feat: add cache for IAM

backend/ciso_assistant/settings.py

@@ -62,6 +62,12 @@ def set_ciso_assistant_url(_, __, event_dict):
     },
     "loggers": {
         "": {"handlers": ["console"], "level": LOG_LEVEL},
+        # to trace all db calls, uncoment these lines
+        #        "django.db.backends": {
+        #            "handlers": ["console"],
+        #            "level": "DEBUG",
+        #            "propagate": False,
+        #        },
     },
 }
 
@@ -224,6 +230,7 @@ def set_ciso_assistant_url(_, __, event_dict):
     "core.custom_middleware.AuditlogMiddleware",
     "allauth.account.middleware.AccountMiddleware",
 ]
+# for DB performance measurements, uncoment the following line
 # MIDDLEWARE += ["querycount.middleware.QueryCountMiddleware"]
 ROOT_URLCONF = "ciso_assistant.urls"
 # we leave these for the API UI tools - even if Django templates and Admin are not used anymore

backend/core/views.py

@@ -613,7 +613,7 @@ class BaseModelViewSet(viewsets.ModelViewSet):
     ordering_fields = "__all__"
     search_fields = ["name", "description"]
     filterset_fields = []
-    model = None
+    model: type[models.Model] | None = None
 
     serializers_module = "core.serializers"
 
@@ -656,6 +656,13 @@ def get_queryset(self) -> models.query.QuerySet:
             )[0]
 
         queryset = self.model.objects.filter(id__in=object_ids_view)
+
+        field_names = {f.name for f in self.model._meta.get_fields()}
+        if "parent_folder" in field_names:
+            queryset = queryset.select_related("parent_folder")
+        if "filtering_labels" in field_names:
+            queryset = queryset.prefetch_related("filtering_labels")
+
         return queryset
 
     def get_serializer_context(self):

backend/iam/apps.py

@@ -4,3 +4,49 @@
 class IamConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
     name = "iam"
+
+    def ready(self):
+        from django.apps import apps
+        from django.db.models.signals import m2m_changed
+
+        from iam.cache_builders import (
+            invalidate_groups_cache,
+            invalidate_assignments_cache,
+            invalidate_roles_cache,
+        )
+
+        User = apps.get_model("iam", "User")
+        RoleAssignment = apps.get_model("iam", "RoleAssignment")
+        Role = apps.get_model("iam", "Role")
+
+        def _user_groups_changed(sender, instance, action, **kwargs):
+            if action in {"post_add", "post_remove", "post_clear"}:
+                invalidate_groups_cache()
+                invalidate_assignments_cache()
+
+        def _ra_perimeters_changed(sender, instance, action, **kwargs):
+            if action in {"post_add", "post_remove", "post_clear"}:
+                invalidate_assignments_cache()
+
+        def _role_permissions_changed(sender, instance, action, **kwargs):
+            if action in {"post_add", "post_remove", "post_clear"}:
+                invalidate_roles_cache()
+
+        m2m_changed.connect(
+            _user_groups_changed,
+            sender=User.user_groups.through,
+            dispatch_uid="iam.user_groups.m2m.invalidate_caches",
+            weak=False,
+        )
+        m2m_changed.connect(
+            _ra_perimeters_changed,
+            sender=RoleAssignment.perimeter_folders.through,
+            dispatch_uid="iam.roleassignment.perimeter_folders.m2m.invalidate_assignments_cache",
+            weak=False,
+        )
+        m2m_changed.connect(
+            _role_permissions_changed,
+            sender=Role.permissions.through,
+            dispatch_uid="iam.role.permissions.m2m.invalidate_roles_cache",
+            weak=False,
+        )