intermittent commit

2026-07-14 13:22:09 +02:00
parent f2afcaa09c
commit ab07075a67
17 changed files with 1821 additions and 586 deletions
--- a/src/govoplan_access/backend/api/v1/admin_common.py
+++ b/src/govoplan_access/backend/api/v1/admin_common.py
@@ -1,6 +1,9 @@
 from __future__ import annotations

+from collections import defaultdict
+
 from fastapi import HTTPException, status
+from sqlalchemy import func
 from sqlalchemy.orm import Session

 from govoplan_access.backend.admin.service import (
@@ -41,6 +44,7 @@ from govoplan_access.backend.db.models import (
    Tenant,
    User,
    UserGroupMembership,
+    UserRoleAssignment,
 )
 from govoplan_core.core.idm import OrganizationFunctionAssignmentRef
 from govoplan_core.core.organizations import OrganizationDirectory
@@ -82,13 +86,147 @@ def _resolve_tenant(
    return tenant


-def _role_summary(session: Session, role: Role) -> RoleSummary:
+def _tenant_role_assignment_counts(session: Session, role_ids: list[str]) -> dict[str, tuple[int, int]]:
+    if not role_ids:
+        return {}
+    user_counts = {
+        role_id: count
+        for role_id, count in session.query(UserRoleAssignment.role_id, func.count(UserRoleAssignment.id))
+        .filter(UserRoleAssignment.role_id.in_(role_ids))
+        .group_by(UserRoleAssignment.role_id)
+        .all()
+    }
+    group_counts = {
+        role_id: count
+        for role_id, count in session.query(GroupRoleAssignment.role_id, func.count(GroupRoleAssignment.id))
+        .filter(GroupRoleAssignment.role_id.in_(role_ids))
+        .group_by(GroupRoleAssignment.role_id)
+        .all()
+    }
+    return {role_id: (int(user_counts.get(role_id, 0)), int(group_counts.get(role_id, 0))) for role_id in role_ids}
+
+
+def _system_role_assignment_counts(session: Session, role_ids: list[str]) -> dict[str, int]:
+    if not role_ids:
+        return {}
+    return {
+        role_id: int(count)
+        for role_id, count in session.query(SystemRoleAssignment.role_id, func.count(SystemRoleAssignment.id))
+        .filter(SystemRoleAssignment.role_id.in_(role_ids))
+        .group_by(SystemRoleAssignment.role_id)
+        .all()
+    }
+
+
+def _accounts_by_id(session: Session, account_ids: list[str]) -> dict[str, Account]:
+    if not account_ids:
+        return {}
+    return {
+        account.id: account
+        for account in session.query(Account).filter(Account.id.in_(sorted(set(account_ids)))).all()
+    }
+
+
+def _accounts_by_user_id(session: Session, user_ids: list[str]) -> dict[str, Account]:
+    if not user_ids:
+        return {}
+    return {
+        user.id: account
+        for user, account in session.query(User, Account)
+        .join(Account, Account.id == User.account_id)
+        .filter(User.id.in_(sorted(set(user_ids))))
+        .all()
+    }
+
+
+def _group_member_ids_by_group_id(session: Session, *, tenant_id: str, group_ids: list[str]) -> dict[str, list[str]]:
+    grouped: dict[str, list[str]] = defaultdict(list)
+    if not group_ids:
+        return {}
+    for group_id, user_id in (
+        session.query(UserGroupMembership.group_id, UserGroupMembership.user_id)
+        .filter(UserGroupMembership.tenant_id == tenant_id, UserGroupMembership.group_id.in_(sorted(set(group_ids))))
+        .order_by(UserGroupMembership.group_id.asc(), UserGroupMembership.user_id.asc())
+        .all()
+    ):
+        grouped[group_id].append(user_id)
+    return dict(grouped)
+
+
+def _roles_by_group_id(session: Session, *, tenant_id: str, group_ids: list[str]) -> dict[str, list[Role]]:
+    grouped: dict[str, list[Role]] = defaultdict(list)
+    if not group_ids:
+        return {}
+    for group_id, role in (
+        session.query(GroupRoleAssignment.group_id, Role)
+        .join(Role, Role.id == GroupRoleAssignment.role_id)
+        .filter(GroupRoleAssignment.tenant_id == tenant_id, GroupRoleAssignment.group_id.in_(sorted(set(group_ids))), Role.tenant_id == tenant_id)
+        .order_by(GroupRoleAssignment.group_id.asc(), Role.name.asc())
+        .all()
+    ):
+        grouped[group_id].append(role)
+    return dict(grouped)
+
+
+def _groups_by_user_id(session: Session, *, tenant_id: str, user_ids: list[str]) -> dict[str, list[Group]]:
+    grouped: dict[str, list[Group]] = defaultdict(list)
+    if not user_ids:
+        return {}
+    for user_id, group in (
+        session.query(UserGroupMembership.user_id, Group)
+        .join(Group, Group.id == UserGroupMembership.group_id)
+        .filter(
+            UserGroupMembership.tenant_id == tenant_id,
+            UserGroupMembership.user_id.in_(sorted(set(user_ids))),
+            Group.is_active.is_(True),
+        )
+        .order_by(UserGroupMembership.user_id.asc(), Group.name.asc())
+        .all()
+    ):
+        grouped[user_id].append(group)
+    return dict(grouped)
+
+
+def _roles_by_user_id(session: Session, *, tenant_id: str, user_ids: list[str]) -> dict[str, list[Role]]:
+    grouped: dict[str, list[Role]] = defaultdict(list)
+    if not user_ids:
+        return {}
+    for user_id, role in (
+        session.query(UserRoleAssignment.user_id, Role)
+        .join(Role, Role.id == UserRoleAssignment.role_id)
+        .filter(
+            UserRoleAssignment.tenant_id == tenant_id,
+            UserRoleAssignment.user_id.in_(sorted(set(user_ids))),
+            Role.tenant_id == tenant_id,
+        )
+        .order_by(UserRoleAssignment.user_id.asc(), Role.name.asc())
+        .all()
+    ):
+        grouped[user_id].append(role)
+    return dict(grouped)
+
+
+def _role_summary(
+    session: Session,
+    role: Role,
+    *,
+    tenant_role_assignment_counts: dict[str, tuple[int, int]] | None = None,
+    system_role_assignment_counts: dict[str, int] | None = None,
+) -> RoleSummary:
    group_count = 0
    if role.tenant_id is None:
-        user_count = session.query(SystemRoleAssignment).filter(SystemRoleAssignment.role_id == role.id).count()
+        user_count = (
+            system_role_assignment_counts.get(role.id, 0)
+            if system_role_assignment_counts is not None
+            else session.query(SystemRoleAssignment).filter(SystemRoleAssignment.role_id == role.id).count()
+        )
        permission_level = "system"
    else:
-        user_count, group_count = role_assignment_counts(session, role.id)
+        user_count, group_count = (
+            tenant_role_assignment_counts.get(role.id, (0, 0))
+            if tenant_role_assignment_counts is not None
+            else role_assignment_counts(session, role.id)
+        )
        permission_level = "tenant"
    permissions = list(role.permissions or [])
    return RoleSummary(
@@ -108,19 +246,35 @@ def _role_summary(session: Session, role: Role) -> RoleSummary:
    )


-def _group_summary(session: Session, group: Group, *, include_members: bool = True) -> GroupSummary:
-    member_ids = [
-        row[0]
-        for row in session.query(UserGroupMembership.user_id)
-        .filter(UserGroupMembership.tenant_id == group.tenant_id, UserGroupMembership.group_id == group.id)
-        .all()
-    ]
+def _group_summary(
+    session: Session,
+    group: Group,
+    *,
+    include_members: bool = True,
+    member_ids_by_group: dict[str, list[str]] | None = None,
+    roles_by_group: dict[str, list[Role]] | None = None,
+    tenant_role_assignment_counts: dict[str, tuple[int, int]] | None = None,
+) -> GroupSummary:
+    member_ids = (
+        member_ids_by_group.get(group.id, [])
+        if member_ids_by_group is not None
+        else [
+            row[0]
+            for row in session.query(UserGroupMembership.user_id)
+            .filter(UserGroupMembership.tenant_id == group.tenant_id, UserGroupMembership.group_id == group.id)
+            .all()
+        ]
+    )
    roles = (
-        session.query(Role)
-        .join(GroupRoleAssignment, GroupRoleAssignment.role_id == Role.id)
-        .filter(GroupRoleAssignment.tenant_id == group.tenant_id, GroupRoleAssignment.group_id == group.id)
-        .order_by(Role.name.asc())
-        .all()
+        roles_by_group.get(group.id, [])
+        if roles_by_group is not None
+        else (
+            session.query(Role)
+            .join(GroupRoleAssignment, GroupRoleAssignment.role_id == Role.id)
+            .filter(GroupRoleAssignment.tenant_id == group.tenant_id, GroupRoleAssignment.group_id == group.id)
+            .order_by(Role.name.asc())
+            .all()
+        )
    )
    return GroupSummary(
        id=group.id,
@@ -130,7 +284,7 @@ def _group_summary(session: Session, group: Group, *, include_members: bool = Tr
        is_active=group.is_active,
        member_count=len(member_ids),
        member_ids=member_ids if include_members else [],
-        roles=[_role_summary(session, role) for role in roles],
+        roles=[_role_summary(session, role, tenant_role_assignment_counts=tenant_role_assignment_counts) for role in roles],
        created_at=group.created_at,
        updated_at=group.updated_at,
        system_template_id=group.system_template_id,
@@ -145,12 +299,18 @@ def _user_item(
    owner_ids: set[str] | None = None,
    idm_assignments: tuple[OrganizationFunctionAssignmentRef, ...] = (),
    organization_directory: OrganizationDirectory | None = None,
+    accounts_by_id: dict[str, Account] | None = None,
+    groups_by_user: dict[str, list[Group]] | None = None,
+    roles_by_user: dict[str, list[Role]] | None = None,
+    group_member_ids_by_group: dict[str, list[str]] | None = None,
+    group_roles_by_group: dict[str, list[Role]] | None = None,
+    tenant_role_assignment_counts: dict[str, tuple[int, int]] | None = None,
 ) -> UserAdminItem:
-    account = session.get(Account, user.account_id)
+    account = accounts_by_id.get(user.account_id) if accounts_by_id is not None else session.get(Account, user.account_id)
    if account is None:
        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="User account is missing")
-    groups = collect_user_groups(session, user)
-    roles = collect_direct_user_roles(session, user)
+    groups = groups_by_user.get(user.id, []) if groups_by_user is not None else collect_user_groups(session, user)
+    roles = roles_by_user.get(user.id, []) if roles_by_user is not None else collect_direct_user_roles(session, user)
    external_roles = (
        collect_external_function_roles(
            session,
@@ -176,8 +336,18 @@ def _user_item(
        account_is_active=account.is_active,
        password_reset_required=account.password_reset_required,
        last_login_at=account.last_login_at,
-        groups=[_group_summary(session, group, include_members=False) for group in groups],
-        roles=[_role_summary(session, role) for role in roles],
+        groups=[
+            _group_summary(
+                session,
+                group,
+                include_members=False,
+                member_ids_by_group=group_member_ids_by_group,
+                roles_by_group=group_roles_by_group,
+                tenant_role_assignment_counts=tenant_role_assignment_counts,
+            )
+            for group in groups
+        ],
+        roles=[_role_summary(session, role, tenant_role_assignment_counts=tenant_role_assignment_counts) for role in roles],
        function_assignment_ids=sorted(dict.fromkeys(function_assignment_ids)),
        function_delegation_ids=collect_function_delegation_ids(session, user),
        effective_scopes=expand_scopes(effective_scopes),
@@ -226,9 +396,12 @@ def _system_account_item(session: Session, account: Account) -> SystemAccountIte
    )


-def _api_key_item(session: Session, item: ApiKey) -> ApiKeyAdminItem:
-    user = session.get(User, item.user_id)
-    account = session.get(Account, user.account_id) if user else None
+def _api_key_item(session: Session, item: ApiKey, *, accounts_by_user_id: dict[str, Account] | None = None) -> ApiKeyAdminItem:
+    if accounts_by_user_id is not None:
+        account = accounts_by_user_id.get(item.user_id)
+    else:
+        user = session.get(User, item.user_id)
+        account = session.get(Account, user.account_id) if user else None
    return ApiKeyAdminItem(
        id=item.id,
        user_id=item.user_id,