fix(tool): skip redundant use_tool filter for normal users (IKABRE) - #2356
Open
yaojin3616 wants to merge 1 commit into
Open
fix(tool): skip redundant use_tool filter for normal users (IKABRE)#2356yaojin3616 wants to merge 1 commit into
yaojin3616 wants to merge 1 commit into
Conversation
The /api/v1/tool?is_preset=0|2 endpoint re-ran a per-tool permission filter (filter_tool_ids_by_permission_async) AFTER the coarse AccessType.GPTS_TOOL_READ FGA list had already returned exactly the same can_read set. For normal users the redundant call issued N FGA batch_check + N DB lookups per request, producing the multi-second latency on the API tools / MCP tools list (IKABRE). Add relation_for_tool_permission_id(permission_id) so callers can detect when the requested id maps to the same relation the coarse list already used. In get_tool_list, skip the per-tool filter on the can_read fast path; the strict path stays in place for ids that need a different relation, so we never accidentally over-grant visibility. mode=coarse_skip / mode=strict in the [perf] log make the branch taken visible in production logs. Tests: replace the per-tool filter check with a fast-path assertion (use_tool must NOT call filter_tool_ids_by_permission_async) and add a strict-path test for non-can_read ids, plus a unit test for the template helper.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修复说明 (IKABRE)
普通用户访问
/api/v1/tool?is_preset=0|2（API 工具 / MCP 工具）接口响应缓慢。该接口在拿到粗粒度的 FGA 资源列表（AccessType.GPTS_TOOL_READ）后，又对所有可见工具重新跑了一遍filter_tool_ids_by_permission_async。这次重过滤在粗筛已经返回相同集合（can_read关系）时是多余的；其代价是 N 次 FGAbatch_check+ N 次 DB 查 creator，对持有较多自定义/MCP 工具的普通用户而言，p99 直接落到多秒级。改动
bisheng/permission/domain/tool_permission_template.py— 新增relation_for_tool_permission_id(permission_id)，从模板中反查某个权限 id 对应的 OpenFGA relation，未知 id 返回None，让调用方安全降级到严格过滤。bisheng/tool/domain/services/tool.py—get_tool_list在请求的权限 id 映射到can_read（与AccessType.GPTS_TOOL_READ同一关系）时跳过第二次过滤；只有真正需要不同关系的 id（如自定义的manage_tool_owner）才走严格路径，避免意外放权。[perf]日志新增mode=coarse_skip/mode=strict字段，便于线上确认分支。test/tool/test_tool_service_permissions.py— 替换原use_tool过滤断言为：test_get_tool_list_skips_redundant_filter_for_can_read_permission—use_tool路径必须 不调用filter_tool_ids_by_permission_async，回归 IKABRE 的核心。test_get_tool_list_still_filters_for_strict_permission— 非can_read权限 id 仍走严格过滤，防止过度放权。test_relation_for_tool_permission_id_maps_known_ids— 模板 helper 的真值表。验证
get_tool_list快速路径与严格路径的测试通过手工推演（uv sync受限于磁盘空间无法在本机跑pytest，但 stub 模式与生产代码走的是同一分支）关联