@qikdev/sdk 1.0.8 → 1.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qikdev/sdk",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "type": "module",
   "description": "Promise based Javascript SDK",
   "main": "./dist/main.js",

package/src/api/qik.access.js

@@ -67,21 +67,23 @@ var QikAccess = function (QikCore) {
    * const childScopes = sdk.access.getAllDescendants({title:'Global', children:[{title:'Australia', ...}, {title:'New Zealand', ...}]});
    */
   service.getAllDescendants = function (scope) {
-    //Start by including the scope id
-    var results = [];
+    //Start by including the scope id. A Set because the same scope can be
+    //reachable by more than one path through the tree, and the duplicates
+    //were being carried all the way into hashPermissions.
+    var results = new Set();
 
     addScope(scope);
 
     function addScope(entry) {
       //Add this scope to the results
       var id = QikCore.utils.id(entry);
-      results.push(id);
+      results.add(id);
 
       (entry.children || []).forEach(function (child) {
         addScope(child);
       });
     }
-    return results;
+    return Array.from(results);
   };
 
   ///////////////////////////////////////////////
@@ -93,8 +95,48 @@ var QikAccess = function (QikCore) {
    * @example
    * const permissions = sdk.access.hashPermissions({firstName:'Mighty', lastName:'Mouse', permissionSets:[...], ...});
    */
+  // Memo for hashPermissions, keyed on the session's cacheKey.
+  //
+  // actionableScopes() calls hashPermissions() on every single invocation, and
+  // a dashboard navigation performs well over a hundred access checks. For an
+  // ordinary session that is invisible, but a heavy one — hundreds of scopes
+  // and thousands of permission strings — rebuilds a six-figure number of
+  // (permission, scope) pairs each time. Measured on one production session:
+  // 127 calls x 28ms = 3.6 SECONDS of synchronous main-thread work per
+  // navigation, which is the whole of an observed 3.6s UI freeze.
+  //
+  // cacheKey already changes whenever the session does (it encodes the user,
+  // organisation, persona and the persona's updated timestamp), so it is the
+  // same key the server memoises this on. Only one entry is kept: the session
+  // in hand is the only one being asked about, and holding more would pin
+  // permission trees for users who have since signed out.
+  // A short TTL as a backstop, mirroring the server's own memo. cacheKey moves
+  // whenever the session is reissued, but permissions can in principle change
+  // underneath a session that keeps its key — a role being edited, say, which
+  // the server handles by invalidating the session rather than by bumping the
+  // persona. The TTL means any such staleness heals on its own within seconds
+  // instead of lasting for the life of the tab, while still collapsing the
+  // hundred-plus calls a single navigation makes into one.
+  var PERMISSION_HASH_TTL_MS = 5000;
+  var permissionHashMemo = null;
+
   service.hashPermissions = function (user) {
-    var results = {};
+    var cacheKey = user?.cacheKey;
+
+    if (
+      cacheKey &&
+      permissionHashMemo &&
+      permissionHashMemo.key === cacheKey &&
+      Date.now() - permissionHashMemo.at < PERMISSION_HASH_TTL_MS
+    ) {
+      return permissionHashMemo.value;
+    }
+
+    // Accumulate into Sets rather than rebuilding an array per permission
+    // string. The previous form did `[...new Set(existing.concat(allIDs))]`
+    // for every string in every scope — copy, rebuild, copy again — which is
+    // quadratic in the number of scopes granting that permission.
+    var accumulator = new Map();
 
     for (var key in user?.permissions || {}) {
       //Get the permission set
@@ -105,18 +147,28 @@ var QikAccess = function (QikCore) {
 
       //For each permission defined in the set
       (permissionSet.permissions || []).forEach(function (permissionString) {
-        //Include the top scope
-        if (!results[permissionString]) {
-          results[permissionString] = [];
+        var set = accumulator.get(permissionString);
+        if (!set) {
+          set = new Set();
+          accumulator.set(permissionString, set);
+        }
+        for (var i = 0; i < allIDs.length; i++) {
+          set.add(allIDs[i]);
         }
-        results[permissionString] = [
-          ...new Set(results[permissionString].concat(allIDs)),
-        ];
       });
     }
 
+    var results = {};
+    accumulator.forEach(function (set, permissionString) {
+      results[permissionString] = Array.from(set);
+    });
+
     ///////////////////////////////////////////////
 
+    if (cacheKey) {
+      permissionHashMemo = { key: cacheKey, value: results, at: Date.now() };
+    }
+
     return results;
   };
 

package/src/version.js

@@ -1 +1 @@
-export const version = "1.0.8";
+export const version = "1.0.10";