Repository navigation
perf(api): fewer D1 round trips per admin request - #68
Merged
Merged
Conversation
A signed-in admin API call made about five serial D1 round trips before and inside its handler, and Studio fires 10–13 calls per screen into a database that serves one query at a time. - Better Auth `session.cookieCache` (maxAge 60 s): the session is read from a signed cookie instead of D1. A session revoked elsewhere stays usable for up to 60 s; membership and roles still apply at once (ADR-0010 addendum). - `staffStore.member`: the member and their site roles in one query. - The auth rate limiter (stored in D1) no longer runs on `/get-session`. - Due comment purges are swept at most every 10 s per isolate instead of on every admin request. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Madraka <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix 4 of the internal performance review (admin API).
Measured on studio.cloudhal.com: 180–380 ms per admin call alone, 700–1200 ms when a screen fires its 10–13 calls together. Each signed-in call made about 5 serial D1 round trips (session, membership ×2,
getSite, data), and D1 serves one query at a time per database.auth/instance.ts):session.cookieCache: { enabled: true, maxAge: 60 }. The session comes from a signed cookie, not D1. Trade-off accepted by the maintainer and recorded as an ADR-0010 addendum: a session revoked from another device stays usable for up to 60 s. The person's own sign-out clears the cookie at once, Better Auth's sensitive endpoints bypass the cache, and membership and roles are still read every request, so removals and role changes apply at once.staff.tsmember):LEFT JOIN site_members; the now unusedsiteRolesOfis removed.customRules: { "/get-session": false }. The limiter stores in D1, so it added a read and a write to every session check; every other auth endpoint stays limited.commentsSweepDue) instead of on every admin request; moderation still wakes its own targeted flush.Tests:
@cloudhal/api371/371,@cloudhal/cloudflare(workerd) 53/53.🤖 Generated with Claude Code