Major The ProfileBasedRightsManager API doesn't define any update(Profile) method, as the GroupsManager API does.
Adding rights to a profile is therefore delegated to the Profile.addRight method, which adds rights one by one.
When profiles are stored in a database (i.e. 100% of cases), adding one right to a profile which already contains 50 makes 52 JDBC queries: one DELETE (call to removeRights), and one INSERT per right (calls to addRight), both old and new.
Not only does this poses a performance problem (which leads to a wait message being required - RUNTIME-739) but this could lead to an integrity issue.
Two solutions:
- Minor rewrite of the API, adding beginUpdate() and endUpdate() to the Profile interface, which would start/commit a transaction.
- Major rewrite of the API, to be coherent with the GroupsManager way of doing things: a Profile is a class (bean) and not an interface, and it's the ProfileBasedRightsManager responsibility to update and remove it (update and remove methods similar to GroupsManager's methods).
Resolved with the first solution, to limit API changes.
The second solution may be considered in the future, to clean up the API.