GraphQL query/mutation benchmarking result

[amaster507 (Anthony Master)]

@pawan

One of our users posted queries where the Auth version was taking 1 sec whereas Auth with Admin was taking 20ms. Can we also look at why is that the case?

I think @michaelcompton explained it pretty good over here which helped me understand it better:

@michaelcompton

Here’s how the rules are processed.

• we process all the RBAC style rules first (the ones that look like this "$USERROLE: {eq: \"ADMIN\" }" if from that we can evaluate the auth, then we stop there and never go to the DB. For example, in your rule you have or: [ A, B, {rule: "$USERROLE: {eq: \"ADMIN\" }"} if the JWT says they are the admin, we can stop without evaluating anything else. Similarly, for the nested cases, we can cut out evaluation of other rules.
• after we have evaluated all the RBAC rules, we then run any remaining database rules in parallel.

My example of the admin taking 20s whereas the user was taking 1s mainly deals with the above.

My admin token quantifies the results based solely on a value in the JWT without doing any query logic so we can evaluate the auth, then we stop there and never go to the DB. However, the user token requires a database request to find out if the user has access based upon data in the database so we then run any remaining database rules in parallel.

That about sums up the difference for me.