Remove id guid id roundtrips (#5318)

* Add bare-id read-permission helpers to Permissions

Add readable_org_ids_for_domains_query and readable_security_group_ids_query,
mirroring the existing *_guids_query helpers but returning the flat id UNION
without the enclosing SELECT ... FROM organizations/security_groups WHERE id IN
wrapper. Prerequisite for removing id -> guid -> id round-trips from V3
read-permission filters.

Follow-up to #5157 and #5172.

* Filter GET /v3/organizations by org id instead of guid

Switch OrgListFetcher and the organization presenter args to the bare-id
readable_org_ids_query, collapsing the id -> guid -> id round-trip on the
non-admin GET /v3/organizations path into a single WHERE id IN (UNION).

Follow-up to #5157 and #5172.

* Filter GET /v3/organization_quotas by org id instead of guid

Switch OrganizationQuotaListFetcher and OrganizationQuotaPresenter to the
bare-id readable_org_ids_query. The presenter's per-quota visible-org filter
previously ran an id -> guid -> id round-trip once per quota returned; it now
filters directly on organizations.id.

Follow-up to #5157 and #5172.

* Filter GET /v3/domains* by org id instead of guid

Switch DomainFetcher, DomainPresenter, DomainSharedOrgsPresenter and the
domains/default-domain paths on OrganizationsController to the bare-id
readable_org_ids(_for_domains)_query, removing the id -> guid -> id round-trip
from domain read-permission filtering.

Follow-up to #5157 and #5172.

* Filter service plan visibility by org id instead of guid

Switch ServicePlanVisibilityFetcher to the bare-id readable_org_ids_query,
removing the id -> guid -> id round-trip from marketplace visibility checks.

Follow-up to #5157 and #5172.

* Filter GET /v3/security_groups* by security group id instead of guid

Switch SecurityGroupListFetcher and SecurityGroupFetcher to the new bare-id
readable_security_group_ids_query, removing the id -> guid -> id round-trip
from the security group visibility filter. The single-resource guid lookup and
the guid-membership checks on individual actions are left untouched.

Follow-up to #5157 and #5172.

* Filter isolation segment organizations by org id instead of guid

Switch IsolationSegmentOrganizationsFetcher (backing
GET /v3/isolation_segments/:guid/relationships/organizations for non-admins)
to the bare-id readable_org_ids_query. The IsolationSegmentListFetcher path is
left as-is: its organizations association is keyed on guid through the join
table, so no org id is in scope there.

Follow-up to #5157 and #5172.

Author: svkrieger

app/controllers/v3/domains_controller.rb

@@ -18,7 +18,7 @@ def index
     message = DomainsListMessage.from_params(query_params)
     invalid_param!(message.errors.full_messages) unless message.valid?
 
-    dataset = DomainFetcher.fetch(message, permission_queryer.readable_org_guids_for_domains_query)
+    dataset = DomainFetcher.fetch(message, permission_queryer.readable_org_ids_for_domains_query)
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
       presenter: Presenters::V3::DomainPresenter,
@@ -164,7 +164,7 @@ def to_route_list_params(query_params, domain)
   def find_domain(message)
     DomainFetcher.fetch(
       message,
-      permission_queryer.readable_org_guids_for_domains_query
+      permission_queryer.readable_org_ids_for_domains_query
     ).first
   end
 
@@ -249,7 +249,7 @@ def presenter_args
     if permission_queryer.can_read_globally?
       { all_orgs_visible: true }
     else
-      { visible_org_guids_query: permission_queryer.readable_org_guids_query }
+      { visible_org_ids_query: permission_queryer.readable_org_ids_query }
     end
   end
 end

app/controllers/v3/isolation_segments_controller.rb

@@ -90,7 +90,7 @@ def relationships_orgs
     organizations = if permission_queryer.can_read_globally?
                       fetcher.fetch_all
                     else
-                      fetcher.fetch_for_organizations(org_guids_query: permission_queryer.readable_org_guids_query)
+                      fetcher.fetch_for_organizations(org_ids_query: permission_queryer.readable_org_ids_query)
                     end
 
     render status: :ok, json: Presenters::V3::ToManyRelationshipPresenter.new(

app/controllers/v3/organization_quotas_controller.rb

@@ -17,7 +17,7 @@ def index
     dataset = if permission_queryer.can_read_globally?
                 OrganizationQuotaListFetcher.fetch_all(message:)
               else
-                OrganizationQuotaListFetcher.fetch(message: message, readable_org_guids_query: permission_queryer.readable_org_guids_query)
+                OrganizationQuotaListFetcher.fetch(message: message, readable_org_ids_query: permission_queryer.readable_org_ids_query)
               end
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
@@ -110,7 +110,7 @@ def presenter_args
     if permission_queryer.can_read_globally?
       { all_orgs_visible: true }
     else
-      { visible_org_guids_query: permission_queryer.readable_org_guids_query }
+      { visible_org_ids_query: permission_queryer.readable_org_ids_query }
     end
   end
 end

app/controllers/v3/organizations_controller.rb

@@ -149,7 +149,8 @@ def index_org_domains
     message = DomainsListMessage.from_params(query_params.except(:guid))
     invalid_param!(message.errors.full_messages) unless message.valid?
 
-    domains = DomainFetcher.fetch(message, permission_queryer.readable_org_guids_for_domains_query.where(guid: org.guid))
+    readable_org_ids = Organization.where(id: org.id).where(id: permission_queryer.readable_org_ids_for_domains_query).select(:id)
+    domains = DomainFetcher.fetch(message, readable_org_ids)
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
       presenter: Presenters::V3::DomainPresenter,
@@ -166,7 +167,7 @@ def show_default_domain
     domain = org.default_domain
 
     domain_not_found! unless domain
-    domain_not_found! if domain.private? && permission_queryer.readable_org_guids_for_domains_query.where(guid: org.guid).empty?
+    domain_not_found! if domain.private? && Organization.where(id: org.id).where(id: permission_queryer.readable_org_ids_for_domains_query).empty?
 
     render status: :ok, json: Presenters::V3::DomainPresenter.new(domain, **presenter_args)
   end
@@ -245,7 +246,7 @@ def fetch_orgs(message)
     else
       OrgListFetcher.fetch(
         message: message,
-        guids: permission_queryer.readable_org_guids_query,
+        ids: permission_queryer.readable_org_ids_query,
         eager_loaded_associations: Presenters::V3::OrganizationPresenter.associated_resources
       )
     end
@@ -260,7 +261,7 @@ def fetch_orgs_for_isolation_segment(message)
     else
       isolation_segment, dataset = OrgListFetcher.fetch_for_isolation_segment(
         message: message,
-        guids: permission_queryer.readable_org_guids_query,
+        ids: permission_queryer.readable_org_ids_query,
         eager_loaded_associations: Presenters::V3::OrganizationPresenter.associated_resources
       )
     end
@@ -272,7 +273,7 @@ def presenter_args
     if permission_queryer.can_read_globally?
       { all_orgs_visible: true }
     else
-      { visible_org_guids_query: permission_queryer.readable_org_guids_query }
+      { visible_org_ids_query: permission_queryer.readable_org_ids_query }
     end
   end
 end

app/controllers/v3/security_groups_controller.rb

@@ -18,7 +18,7 @@ def index
     dataset = if permission_queryer.can_read_globally?
                 SecurityGroupListFetcher.fetch_all(message)
               else
-                SecurityGroupListFetcher.fetch(message, permission_queryer.readable_security_group_guids_query)
+                SecurityGroupListFetcher.fetch(message, permission_queryer.readable_security_group_ids_query)
               end
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
@@ -31,7 +31,7 @@ def index
   end
 
   def show
-    security_group = SecurityGroupFetcher.fetch(hashed_params[:guid], permission_queryer.readable_security_group_guids_query)
+    security_group = SecurityGroupFetcher.fetch(hashed_params[:guid], permission_queryer.readable_security_group_ids_query)
     resource_not_found!(:security_group) unless security_group
 
     render status: :ok, json: Presenters::V3::SecurityGroupPresenter.new(

app/controllers/v3/spaces_controller.rb

@@ -106,8 +106,8 @@ def running_security_groups
     space = SpaceFetcher.new.fetch(hashed_params[:guid])
     space_not_found! unless space && permission_queryer.can_read_from_space?(space.id, space.organization_id)
 
-    unfiltered_group_guids = fetch_running_security_group_guids(space)
-    dataset = SecurityGroupListFetcher.fetch(message, unfiltered_group_guids)
+    unfiltered_group_ids = fetch_running_security_group_ids(space)
+    dataset = SecurityGroupListFetcher.fetch(message, unfiltered_group_ids)
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
       presenter: Presenters::V3::SecurityGroupPresenter,
@@ -125,8 +125,8 @@ def staging_security_groups
     space = SpaceFetcher.new.fetch(hashed_params[:guid])
     space_not_found! unless space && permission_queryer.can_read_from_space?(space.id, space.organization_id)
 
-    unfiltered_group_guids = fetch_staging_security_group_guids(space)
-    dataset = SecurityGroupListFetcher.fetch(message, unfiltered_group_guids)
+    unfiltered_group_ids = fetch_staging_security_group_ids(space)
+    dataset = SecurityGroupListFetcher.fetch(message, unfiltered_group_ids)
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
       presenter: Presenters::V3::SecurityGroupPresenter,
@@ -243,16 +243,16 @@ def fetch_isolation_segment(guid)
     IsolationSegmentModel.where(guid:).first
   end
 
-  def fetch_running_security_group_guids(space)
+  def fetch_running_security_group_ids(space)
     space_level_groups = SecurityGroup.where(spaces: space)
     global_groups = SecurityGroup.where(running_default: true)
-    space_level_groups.union(global_groups).select_map(:guid)
+    space_level_groups.union(global_groups).select_map(:id)
   end
 
-  def fetch_staging_security_group_guids(space)
+  def fetch_staging_security_group_ids(space)
     space_level_groups = SecurityGroup.where(staging_spaces: space)
     global_groups = SecurityGroup.where(staging_default: true)
-    space_level_groups.union(global_groups).distinct.select_map(:guid)
+    space_level_groups.union(global_groups).distinct.select_map(:id)
   end
 
   def space_not_found!

app/fetchers/domain_fetcher.rb

@@ -3,11 +3,11 @@
 module VCAP::CloudController
   class DomainFetcher < BaseListFetcher
     class << self
-      def fetch_all_for_orgs(readable_org_guids)
+      def fetch_all_for_orgs(readable_org_ids)
         # Q: The "Domain" in Domain.dataset is arbitrary -- just a way to get access to any database table.
         # If there's a way to use a more generic way to access the database, maybe this can be revised.
         #
-        readable_orgs_filter = Domain.dataset.db[:organizations].where(guid: readable_org_guids).select(:id)
+        readable_orgs_filter = Domain.dataset.db[:organizations].where(id: readable_org_ids).select(:id)
 
         readable_shared_private_domains_filter = Domain.dataset.db[:organizations_private_domains].where(
           organization_id: readable_orgs_filter
@@ -22,8 +22,8 @@ def fetch_all_for_orgs(readable_org_guids)
         Domain.where(user_visible_domains).qualify
       end
 
-      def fetch(message, readable_org_guids)
-        dataset = fetch_all_for_orgs(readable_org_guids)
+      def fetch(message, readable_org_ids)
+        dataset = fetch_all_for_orgs(readable_org_ids)
         filter(message, dataset)
       end
 

app/fetchers/isolation_segment_organizations_fetcher.rb

@@ -8,8 +8,8 @@ def fetch_all
       @isolation_segment.organizations
     end
 
-    def fetch_for_organizations(org_guids_query:)
-      Organization.where(guid: org_guids_query, isolation_segment_models: @isolation_segment).all
+    def fetch_for_organizations(org_ids_query:)
+      Organization.where(id: org_ids_query, isolation_segment_models: @isolation_segment).all
     end
   end
 end

app/fetchers/org_list_fetcher.rb

@@ -5,8 +5,8 @@
 module VCAP::CloudController
   class OrgListFetcher < BaseListFetcher
     class << self
-      def fetch(message:, guids:, eager_loaded_associations: [])
-        dataset = Organization.where(guid: guids)
+      def fetch(message:, ids:, eager_loaded_associations: [])
+        dataset = Organization.where(id: ids)
         dataset = eager_load(dataset, eager_loaded_associations)
         filter(message, dataset)
       end
@@ -17,11 +17,11 @@ def fetch_all(message:, eager_loaded_associations: [])
         filter(message, dataset)
       end
 
-      def fetch_for_isolation_segment(message:, guids:, eager_loaded_associations: [])
+      def fetch_for_isolation_segment(message:, ids:, eager_loaded_associations: [])
         isolation_segment = IsolationSegmentModel.where(guid: message.isolation_segment_guid).first
         return nil unless isolation_segment
 
-        dataset = isolation_segment.organizations_dataset.where(guid: guids)
+        dataset = isolation_segment.organizations_dataset.where(id: ids)
         dataset = eager_load(dataset, eager_loaded_associations)
         [isolation_segment, filter(message, dataset)]
       end

app/fetchers/organization_quota_list_fetcher.rb

@@ -5,9 +5,9 @@
 module VCAP::CloudController
   class OrganizationQuotaListFetcher < BaseListFetcher
     class << self
-      def fetch(message:, readable_org_guids_query:)
+      def fetch(message:, readable_org_ids_query:)
         dataset = QuotaDefinition.dataset
-        filter(message, dataset, readable_org_guids_query)
+        filter(message, dataset, readable_org_ids_query)
       end
 
       def fetch_all(message:)
@@ -17,7 +17,7 @@ def fetch_all(message:)
 
       private
 
-      def filter(message, dataset, readable_org_guids_query=nil)
+      def filter(message, dataset, readable_org_ids_query=nil)
         dataset = dataset.where(name: message.names) if message.requested? :names
 
         if message.requested? :organization_guids
@@ -26,7 +26,7 @@ def filter(message, dataset, readable_org_guids_query=nil)
                     where(organizations__guid: message.organization_guids).distinct(:id).
                     qualify(:quota_definitions)
 
-          dataset = dataset.where(organizations__guid: readable_org_guids_query) if readable_org_guids_query
+          dataset = dataset.where(organizations__id: readable_org_ids_query) if readable_org_ids_query
         end
 
         super(message, dataset, QuotaDefinition)