keycloak/server-spi
Alexey Skosyrskiy 56cdb6b8ef Optimize composite client role mappings endpoint and migrate test
Pre-compute the full effective role set once in
ClientRoleMappingsResource.getCompositeClientRoleMappings() using
RoleUtils.getDeepRoleMappings(), then filter by client. This replaces
the previous O(C*M*D) approach of calling user.hasRole() for every
client role, which recursively expanded composites without memoization.

RoleUtils.getDeepRoleMappings(RoleMapperModel) is introduced to handle
both RoleMapperModel implementations correctly: UserModel includes
group-inherited roles (matching UserModel.hasRole() semantics), while
GroupModel expands only its direct composite mappings.

The CompositeClientRoleMappingsTest is migrated from the deprecated
Arquillian framework to the new Keycloak test framework (JUnit 5).

Signed-off-by: Alexey Skosyrskiy <askosyrskiy@metropolis.io>
2026-03-25 17:24:16 -03:00
..
src Optimize composite client role mappings endpoint and migrate test 2026-03-25 17:24:16 -03:00
pom.xml Add missing artifact descriptions to allow Maven Central Portal Publisher pass validation process. (#40822) 2025-08-12 16:50:17 +02:00