perf(panel): kill per-request full-database clones (item 22, backend)

Data.Clone() was a full JSON marshal/unmarshal round trip (with a per-record map dance for unknown fields): 6.3ms and ~13.8k allocs per call on sandbox hardware, and every admin GET paid it at least twice (RequireAdmin's user lookup + the handler). Clone is now a reflective deep copy of the plain data graph — byte-identical output, proven against the JSON clone on the real seed database by TestCloneEquivalence — at 0.37ms / 538 allocs. CurrentAdmin resolves the session user under a read-only store View and no longer clones at all, so an admin GET takes exactly one snapshot. Sandbox benchmarks (11 servers / 26 customers / 25 nodes): overview 17.2ms -> 0.38ms, servers 13.3 -> 0.85ms, customers 20.5 -> 1.54ms, nodes 15.8 -> 3.45ms, jobs 13.0 -> 0.39ms per request.
2026-10-21 10:50:00 +00:00
parent 0ab31ae32c
commit 05366d9177
5 changed files with 302 additions and 10 deletions
@@ -0,0 +1,107 @@
+package main
+
+// Benchmarks for round-3 item 22 (per-request full-clone cost). Not run
+// by `go test` without -bench. The seed is synthetic data at production
+// scale (~11 servers / 26 customers / 25 nodes / ~100 bindings).
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func perfSeedData() *Data {
+	d := EmptyData()
+	d.Users = []*User{{ID: "usr_1", Username: "admin", PasswordHash: "x", Role: "owner", Status: "active", CreatedAt: NowISO()}}
+	for i := 0; i < 11; i++ {
+		d.Servers = append(d.Servers, &Server{
+			ID: fmt.Sprintf("srv_%d", i), Name: fmt.Sprintf("S%d", i), PublicAddress: "203.0.113.1",
+			Status: "online", LastSeenAt: StrPtr(NowISO()), PortRangeStart: 20000, PortRangeEnd: 50000,
+			Labels: []string{}, CreatedAt: NowISO(), UpdatedAt: NowISO(),
+		})
+	}
+	for i := 0; i < 26; i++ {
+		d.Customers = append(d.Customers, &Customer{
+			ID: fmt.Sprintf("cus_%d", i), Name: fmt.Sprintf("C%d", i), Status: "active",
+			SubscriptionToken: fmt.Sprintf("tok-%032d", i),
+			Credentials:       &Credentials{ClientID: NewUUID(), RelayPassword: "FRYXGBkaGxwdHh8gISIjJA==", ShortID: "abcd0001"},
+			Tags:              []string{}, CreatedAt: NowISO(), UpdatedAt: NowISO(),
+		})
+	}
+	protocols := []string{"vless-reality-vision", "shadowsocks-2022-aes128", "socks5-auth", "vless-ws", "hysteria2"}
+	for i := 0; i < 25; i++ {
+		node := &Node{
+			ID: fmt.Sprintf("nod_%d", i), Name: fmt.Sprintf("N%d", i), ServerID: fmt.Sprintf("srv_%d", i%11),
+			Protocol: protocols[i%len(protocols)], Topology: "direct", NetworkMode: "ipv4", Port: 23000 + i,
+			Status: "active", ResourceID: fmt.Sprintf("res_%d", i), Artifacts: map[string]json.RawMessage{},
+		}
+		if node.Protocol == "socks5-auth" {
+			node.SocksUser, node.SocksPassword = "ngs_fixed", "fixedpass"
+		}
+		if IsRealityProtocol(node.Protocol) {
+			node.Reality = &RealityConfig{KeyID: fmt.Sprintf("reality-nod_%d", i), ServerName: "www.tesla.com", DestPort: 443}
+		}
+		d.Nodes = append(d.Nodes, node)
+		for j := 0; j < 4; j++ {
+			d.NodeClients = append(d.NodeClients, &NodeClient{
+				ID: fmt.Sprintf("nc_%d_%d", i, j), NodeID: node.ID,
+				CustomerID: fmt.Sprintf("cus_%d", (i+j)%26), Status: "active",
+				CreatedAt: NowISO(), UpdatedAt: NowISO(),
+			})
+		}
+	}
+	return d
+}
+
+func BenchmarkCloneJSONRoundTrip(b *testing.B) {
+	d := perfSeedData()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = d.cloneViaJSON()
+	}
+}
+
+func BenchmarkCloneFast(b *testing.B) {
+	d := perfSeedData()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = d.Clone()
+	}
+}
+
+func BenchmarkAdminGET(b *testing.B) {
+	cookieSecure = false
+	store := NewStore(filepath.Join(b.TempDir(), "nexusgate.json"))
+	if err := store.Init(); err != nil {
+		b.Fatal(err)
+	}
+	seed := perfSeedData()
+	seed.Users[0].PasswordHash = HashSecret("password12345")
+	if _, err := store.Transaction(func(d *Data) (any, error) { *d = *seed; return nil, nil }); err != nil {
+		b.Fatal(err)
+	}
+	app := NewApp(store, NewSessionManager(12), NewOrchestrator(store))
+	login := httptest.NewRequest("POST", "/api/auth/login", strings.NewReader(`{"username":"admin","password":"password12345"}`))
+	rec := httptest.NewRecorder()
+	app.ServeHTTP(rec, login)
+	if rec.Code != 200 {
+		b.Fatalf("login %d", rec.Code)
+	}
+	cookie := strings.Split(rec.Header().Get("Set-Cookie"), ";")[0]
+	for _, path := range []string{"/api/overview", "/api/servers", "/api/customers", "/api/nodes", "/api/jobs"} {
+		b.Run(strings.TrimPrefix(path, "/api/"), func(b *testing.B) {
+			for i := 0; i < b.N; i++ {
+				req := httptest.NewRequest("GET", path, nil)
+				req.Header.Set("Cookie", cookie)
+				rec := httptest.NewRecorder()
+				app.ServeHTTP(rec, req)
+				if rec.Code != 200 {
+					b.Fatalf("%s -> %d", path, rec.Code)
+				}
+			}
+		})
+	}
+}