How can I use a gremlin query to filter based on a users permissions?

Question

I am fairly new to graph databases, however I have used SQL Server and document databases (Lucene, DocumentDb, etc.) extensively. It's completely possible that I am approaching this query the wrong way, since I am new to graph databases. I am trying to convert some logic to a graph database (CosmosDB Graph via Gremlins to be specific) that we currently are using SQL Server for. The reason for the change is that this problem set is not really what SQL Server is great at and so our SQL query (which we have optimized as good as we can) is really starting to be the hot spot of our application.

To give a very brief overview of our logic, we run a web shop that allows admins to configure products and users with several levels of granular permissions (described below). Based on these permissions, we show the user only the products they are allowed to see.

Entities:

• Region: A region consists of multiple countries
• Country: A country has many markets and many regions
• Market: A market is a group of stores in a single country
• Store: A store is belongs to a single market

Users have the following set of permissions and each set can contain multiple values:

• can-view-region
• can-view-country
• can-view-market
• can-view-store

Products have the following set of permissions and each set can contain multiple values:

• visible-to-region
• visible-to-country
• visible-to-market
• visible-to-store

After trying for a few days, this is the query that I have come up with. This query does work and returns the correct products for the given user, however it takes about 25 seconds to execute.

g.V().has('user','username', 'john.doe').union(
    __.out('can-view-region').out('contains-country').in('in-market').hasLabel('store'),
    __.out('can-view-country').in('in-market').hasLabel('store'),
    __.out('can-view-market').in('in-market').hasLabel('store'),
    __.out('can-view-store')
).dedup().union(
    __.out('in-market').in('contains-country').in('visible-to-region').hasLabel('product'),
    __.out('in-market').in('visible-to-country').hasLabel('product'),
    __.out('in-market').in('visible-to-market').hasLabel('product'),
    __.in('visible-to-store').hasLabel('product')
).dedup()

Is there a better way to do this? Is this problem maybe not best suited with a graph database?

Any help would be greatly appreciated!

Thanks, Chris

Answer 1

I don't think this is going to help a lot, but here's an improved version of your query:

g.V().has('user','username', 'john.doe').union(
    __.out('can-view-region').out('contains-country').in('in-market').hasLabel('store'),
    __.out('can-view-country','can-view-market').in('in-market').hasLabel('store'),
    __.out('can-view-store')
).dedup().union(
    __.out('in-market').union(
      __.in('contains-country').in('visible-to-region'),
      __.in('visible-to-country','visible-to-market')).hasLabel('product'),
    __.in('visible-to-store').hasLabel('product')
).dedup()

I wonder if the hasLabel() checks are really necessary. If, for example, .in('in-market') can only lead a store vertex, then remove the extra check.

Furthermore it might be worth to create shortcut edges. This would increase write times whenever you mutate the permissions, but should significantly increase the read times for the given query. Since the reads are likely to occur way more often than permission updates, this might be a good trade-off.

Answer 2

CosmosDB Graph team is looking into improvements that can done on union step in particular.

Other options that haven't already been suggested:

1. Reduce the number of edges that are traversed per hop with additional predicates. e.g: g.V('1').outE('market').has('prop', 'value').inV()

2. Would it be possible to split the traversal up and do parallel request in your client code? Since you are using .NET, you could take each result in first union, and execute parallel requests for the traversals in the second union. Something like this (untested code):

   string firstUnion = @"g.V().has('user','username', 'john.doe').union(
       __.out('can-view-region').out('contains-country').in('in-market').hasLabel('store'),
       __.out('can-view-country').in('in-market').hasLabel('store'),
       __.out('can-view-market').in('in-market').hasLabel('store'),
       __.out('can-view-store')
   ).dedup()"
   
   string[] secondUnionTraversals = new[] {
       "g.V({0}).out('in-market').in('contains-country').in('visible-to-region').hasLabel('product')",
       "g.V({0}).out('in-market').in('visible-to-country').hasLabel('product')",
       "g.V({0}).out('in-market').in('visible-to-market').hasLabel('product')",
       "g.V({0}).in('visible-to-store').hasLabel('product')",
   };
   
   var response = client.CreateGremlinQuery(col, firstUnion);
   while (response.HasMoreResults)
   {
       var results = await response.ExecuteNextAsync<Vertex>();
       foreach (Vertex v in results)
       {
           Parallel.ForEach(secondUnionTraversals, (traversal) =>
           {
               var secondResponse = client.CreateGremlinQuery<Vertex>(col, string.Format(traversal, v.Id));
               while (secondResponse.HasMoreResults)
               {
                   concurrentColl.Add(secondResponse);
               }
           });
       }
   }