Optimize full-text search's SecurityQuery

api/src/org/labkey/api/search/SearchService.java

@@ -187,7 +187,7 @@ public String toString()
         }
     }
 
-    enum SEARCH_PHASE {createQuery, buildSecurityFilter, search, applySecurityFilter, processHits}
+    enum SEARCH_PHASE {createQuery, buildSecurityFilterOld, buildSecurityFilter, search, applySecurityFilter, processHits}
 
     interface TaskListener
     {
@@ -305,6 +305,17 @@ public String toString()
             return _name;
         }
 
+        /**
+         * Permission required, beyond base container Read (which every searchable container already has), for this
+         * category's documents to be visible. Return null if base Read is sufficient.
+         */
+        @Nullable
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return null;
+        }
+
+        @Deprecated // TODO: Remove after testing
         protected Set<String> getPermittedContainerIds(User user, Map<String, Container> containers, @NotNull Class<? extends Permission> perm)
         {
             Set<String> containerIds = new HashSet<>();
@@ -315,6 +326,7 @@ protected Set<String> getPermittedContainerIds(User user, Map<String, Container>
             return containerIds.size() == containers.size() ? containers.keySet() : containerIds;
         }
 
+        @Deprecated // TODO: Remove after testing
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {
             return containers.keySet();

api/src/org/labkey/api/util/MultiPhaseCPUTimer.java

@@ -38,6 +38,7 @@ public class MultiPhaseCPUTimer<K extends Enum<K>>
     private final K[] _values;
 
     private long _count = 0;
+    private boolean _clearedFirstInvocation = false;
 
     public MultiPhaseCPUTimer(Class<K> clazz, K[] values)
     {
@@ -87,6 +88,27 @@ public Map<String, Double> getTimes()
         return map;
     }
 
+    public void clearTimes()
+    {
+        synchronized (_accumulationMap)
+        {
+            _accumulationMap.values().forEach(v -> v.setValue(0));
+            _count = 0;
+        }
+    }
+
+    public void clearTimesIfFirstInvocation()
+    {
+        synchronized (_accumulationMap)
+        {
+            if (!_clearedFirstInvocation)
+            {
+                _clearedFirstInvocation = true;
+                clearTimes();
+            }
+        }
+    }
+
     // Create an enum map and populate it with MutableLongs for each value
     private static <ENUM extends Enum<ENUM>> Map<ENUM, MutableLong> getEnumMap(Class<ENUM> clazz, ENUM[] values)
     {

assay/src/org/labkey/assay/AssayManager.java

@@ -76,6 +76,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.AssayReadPermission;
 import org.labkey.api.security.permissions.InsertPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.settings.AppProps;
 import org.labkey.api.study.assay.ParticipantVisitResolver;
 import org.labkey.api.study.assay.ParticipantVisitResolverType;
@@ -119,20 +120,38 @@
 public class AssayManager implements AssayService
 {
     SearchService.SearchCategory ASSAY_CATEGORY = new SearchService.SearchCategory("assay", "Assays") {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return AssayReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {
             return getPermittedContainerIds(user, containers, AssayReadPermission.class);
         }
     };
     SearchService.SearchCategory ASSAY_BATCH_CATEGORY = new SearchService.SearchCategory("assayBatch", "Assay Batches", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return AssayReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {
             return getPermittedContainerIds(user, containers, AssayReadPermission.class);
         }
     };
     SearchService.SearchCategory ASSAY_RUN_CATEGORY = new SearchService.SearchCategory("assayRun", "Assay Runs", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return AssayReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {

assay/src/org/labkey/assay/plate/PlateManager.java

@@ -220,6 +220,9 @@ public class PlateManager implements PlateService, AssayListener, ExperimentList
     // when those calls are being made for a plate save operation.
     public static final String PLATE_SAVE_FLAG = ".plateSave";
 
+    // No getRequiredPermission() override needed: base container Read (already required to reach this category's
+    // containers) is sufficient. The old getPermittedContainerIds() override below is kept temporarily for
+    // old-vs-new comparison testing even though it's a redundant re-check of Read permission.
     public SearchService.SearchCategory PLATE_CATEGORY = new SearchService.SearchCategory("plate", "Assay Plates", false) {
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)

experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java

@@ -48,6 +48,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.DataClassReadPermission;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
 import org.labkey.api.util.UnexpectedException;
@@ -75,13 +76,25 @@ public class ExpDataClassImpl extends ExpIdentifiableEntityImpl<DataClass> imple
     private static final String SEARCH_CATEGORY_NAME = "dataClass";
     private static final String MEDIA_SEARCH_CATEGORY_NAME = "media";
     public static final SearchService.SearchCategory SEARCH_CATEGORY = new SearchService.SearchCategory(SEARCH_CATEGORY_NAME, "Collections of data objects", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return DataClassReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {
             return getPermittedContainerIds(user, containers, DataClassReadPermission.class);
         }
     };
     public static final SearchService.SearchCategory MEDIA_SEARCH_CATEGORY = new SearchService.SearchCategory(MEDIA_SEARCH_CATEGORY_NAME, "Collections of media data and samples", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return MediaReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {

experiment/src/org/labkey/experiment/api/ExpDataImpl.java

@@ -132,13 +132,25 @@ public Class<? extends Permission> getPermissionClass()
     }
 
     public static final SearchService.SearchCategory expDataCategory = new SearchService.SearchCategory("data", "ExpData", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return DataClassReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {
             return getPermittedContainerIds(user, containers, DataClassReadPermission.class);
         }
     };
     public static final SearchService.SearchCategory expMediaDataCategory = new SearchService.SearchCategory("mediaData", "ExpData for media objects", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return MediaReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {

experiment/src/org/labkey/experiment/api/ExpMaterialImpl.java

@@ -59,6 +59,7 @@
 import org.labkey.api.search.SearchService;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.study.StudyService;
 import org.labkey.api.util.JobRunner;
 import org.labkey.api.util.PageFlowUtil;
@@ -87,6 +88,12 @@ public class ExpMaterialImpl extends AbstractRunItemImpl<Material> implements Ex
 {
     public static final SearchService.SearchCategory searchCategory = new SearchService.SearchCategory("material", "Materials/Samples", false);
     public static final SearchService.SearchCategory mediaSearchCategory = new SearchService.SearchCategory("media", "Media Samples", false){
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return MediaReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {

experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java

@@ -63,6 +63,7 @@
 import org.labkey.api.search.SearchService;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.security.permissions.Permission;
 import org.labkey.api.study.StudyService;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
@@ -96,6 +97,12 @@ public class ExpSampleTypeImpl extends ExpIdentifiableEntityImpl<MaterialSource>
     private static final String mediaCategoryName = "mediaMaterialSource";
     public static final SearchService.SearchCategory searchCategory = new SearchService.SearchCategory(categoryName, "Sample Types", false);
     public static final SearchService.SearchCategory mediaSearchCategory = new SearchService.SearchCategory(mediaCategoryName, "Media Sample Types", false) {
+        @Override
+        public Class<? extends Permission> getRequiredPermission()
+        {
+            return MediaReadPermission.class;
+        }
+
         @Override
         public Set<String> getPermittedContainerIds(User user, Map<String, Container> containers)
         {

search/src/org/labkey/search/SearchModule.java

@@ -58,6 +58,7 @@
 import org.labkey.search.model.PlainTextDocumentParser;
 import org.labkey.search.model.SearchSchema;
 import org.labkey.search.model.SearchStartupProperties;
+import org.labkey.search.model.SecurityQuery;
 import org.labkey.search.view.SearchWebPartFactory;
 
 import javax.management.StandardMBean;
@@ -259,7 +260,7 @@ private void reindexIfNeeded(@NotNull SearchService ss)
     @Override
     public @NotNull Set<Class<?>> getUnitTests()
     {
-        return Set.of(AbstractSearchService.TestCase.class);
+        return Set.of(AbstractSearchService.TestCase.class, SecurityQuery.TestCase.class);
     }
 
     @Override

search/src/org/labkey/search/model/LuceneSearchServiceImpl.java

@@ -1824,6 +1824,7 @@ else if (options.sortField.equals(FIELD_NAME.container.name()))
         finally
         {
             TIMER.releaseInvocationTimer(iTimer);
+            TIMER.clearTimesIfFirstInvocation(); // Toss the very first invocation since it likely had to warm the caches, etc.
         }
     }