[brandonkelly]

Summary

 UserPermissions::doesUserHavePermission($userId, $permission)
-  in_array(strtolower($permission), $permissionsByUserId[$userId])   // O(n) per check
+  isset($permissionMapsByUserId[$userId][strtolower($permission)])   // O(1) per check

Users' cached permission lists now have a map alongside them for lookups. The map is rebuilt whenever the list is cached (getPermissionsByUserId(), saveUserPermissions()) and cleared by reset().

Evidence

Per-lookup cost (doesUserHavePermission(), mean of 20,000 lookups, half hits):

User’s permissions	Before	After
200	0.89 µs	0.14 µs
2,000	7.09 µs	0.13 µs
8,600	25.3 µs	0.14 µs

Semi-complex site (PostgreSQL, production mode, GraphQL caching off; median of 11–15 fresh processes):

• 3 sites, 112 fields (86 simple, 20 relation, 6 Matrix), 72 entry types
• 30 sections (18 channels, 8 structures, 4 singles), 6 volumes, 5 category groups, 2 tag groups, 4 global sets
• 6 user groups; the “Editors” group, whose permissions the benchmark user has, holds 197 permissions across two-thirds of the sections, plus all volumes, categories and globals
• 304 entries

Scenario	Before	After
Entry index authorization for an editor (sources + canView/Save/Delete/Duplicate/CreateDrafts × 100 entries)	119.3 ms	115.9 ms
GraphQL entries(limit: 20)	405.2 ms	409.7 ms
Building an authenticated GraphQL schema for the editor (#20147)	65.4 ms	67.9 ms

At this scale, permission lookups aren't the bottleneck; the differences are within noise. The gains appear with thousands of permissions. In a mocked test with 1,000 sections and 200 volumes (8,600 permissions), the authenticated schema build went from 118 ms to 20 ms.

Regression test: UserPermissionsTest::testDoesUserHavePermission now also checks that lookups are case-insensitive and that reset() drops cached permissions. It fails if reset() doesn't clear the new map.

Related issues

• Slow GraphQL queries on larger schemas #8035 and Very slow GraphQl queries (5-50+seconds) #9830: GraphQL requests get slower as the content model grows. Profiling the site above shows most of a { ping } request (~390 ms) goes to building the schema definition (Schema::getTypeMap() → FieldArgument::createMap), not to permission checks. With lazyGqlTypes enabled it drops to ~140 ms.