perf: optimize enforcement hot paths

benches/benchmark.rs

@@ -77,6 +77,9 @@ fn b_benchmark_cached_basic_model(c: &mut Criterion) {
     });
 }
 
+#[cfg(not(feature = "cached"))]
+fn b_benchmark_cached_basic_model(_c: &mut Criterion) {}
+
 fn b_benchmark_rbac_model(c: &mut Criterion) {
     let e = await_future(Enforcer::new(
         "examples/rbac_model.conf",
@@ -558,6 +561,9 @@ fn b_benchmark_cached_abac_model(c: &mut Criterion) {
     });
 }
 
+#[cfg(not(feature = "cached"))]
+fn b_benchmark_cached_abac_model(_c: &mut Criterion) {}
+
 fn b_benchmark_key_match(c: &mut Criterion) {
     let e = await_future(Enforcer::new(
         "examples/keymatch_model.conf",
@@ -637,6 +643,7 @@ criterion_group!(
     benches,
     b_benchmark_raw,
     b_benchmark_basic_model,
+    b_benchmark_cached_basic_model,
     b_benchmark_rbac_model,
     b_benchmark_role_manager_small,
     b_benchmark_rbac_model_small,
@@ -647,6 +654,7 @@ criterion_group!(
     b_benchmark_rbac_with_resource_roles,
     b_benchmark_rbac_model_with_domains,
     b_benchmark_abac_model,
+    b_benchmark_cached_abac_model,
     b_benchmark_key_match,
     b_benchmark_rbac_with_deny,
     b_benchmark_priority_model,

src/cached_enforcer.rs

@@ -41,7 +41,7 @@ pub struct CachedEnforcer {
 
 impl EventEmitter<Event> for CachedEnforcer {
     fn on(&mut self, e: Event, f: fn(&mut Self, EventData)) {
-        self.events.entry(e).or_insert_with(Vec::new).push(f)
+        self.events.entry(e).or_default().push(f)
     }
 
     fn off(&mut self, e: Event) {
@@ -66,8 +66,7 @@ impl CachedEnforcer {
         Ok(if let Some(authorized) = self.cache.get(&cache_key) {
             (authorized, true, None)
         } else {
-            let (authorized, indices) =
-                self.enforcer.private_enforce(&rvals)?;
+            let (authorized, indices) = self.enforcer.private_enforce(rvals)?;
             self.cache.set(cache_key, authorized);
             (authorized, false, indices)
         })
@@ -82,7 +81,7 @@ impl CachedEnforcer {
             (authorized, true, None)
         } else {
             let (authorized, indices) =
-                self.enforcer.private_enforce_with_context(ctx, &rvals)?;
+                self.enforcer.private_enforce_with_context(ctx, rvals)?;
             self.cache.set(cache_key, authorized);
             (authorized, false, indices)
         })
@@ -206,6 +205,12 @@ impl CoreApi for CachedEnforcer {
 
     fn enforce<ARGS: EnforceArgs>(&self, rvals: ARGS) -> Result<bool> {
         let cache_key = rvals.cache_key();
+
+        #[cfg(not(feature = "logging"))]
+        if let Some(authorized) = self.cache.get(&cache_key) {
+            return Ok(authorized);
+        }
+
         let rvals = rvals.try_into_vec()?;
         #[allow(unused_variables)]
         let (authorized, cached, indices) =
@@ -244,6 +249,12 @@ impl CoreApi for CachedEnforcer {
         rvals: ARGS,
     ) -> Result<bool> {
         let cache_key = rvals.cache_key();
+
+        #[cfg(not(feature = "logging"))]
+        if let Some(authorized) = self.cache.get(&cache_key) {
+            return Ok(authorized);
+        }
+
         let rvals = rvals.try_into_vec()?;
         #[allow(unused_variables)]
         let (authorized, cached, indices) =

src/enforcer.rs

@@ -148,6 +148,7 @@ impl Enforcer {
 
         let policies = p_ast.get_policy();
         let (policy_len, scope_len) = (policies.len(), scope.len());
+        let p_eft_index = p_ast.tokens.iter().position(|x| x == "p_eft");
 
         let mut eft_stream =
             self.eft.new_stream(&e_ast.value, max(policy_len, 1));
@@ -203,7 +204,7 @@ impl Enforcer {
             let eval_result = self
                 .engine
                 .eval_ast_with_scope::<bool>(&mut scope, m_ast_compiled)?;
-            let eft = match p_ast.tokens.iter().position(|x| x == "p_eft") {
+            let eft = match p_eft_index {
                 Some(j) if eval_result => {
                     let p_eft = &pvals[j];
                     if p_eft == "deny" {
@@ -288,6 +289,7 @@ impl Enforcer {
 
         let policies = p_ast.get_policy();
         let (policy_len, scope_len) = (policies.len(), scope.len());
+        let p_eft_index = p_ast.tokens.iter().position(|x| x == "p_eft");
 
         let mut eft_stream =
             self.eft.new_stream(&e_ast.value, max(policy_len, 1));
@@ -348,7 +350,7 @@ impl Enforcer {
             let eval_result = self
                 .engine
                 .eval_ast_with_scope::<bool>(&mut scope, m_ast_compiled)?;
-            let eft = match p_ast.tokens.iter().position(|x| x == "p_eft") {
+            let eft = match p_eft_index {
                 Some(j) if eval_result => {
                     let p_eft = &pvals[j];
                     if p_eft == "deny" {

src/model/function_map.rs

@@ -14,6 +14,9 @@ use rhai::Dynamic;
 
 static MAT_B: Lazy<Regex> = Lazy::new(|| Regex::new(r":[^/]*").unwrap());
 static MAT_P: Lazy<Regex> = Lazy::new(|| Regex::new(r"\{[^/]*\}").unwrap());
+static MAT_COLON: Lazy<Regex> = Lazy::new(|| Regex::new(r":[^/]+").unwrap());
+static MAT_BRACE: Lazy<Regex> =
+    Lazy::new(|| Regex::new(r"\{[^/]+?\}").unwrap());
 
 use std::{borrow::Cow, collections::HashMap};
 
@@ -248,9 +251,8 @@ pub fn key_get2(key1: &str, key2: &str, path_var: &str) -> String {
         key2.into()
     };
 
-    let re = Regex::new(r":[^/]+").unwrap();
-    let keys: Vec<_> = re.find_iter(&key2).collect();
-    let key2 = re.replace_all(&key2, "([^/]+)").to_string();
+    let keys: Vec<_> = MAT_COLON.find_iter(&key2).collect();
+    let key2 = MAT_COLON.replace_all(&key2, "([^/]+)").to_string();
     let key2 = format!("^{}$", key2);
 
     if let Ok(re2) = Regex::new(&key2) {
@@ -291,13 +293,9 @@ pub fn key_get3(key1: &str, key2: &str, path_var: &str) -> String {
         key2.into()
     };
 
-    let re = Regex::new(r"\{[^/]+?\}").unwrap();
-    let keys: Vec<_> = re.find_iter(&key2).collect();
-    let key2 = re.replace_all(&key2, "([^/]+?)").to_string();
-    let key2 = Regex::new(r"\{")
-        .unwrap()
-        .replace_all(&key2, "\\{")
-        .to_string();
+    let keys: Vec<_> = MAT_BRACE.find_iter(&key2).collect();
+    let key2 = MAT_BRACE.replace_all(&key2, "([^/]+?)").to_string();
+    let key2 = key2.replace('{', "\\{");
     let key2 = format!("^{}$", key2);
 
     let re2 = Regex::new(&key2).unwrap();
@@ -323,8 +321,7 @@ pub fn key_match4(key1: &str, key2: &str) -> bool {
     let mut key2 = key2.replace("/*", "/.*");
     let mut tokens = Vec::new();
 
-    let re = Regex::new(r"\{[^/]+?\}").unwrap();
-    key2 = re
+    key2 = MAT_BRACE
         .replace_all(&key2, |caps: &regex::Captures| {
             tokens.push(caps[0][1..caps[0].len() - 1].to_string());
             "([^/]+)".to_string()
@@ -373,9 +370,7 @@ pub fn key_match5(key1: &str, key2: &str) -> bool {
     };
 
     let key2 = key2.replace("/*", "/.*");
-    let key2 = Regex::new(r"(\{[^/]+?\})")
-        .unwrap()
-        .replace_all(&key2, "[^/]+");
+    let key2 = MAT_BRACE.replace_all(&key2, "[^/]+");
 
     regex_match(key1, &format!("^{}$", key2))
 }