real Postgres.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-05 02:19:42 +03:00

agent_coder

24cfb158bf

perf(server): low-hanging backend wins — indexes, auth dedup, embed coalescing, CTE short-circuit (#348 )

One migration + targeted hot-path fixes. API behavior 1:1 (schema change = added
indexes + a byte-identical f_unaccent function-body swap, see below).

- Trigram + composite indexes (20260705T120000-perf-indexes.ts): GIN trigram on
  LOWER(f_unaccent(title/name)) for pages/users/groups (the /search/suggest
  leading-wildcard LIKE did a seq scan per keystroke — EXPLAIN now confirms
  Bitmap Index Scan on idx_pages_title_trgm), + page_history(page_id,id DESC),
  comments(page_id,id). DEVIATION (verified byte-identical): PG18 cannot inline
  the two-arg f_unaccent body during index creation, so up() swaps it to the
  schema-qualified single-arg `SELECT public.unaccent($1)` — same dictionary,
  identical output for all inputs, so the tsvector trigger + main @@ search stay
  consistent with NO reindex; down() restores the exact two-arg body.
- Auth path: jwt.strategy reuses req.raw.workspace when workspaceId matches (the
  middleware already validated it) instead of re-querying; domain.middleware
  caches the workspace lookup (withCache 15s, invalidated in all 8 WorkspaceRepo
  mutators, with a Date reviver for the JSON-serialized cache). USER + SESSION
  caching DEFERRED — the invalidation surface (role change doesn't revoke
  sessions; revocation includes background jobs) can't be safely covered, and a
  missed hook on a security path is worse than the win.
- AI re-embed coalescing: aiQueue.add gets {jobId: embed-<id>, delay: 30s} so
  active editing collapses to one job (worker reads current page state).
- filterAccessiblePageIds: hasRestrictedPagesInWorkspace short-circuit skips the
  recursive-ancestor CTE when a workspace has zero restricted pages (wired from
  search/favorites/notifications/recent/created-by). EXISTS on the same pageAccess
  table the CTE anti-joins → no false-positive / no access leak. Busts the cache
  on insertPageAccess so a 0->1 restricted transition takes effect immediately
  (review F1).
- Small: syncTransclusion guarded by a family-node probe (both old+new content, so
  the removal path is preserved); mention notifications enqueue only when the set
  gained a member; redis maintainLock clears a prior interval (leak fix).

Skipped as risky (flagged): global ValidationPipe transform change; a pool-wide
statement_timeout (would kill long CREATE INDEX migrations on the same pool).
NOTE: kept the trash query's `content` select — the trash UI reads page.content
for its preview modal (review F3, would have regressed).

Gate: server tsc 0; jest page-permission/auth/search/persistence 15 suites pass;
migration up+down+idempotency verified on real PG18 with EXPLAIN confirming index
use. No new deps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-05 01:31:35 +03:00

perf(server): низковисящие бэкенд-оптимизации — индексы, auth-дедуп, коалесинг эмбеда, CTE short-circuit (#348) #364

3 Commits