Optimize full-text search's SecurityQuery

api/src/org/labkey/api/search/SearchService.java

@@ -305,19 +305,14 @@ public String toString()
             return _name;
         }
 
-        protected Set<String> getPermittedContainerIds(User user, Map<String, Container> containers, @NotNull Class<? extends Permission> perm)
-        {
-            Set<String> containerIds = new HashSet<>();
-            containers.forEach((id, container) -> {
-                if (container.hasPermission(user, perm))
-                    containerIds.add(id);
-            });
-            return containerIds.size() == containers.size() ? containers.keySet() : containerIds;
-        }
-
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        /**
+         * Permission required, beyond base container Read (which every searchable container already has), for this
+         * category's documents to be visible. Return null if base Read is sufficient.
+         */
+        @Nullable
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return containers.keySet();
+            return null;
         }
 
         public boolean isShowInAdvancedSearch()

api/src/org/labkey/api/util/MultiPhaseCPUTimer.java

@@ -38,6 +38,7 @@ public class MultiPhaseCPUTimer<K extends Enum<K>>
     private final K[] _values;
 
     private long _count = 0;
+    private boolean _clearedFirstInvocation = false;
 
     public MultiPhaseCPUTimer(Class<K> clazz, K[] values)
     {
@@ -87,6 +88,27 @@ public Map<String, Double> getTimes()
         return map;
     }
 
+    public void clearTimes()
+    {
+        synchronized (_accumulationMap)
+        {
+            _accumulationMap.values().forEach(v -> v.setValue(0));
+            _count = 0;
+        }
+    }
+
+    public void clearTimesIfFirstInvocation()
+    {
+        synchronized (_accumulationMap)
+        {
+            if (!_clearedFirstInvocation)
+            {
+                _clearedFirstInvocation = true;
+                clearTimes();
+            }
+        }
+    }
+
     // Create an enum map and populate it with MutableLongs for each value
     private static <ENUM extends Enum<ENUM>> Map<ENUM, MutableLong> getEnumMap(Class<ENUM> clazz, ENUM[] values)
     {

assay/src/org/labkey/assay/AssayManager.java

@@ -76,6 +76,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.AssayReadPermission;
 import org.labkey.api.security.permissions.InsertPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.settings.AppProps;
 import org.labkey.api.study.assay.ParticipantVisitResolver;
 import org.labkey.api.study.assay.ParticipantVisitResolverType;
@@ -120,23 +121,23 @@ public class AssayManager implements AssayService
 {
     SearchService.SearchCategory ASSAY_CATEGORY = new SearchService.SearchCategory("assay", "Assays") {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, AssayReadPermission.class);
+            return AssayReadPermission.class;
         }
     };
     SearchService.SearchCategory ASSAY_BATCH_CATEGORY = new SearchService.SearchCategory("assayBatch", "Assay Batches", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, AssayReadPermission.class);
+            return AssayReadPermission.class;
         }
     };
     SearchService.SearchCategory ASSAY_RUN_CATEGORY = new SearchService.SearchCategory("assayRun", "Assay Runs", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, AssayReadPermission.class);
+            return AssayReadPermission.class;
         }
     };
 

assay/src/org/labkey/assay/plate/PlateManager.java

@@ -116,6 +116,7 @@
 import org.labkey.api.query.ValidationException;
 import org.labkey.api.reader.ColumnDescriptor;
 import org.labkey.api.search.SearchService;
+import org.labkey.api.search.SearchService.SearchCategory;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.InsertPermission;
 import org.labkey.api.security.permissions.Permission;
@@ -220,21 +221,8 @@ public class PlateManager implements PlateService, AssayListener, ExperimentList
     // when those calls are being made for a plate save operation.
     public static final String PLATE_SAVE_FLAG = ".plateSave";
 
-    public SearchService.SearchCategory PLATE_CATEGORY = new SearchService.SearchCategory("plate", "Assay Plates", false) {
-        @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
-        {
-            return getPermittedContainerIds(user, containers, ReadPermission.class);
-        }
-    };
-
-    public SearchService.SearchCategory PLATE_SET_CATEGORY = new SearchService.SearchCategory("plateSet", "Assay Plate Sets", false) {
-        @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
-        {
-            return getPermittedContainerIds(user, containers, ReadPermission.class);
-        }
-    };
+    public SearchCategory PLATE_CATEGORY = new SearchCategory("plate", "Assay Plates", false);
+    public SearchCategory PLATE_SET_CATEGORY = new SearchCategory("plateSet", "Assay Plate Sets", false);
 
     public static PlateManager get()
     {

experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java

@@ -48,6 +48,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.DataClassReadPermission;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
 import org.labkey.api.util.UnexpectedException;
@@ -76,16 +77,16 @@ public class ExpDataClassImpl extends ExpIdentifiableEntityImpl<DataClass> imple
     private static final String MEDIA_SEARCH_CATEGORY_NAME = "media";
     public static final SearchService.SearchCategory SEARCH_CATEGORY = new SearchService.SearchCategory(SEARCH_CATEGORY_NAME, "Collections of data objects", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, DataClassReadPermission.class);
+            return DataClassReadPermission.class;
         }
     };
     public static final SearchService.SearchCategory MEDIA_SEARCH_CATEGORY = new SearchService.SearchCategory(MEDIA_SEARCH_CATEGORY_NAME, "Collections of media data and samples", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, MediaReadPermission.class);
+            return MediaReadPermission.class;
         }
     };
 

experiment/src/org/labkey/experiment/api/ExpDataImpl.java

@@ -133,16 +133,16 @@ public Class<? extends Permission> getPermissionClass()
 
     public static final SearchService.SearchCategory expDataCategory = new SearchService.SearchCategory("data", "ExpData", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, DataClassReadPermission.class);
+            return DataClassReadPermission.class;
         }
     };
     public static final SearchService.SearchCategory expMediaDataCategory = new SearchService.SearchCategory("mediaData", "ExpData for media objects", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, MediaReadPermission.class);
+            return MediaReadPermission.class;
         }
     };
 

experiment/src/org/labkey/experiment/api/ExpMaterialImpl.java

@@ -59,6 +59,7 @@
 import org.labkey.api.search.SearchService;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.study.StudyService;
 import org.labkey.api.util.JobRunner;
 import org.labkey.api.util.PageFlowUtil;
@@ -88,9 +89,9 @@ public class ExpMaterialImpl extends AbstractRunItemImpl<Material> implements Ex
     public static final SearchService.SearchCategory searchCategory = new SearchService.SearchCategory("material", "Materials/Samples", false);
     public static final SearchService.SearchCategory mediaSearchCategory = new SearchService.SearchCategory("media", "Media Samples", false){
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, MediaReadPermission.class);
+            return MediaReadPermission.class;
         }
     };
 

experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java

@@ -63,6 +63,7 @@
 import org.labkey.api.search.SearchService;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.study.StudyService;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
@@ -97,9 +98,9 @@ public class ExpSampleTypeImpl extends ExpIdentifiableEntityImpl<MaterialSource>
     public static final SearchService.SearchCategory searchCategory = new SearchService.SearchCategory(categoryName, "Sample Types", false);
     public static final SearchService.SearchCategory mediaSearchCategory = new SearchService.SearchCategory(mediaCategoryName, "Media Sample Types", false) {
         @Override
-        public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
+        public Class<? extends Permission> getRequiredPermission()
         {
-            return getPermittedContainerIds(user, containers, MediaReadPermission.class);
+            return MediaReadPermission.class;
         }
     };
 

search/src/org/labkey/search/SearchModule.java

@@ -58,6 +58,7 @@
 import org.labkey.search.model.PlainTextDocumentParser;
 import org.labkey.search.model.SearchSchema;
 import org.labkey.search.model.SearchStartupProperties;
+import org.labkey.search.model.SecurityQuery;
 import org.labkey.search.view.SearchWebPartFactory;
 
 import javax.management.StandardMBean;
@@ -259,7 +260,7 @@ private void reindexIfNeeded(@NotNull SearchService ss)
     @Override
     public @NotNull Set<Class<?>> getUnitTests()
     {
-        return Set.of(AbstractSearchService.TestCase.class);
+        return Set.of(AbstractSearchService.TestCase.class, SecurityQuery.TestCase.class);
     }
 
     @Override

search/src/org/labkey/search/model/LuceneSearchServiceImpl.java

@@ -1824,6 +1824,7 @@ else if (options.sortField.equals(FIELD_NAME.container.name()))
         finally
         {
             TIMER.releaseInvocationTimer(iTimer);
+            TIMER.clearTimesIfFirstInvocation(); // Toss the very first invocation since it likely had to warm the caches, etc.
         }
     }