@@ -428,99 +428,55 @@ func (impl ImageScanRestHandlerImpl) VulnerabilitySummary(w http.ResponseWriter,
428428 return
429429 }
430430
431- // Create ImageScanRequest with filters for fetching deploy info
432- request := & securityBean.ImageScanRequest {
433- ImageScanFilter : bean.ImageScanFilter {
434- EnvironmentIds : summaryRequest .EnvironmentIds ,
435- ClusterIds : summaryRequest .ClusterIds ,
436- },
437- }
438-
439- deployInfoList , err := impl .imageScanService .FetchAllDeployInfo (request )
440- if err != nil {
441- impl .logger .Errorw ("service err, VulnerabilitySummary" , "err" , err )
442- if util .IsErrNoRows (err ) {
443- emptySummary := & securityBean.VulnerabilitySummary {
444- TotalVulnerabilities : 0 ,
445- SeverityCount : & securityBean.SeverityCount {
446- Critical : 0 ,
447- High : 0 ,
448- Medium : 0 ,
449- Low : 0 ,
450- Unknown : 0 ,
451- },
452- FixableVulnerabilities : 0 ,
453- NotFixableVulnerabilities : 0 ,
454- }
455- common .WriteJsonResp (w , nil , emptySummary , http .StatusOK )
456- } else {
457- common .WriteJsonResp (w , err , nil , http .StatusInternalServerError )
458- }
459- return
460- }
461-
462- filteredDeployInfoList , err := impl .imageScanService .FilterDeployInfoByScannedArtifactsDeployedInEnv (deployInfoList )
463- if err != nil {
464- impl .logger .Errorw ("request err, FilterDeployInfoListForScannedArtifacts" , "err" , err )
465- common .WriteJsonResp (w , err , nil , http .StatusInternalServerError )
466- return
467- }
468-
469- _ , rbacSpan := otel .Tracer ("imageScanRestHandler" ).Start (ctx , "RBACProcessing" )
431+ // Check if user is super admin first - this determines the optimization path
432+ _ , rbacSpan := otel .Tracer ("imageScanRestHandler" ).Start (ctx , "RBACCheck" )
470433 token := r .Header .Get ("token" )
471- isSuperAdmin := false
472- if ok := impl .enforcer .Enforce (token , casbin .ResourceGlobal , casbin .ActionGet , "*" ); ok {
473- isSuperAdmin = true
474- }
434+ isSuperAdmin := impl .enforcer .Enforce (token , casbin .ResourceGlobal , casbin .ActionGet , "*" )
435+ rbacSpan .End ()
436+
475437 var ids []int
438+
476439 if isSuperAdmin {
477- ids = sliceUtil .NewSliceFromFuncExec (filteredDeployInfoList , func (item * security2.ImageScanDeployInfo ) int {
478- return item .Id
479- })
440+ // OPTIMIZATION: For super-admin users, skip deploy info fetching and filtering entirely
441+ // The GetVulnerabilityRawData query already handles all filtering (env, cluster, app) at DB level
442+ // When ids is empty, it doesn't apply RBAC filtering, which is correct for super-admins
443+ ids = nil
480444 } else {
445+ // OPTIMIZATION: For non-super-admin users, use optimized single query
446+ _ , fetchSpan := otel .Tracer ("imageScanRestHandler" ).Start (ctx , "FetchScannedDeployInfo" )
447+ filteredDeployInfoList , err := impl .imageScanService .FetchScannedDeployInfoWithFilters (ctx , summaryRequest .EnvironmentIds , summaryRequest .ClusterIds )
448+ fetchSpan .End ()
449+ if err != nil {
450+ impl .logger .Errorw ("service err, VulnerabilitySummary" , "err" , err )
451+ if util .IsErrNoRows (err ) {
452+ common .WriteJsonResp (w , nil , impl .getEmptyVulnerabilitySummary (), http .StatusOK )
453+ } else {
454+ common .WriteJsonResp (w , err , nil , http .StatusInternalServerError )
455+ }
456+ return
457+ }
458+
459+ // Apply RBAC filtering
460+ _ , rbacProcessSpan := otel .Tracer ("imageScanRestHandler" ).Start (ctx , "RBACProcessing" )
481461 ids , err = impl .getAuthorisedImageScanDeployInfoIds (token , filteredDeployInfoList )
462+ rbacProcessSpan .End ()
482463 if err != nil {
483464 impl .logger .Errorw ("error in getting authorised image scan deploy info ids" , "err" , err )
484465 common .WriteJsonResp (w , err , nil , http .StatusInternalServerError )
485466 return
486467 }
487- }
488- rbacSpan .End ()
489468
490- if len (ids ) == 0 {
491- emptySummary := & securityBean.VulnerabilitySummary {
492- TotalVulnerabilities : 0 ,
493- SeverityCount : & securityBean.SeverityCount {
494- Critical : 0 ,
495- High : 0 ,
496- Medium : 0 ,
497- Low : 0 ,
498- Unknown : 0 ,
499- },
500- FixableVulnerabilities : 0 ,
501- NotFixableVulnerabilities : 0 ,
469+ if len (ids ) == 0 {
470+ common .WriteJsonResp (w , nil , impl .getEmptyVulnerabilitySummary (), http .StatusOK )
471+ return
502472 }
503- common .WriteJsonResp (w , nil , emptySummary , http .StatusOK )
504- return
505473 }
506474
507475 summary , err := impl .imageScanService .FetchVulnerabilitySummary (ctx , summaryRequest , ids )
508476 if err != nil {
509477 impl .logger .Errorw ("service err, VulnerabilitySummary" , "err" , err )
510478 if util .IsErrNoRows (err ) {
511- emptySummary := & securityBean.VulnerabilitySummary {
512- TotalVulnerabilities : 0 ,
513- SeverityCount : & securityBean.SeverityCount {
514- Critical : 0 ,
515- High : 0 ,
516- Medium : 0 ,
517- Low : 0 ,
518- Unknown : 0 ,
519- },
520- FixableVulnerabilities : 0 ,
521- NotFixableVulnerabilities : 0 ,
522- }
523- common .WriteJsonResp (w , nil , emptySummary , http .StatusOK )
479+ common .WriteJsonResp (w , nil , impl .getEmptyVulnerabilitySummary (), http .StatusOK )
524480 } else {
525481 common .WriteJsonResp (w , err , nil , http .StatusInternalServerError )
526482 }
@@ -529,6 +485,22 @@ func (impl ImageScanRestHandlerImpl) VulnerabilitySummary(w http.ResponseWriter,
529485 common .WriteJsonResp (w , err , summary , http .StatusOK )
530486}
531487
488+ // getEmptyVulnerabilitySummary returns an empty vulnerability summary response
489+ func (impl ImageScanRestHandlerImpl ) getEmptyVulnerabilitySummary () * securityBean.VulnerabilitySummary {
490+ return & securityBean.VulnerabilitySummary {
491+ TotalVulnerabilities : 0 ,
492+ SeverityCount : & securityBean.SeverityCount {
493+ Critical : 0 ,
494+ High : 0 ,
495+ Medium : 0 ,
496+ Low : 0 ,
497+ Unknown : 0 ,
498+ },
499+ FixableVulnerabilities : 0 ,
500+ NotFixableVulnerabilities : 0 ,
501+ }
502+ }
503+
532504func (impl ImageScanRestHandlerImpl ) VulnerabilityListing (w http.ResponseWriter , r * http.Request ) {
533505 ctx , span := otel .Tracer ("imageScanRestHandler" ).Start (r .Context (), "VulnerabilityListing" )
534506 defer span .End ()
0 commit comments