feat(rbac): use less requests to filter policies

workspaces/rbac/plugins/rbac-backend/src/policies/permission-policy.ts

@@ -366,19 +366,17 @@ export class RBACPermissionPolicy implements PermissionPolicy {
     action: string,
     roles: string[],
   ): Promise<boolean> {
-    for (const role of roles) {
-      const perms = await this.enforcer.getFilteredPolicy(
-        0,
-        role,
-        permissionName,
-        action,
-      );
-      if (perms.length > 0) {
-        return true;
-      }
+    if (roles.length === 0) {
+      return false;
     }
 
-    return false;
+    const filters: string[][] = roles.map(role => [
+      role,
+      permissionName,
+      action,
+    ]);
+    const perms = await this.enforcer.getFilteredPolicy(0, ...filters);
+    return perms.length > 0;
   }
 
   private isAuthorized = async (

workspaces/rbac/plugins/rbac-backend/src/providers/connect-providers.ts

@@ -115,9 +115,10 @@ export class Connection implements RBACProviderConnection {
 
     await this.enforcer.loadPolicy();
     // Get the roles for this provider coming from rbac plugin
-    for (const providerRole of providerRoles) {
+    if (providerRoles.length > 0) {
+      const roleFilters: string[][] = providerRoles.map(role => [role]);
       providerPermissions.push(
-        ...(await this.enforcer.getFilteredPolicy(0, providerRole)),
+        ...(await this.enforcer.getFilteredPolicy(0, ...roleFilters)),
       );
     }
 

workspaces/rbac/plugins/rbac-backend/src/service/enforcer-delegate.ts

@@ -161,20 +161,31 @@ export class EnforcerDelegate implements RoleEventEmitter<RoleEvents> {
 
   async getFilteredPolicy(
     fieldIndex: number,
-    ...filter: string[]
+    ...filter: string[] | string[][]
   ): Promise<string[][]> {
     const tempModel = newModelFromString(MODEL);
 
-    const filterObj: Record<string, string> = { ptype: 'p' };
-    for (let i = 0; i < filter.length; i++) {
-      if (filter[i]) {
-        filterObj[`v${i + fieldIndex}`] = filter[i];
+    let twoLevelFilter: string[][];
+    if (filter.length > 0 && typeof filter[0] === 'string') {
+      twoLevelFilter = [filter as string[]];
+    } else {
+      twoLevelFilter = filter as string[][];
+    }
+
+    const filterArgs: Record<string, string>[] = [];
+    for (const nestedFilter of twoLevelFilter) {
+      const filterObj: Record<string, string> = { ptype: 'p' };
+      for (let i = 0; i < nestedFilter.length; i++) {
+        if (nestedFilter[i]) {
+          filterObj[`v${i + fieldIndex}`] = nestedFilter[i];
+        }
       }
+      filterArgs.push(filterObj);
     }
 
     await (this.enforcer.getAdapter() as FilteredAdapter).loadFilteredPolicy(
       tempModel,
-      [filterObj],
+      filterArgs,
     );
 
     return await tempModel.getPolicy('p', 'p');
@@ -680,15 +691,15 @@ export class EnforcerDelegate implements RoleEventEmitter<RoleEvents> {
     const model = newModelFromString(MODEL);
     let policies: string[][] = [];
     if (roles.length > 0) {
+      const rolePermissionFilter: string[][] = [];
       for (const role of roles) {
-        const filteredPolicy = await this.getFilteredPolicy(
-          0,
-          role,
-          resourceType,
-          action,
-        );
-        policies.push(...filteredPolicy);
+        rolePermissionFilter.push([role, resourceType, action]);
       }
+      const filteredPolicy = await this.getFilteredPolicy(
+        0,
+        ...rolePermissionFilter,
+      );
+      policies.push(...filteredPolicy);
     } else {
       const enforcePolicies = await this.getFilteredPolicy(
         1,