Skip to content

Performance Boost: Optimize RLS Delete Engine to Run Atomically #218

@yash-pouranik

Description

@yash-pouranik

Description

Inside our security parsing framework (authorizeWriteOperation.js), verifying resource authorship for data alterations (like DELETE and PUT methods) requires pulling down the active file resource first. While this design layout works safely, it doubles our database server load by executing two round-trip database requests for every single deletion operation.

Expected Behavior

Instead of pulling document objects into runtime memory stacks to parse authorization keys, ownership checks should be integrated directly into the primary MongoDB query context filter dynamically.

Technical Implementation Checklist

  • Refactor the deleteSingleDoc endpoint pipeline to accept inline database parameters.
  • Construct a uniform query definition object: const deleteFilter = { _id: id };
  • Intercept collection flags. If req.currentCollectionMeta.isRlsEnabled resolves to true, extract the targeted identifier payload (ownerField) and map it straight into the filter layout:
    const ownerField = req.currentCollectionMeta.ownerField || 'ownerId';
    deleteFilter[ownerField] = req.authUserId;
  • Fire an atomic execution call: const result = await TargetModel.deleteOne(deleteFilter);
  • Evaluate the operational metrics data loop. If result.deletedCount === 0, return a structured error response: 404 Not Found or unauthorized.

Technology Stack

  • Node.js, Express, Mongoose / MongoDB Atlas

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions