fix: Invalidate user role member sessions async without loading users [DHIS2-21854] (#24494)

(cherry picked from commit e4a9688)

Author: netroms

dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserRoleAuthoritiesChangedEvent.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2004-2022, University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * Neither the name of the HISP project nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.hisp.dhis.user;
+
+import org.hisp.dhis.common.UID;
+
+/**
+ * Event published after the authorities of a {@link UserRole} have changed, so that active sessions
+ * of users with that role can be invalidated asynchronously, outside the updating transaction and
+ * off the request thread.
+ *
+ * @author Morten Svanæs <msvanaes@dhis2.org>
+ */
+public record UserRoleAuthoritiesChangedEvent(UID userRoleUid) {}

dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserService.java

@@ -622,7 +622,20 @@ boolean canCurrentUserCanModify(
   @Nonnull
   List<UserLookup> getLinkedUserAccounts(@Nonnull User actingUser);
 
-  void invalidateUserSessions(String uid);
+  /**
+   * Invalidate all sessions for the given user.
+   *
+   * @param username the username of the user account.
+   */
+  void invalidateUserSessions(String username);
+
+  /**
+   * Returns the usernames of all users that are members of the user role with the given UID.
+   *
+   * @param roleUid the UID of the user role.
+   * @return a list of usernames.
+   */
+  List<String> getUsernamesByUserRole(@Nonnull UID roleUid);
 
   /**
    * Register a account recovery attempt for the given user account.

dhis-2/dhis-api/src/main/java/org/hisp/dhis/user/UserStore.java

@@ -161,6 +161,14 @@ Map<String, Optional<Locale>> findNotifiableUsersWithPasswordLastUpdatedBetween(
    */
   List<User> getUserByUsernames(Collection<String> usernames);
 
+  /**
+   * Retrieves the usernames of all users that are members of the user role with the given UID.
+   *
+   * @param roleUid the UID of the user role.
+   * @return a list of usernames.
+   */
+  List<String> getUsernamesByUserRole(@Nonnull UID roleUid);
+
   /**
    * Retrieves the most recently-used enabled User associated with the given open ID.
    *

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/config/ServiceConfig.java

@@ -31,6 +31,7 @@
 import java.util.Map;
 import java.util.SortedMap;
 import java.util.TreeMap;
+import java.util.concurrent.Executor;
 import org.hisp.dhis.common.DeliveryChannel;
 import org.hisp.dhis.i18n.I18nManager;
 import org.hisp.dhis.i18n.ui.resourcebundle.DefaultResourceBundleManager;
@@ -45,6 +46,7 @@
 import org.hisp.dhis.user.UserSettingService;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor;
 import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
 
 /**
@@ -93,4 +95,20 @@ public DefaultOutboundMessageBatchService defaultOutboundMessageBatchService(
   public ResourceBundleManager resourceBundleManager() {
     return new DefaultResourceBundleManager();
   }
+
+  /**
+   * Single-threaded, bounded executor for asynchronous user session invalidation, see {@code
+   * UserRoleSessionInvalidationListener}. A single thread serializes the work and keeps it from
+   * competing with more important work.
+   */
+  @Bean("userSessionInvalidationTaskExecutor")
+  public Executor userSessionInvalidationTaskExecutor() {
+    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
+    executor.setCorePoolSize(1);
+    executor.setMaxPoolSize(1);
+    executor.setQueueCapacity(1000);
+    executor.setThreadNamePrefix("SessionInvalidation-");
+    executor.initialize();
+    return executor;
+  }
 }

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java

@@ -1088,13 +1088,41 @@ public List<UserLookup> getLinkedUserAccounts(@Nonnull User actingUser) {
   }
 
   @Override
-  public void invalidateUserSessions(String userUid) {
-    User user = getUser(userUid);
-    UserDetails userDetails = createUserDetails(user);
-    if (userDetails != null) {
-      List<SessionInformation> allSessions = sessionRegistry.getAllSessions(userDetails, false);
-      allSessions.forEach(SessionInformation::expireNow);
+  public void invalidateUserSessions(String username) {
+    if (username == null) {
+      return;
     }
+    List<SessionInformation> sessions =
+        sessionRegistry.getAllSessions(sessionLookupPrincipal(username), false);
+    sessions.forEach(SessionInformation::expireNow);
+  }
+
+  /**
+   * Creates a minimal principal used only to look up sessions in the {@link SessionRegistry}. The
+   * in-memory registry matches principals by {@link UserDetailsImpl} equality, which includes the
+   * username only, and the Redis-backed registry resolves principals by name (username). Building
+   * this instead of loading the full user avoids one user fetch plus full {@code UserDetails}
+   * hydration (groups, roles, org units) per invalidated user.
+   */
+  private static UserDetails sessionLookupPrincipal(String username) {
+    return UserDetailsImpl.builder()
+        .username(username)
+        .authorities(List.of())
+        .allAuthorities(Set.of())
+        .allRestrictions(Set.of())
+        .userSettings(Map.of())
+        .userGroupIds(Set.of())
+        .userOrgUnitIds(Set.of())
+        .userDataOrgUnitIds(Set.of())
+        .userSearchOrgUnitIds(Set.of())
+        .userRoleIds(Set.of())
+        .build();
+  }
+
+  @Override
+  @Transactional(readOnly = true)
+  public List<String> getUsernamesByUserRole(@Nonnull UID roleUid) {
+    return userStore.getUsernamesByUserRole(roleUid);
   }
 
   @Override

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/UserRoleSessionInvalidationListener.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2004-2022, University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * Neither the name of the HISP project nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.hisp.dhis.user;
+
+import com.google.common.collect.Lists;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.scheduling.annotation.Async;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.event.TransactionPhase;
+import org.springframework.transaction.event.TransactionalEventListener;
+
+/**
+ * Invalidates the sessions of all users that are members of a user role whose authorities have
+ * changed, so that the new authorities take effect on the next authentication.
+ *
+ * <p>The work runs after the updating transaction has committed, on a dedicated single-threaded
+ * executor, in batches with a pause in between. This keeps an authority change on a role with many
+ * members cheap on the request thread and spreads the invalidation work out over time. If the
+ * server shuts down before all batches have run, the remaining sessions simply keep the old
+ * authorities until they expire or the user re-authenticates.
+ *
+ * @author Morten Svanæs <msvanaes@dhis2.org>
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class UserRoleSessionInvalidationListener {
+
+  /** Number of users whose sessions are invalidated per batch. */
+  static final int BATCH_SIZE = 100;
+
+  /** Pause between batches, to spread the work out over time. */
+  static final long BATCH_DELAY_MS = 500;
+
+  private final UserService userService;
+
+  @Async("userSessionInvalidationTaskExecutor")
+  @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT, fallbackExecution = true)
+  public void onUserRoleAuthoritiesChanged(UserRoleAuthoritiesChangedEvent event) {
+    List<String> usernames = userService.getUsernamesByUserRole(event.userRoleUid());
+    log.info(
+        "Invalidating sessions of {} users after authority change of user role '{}'",
+        usernames.size(),
+        event.userRoleUid());
+
+    List<List<String>> batches = Lists.partition(usernames, BATCH_SIZE);
+    for (int i = 0; i < batches.size(); i++) {
+      if (i > 0 && !pauseBetweenBatches()) {
+        log.warn(
+            "Session invalidation for user role '{}' interrupted, {} of {} batches done",
+            event.userRoleUid(),
+            i,
+            batches.size());
+        return;
+      }
+      batches.get(i).forEach(userService::invalidateUserSessions);
+    }
+  }
+
+  private static boolean pauseBetweenBatches() {
+    try {
+      Thread.sleep(BATCH_DELAY_MS);
+      return true;
+    } catch (InterruptedException e) {
+      Thread.currentThread().interrupt();
+      return false;
+    }
+  }
+}

dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/hibernate/HibernateUserStore.java

@@ -603,6 +603,15 @@ public List<User> getUserByUsernames(Collection<String> usernames) {
     return query.getResultList();
   }
 
+  @Override
+  public List<String> getUsernamesByUserRole(@Nonnull UID roleUid) {
+    return getSession()
+        .createQuery(
+            "select u.username from User u join u.userRoles r where r.uid = :roleUid", String.class)
+        .setParameter("roleUid", roleUid.getValue())
+        .list();
+  }
+
   @Override
   public void setActiveLinkedAccounts(
       @Nonnull String actingUsername, @Nonnull String activeUsername) {

dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/user/UserRoleSessionInvalidationListenerTest.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) 2004-2022, University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * Neither the name of the HISP project nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.hisp.dhis.user;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.inOrder;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.stream.IntStream;
+import org.hisp.dhis.common.UID;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InOrder;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+/**
+ * Unit test of {@link UserRoleSessionInvalidationListener}.
+ *
+ * @author Morten Svanæs <msvanaes@dhis2.org>
+ */
+@ExtendWith(MockitoExtension.class)
+class UserRoleSessionInvalidationListenerTest {
+
+  private static final UID ROLE_UID = UID.of("Rab1234abcd");
+
+  @Mock private UserService userService;
+
+  @InjectMocks private UserRoleSessionInvalidationListener listener;
+
+  @Test
+  void invalidatesSessionsOfAllRoleMembersInOrder() {
+    List<String> usernames = List.of("alice", "bob", "carol");
+    when(userService.getUsernamesByUserRole(ROLE_UID)).thenReturn(usernames);
+
+    listener.onUserRoleAuthoritiesChanged(new UserRoleAuthoritiesChangedEvent(ROLE_UID));
+
+    InOrder order = inOrder(userService);
+    usernames.forEach(username -> order.verify(userService).invalidateUserSessions(username));
+  }
+
+  @Test
+  void invalidatesSessionsOfAllRoleMembersAcrossBatches() {
+    List<String> usernames =
+        IntStream.range(0, UserRoleSessionInvalidationListener.BATCH_SIZE + 1)
+            .mapToObj(i -> "user" + i)
+            .toList();
+    when(userService.getUsernamesByUserRole(ROLE_UID)).thenReturn(usernames);
+
+    listener.onUserRoleAuthoritiesChanged(new UserRoleAuthoritiesChangedEvent(ROLE_UID));
+
+    verify(userService, times(usernames.size())).invalidateUserSessions(anyString());
+  }
+
+  @Test
+  void invalidatesNothingWhenRoleHasNoMembers() {
+    when(userService.getUsernamesByUserRole(ROLE_UID)).thenReturn(List.of());
+
+    listener.onUserRoleAuthoritiesChanged(new UserRoleAuthoritiesChangedEvent(ROLE_UID));
+
+    verify(userService, never()).invalidateUserSessions(anyString());
+  }
+}