perf(grpc): O(1) unconstrained bulk fast path, direct filtered-command build, cache eviction, capacity hints

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/ConstraintEnforcer.cs

@@ -16,6 +16,14 @@ public sealed class ConstraintEnforcer(
     IGalaxyHierarchyCache cache,
     IAuditWriter auditWriter) : IConstraintEnforcer
 {
+    /// <inheritdoc />
+    public bool HasReadConstraints(ApiKeyIdentity? identity) =>
+        identity?.EffectiveConstraints.HasReadConstraints ?? false;
+
+    /// <inheritdoc />
+    public bool HasWriteConstraints(ApiKeyIdentity? identity) =>
+        identity?.EffectiveConstraints.HasWriteConstraints ?? false;
+
     /// <inheritdoc />
     public Task<ConstraintFailure?> CheckReadTagAsync(
         ApiKeyIdentity? identity,
@@ -211,7 +219,25 @@ public sealed class ConstraintEnforcer(
             return true;
         }
 
-        return subtreeGlobs.Any(glob => GalaxyGlobMatcher.IsMatch(containedPath, glob))
-            || tagGlobs.Any(glob => GalaxyGlobMatcher.IsMatch(tagAddress, glob));
+        // Plain index loops rather than Any(lambda): this runs once per item of every bulk
+        // read/write, and the closures the lambdas capture (containedPath / tagAddress) allocate a
+        // display class plus a delegate per call. Same short-circuit order, same result.
+        for (int i = 0; i < subtreeGlobs.Count; i++)
+        {
+            if (GalaxyGlobMatcher.IsMatch(containedPath, subtreeGlobs[i]))
+            {
+                return true;
+            }
+        }
+
+        for (int i = 0; i < tagGlobs.Count; i++)
+        {
+            if (GalaxyGlobMatcher.IsMatch(tagAddress, tagGlobs[i]))
+            {
+                return true;
+            }
+        }
+
+        return false;
     }
 }

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/IConstraintEnforcer.cs

@@ -5,6 +5,30 @@ namespace ZB.MOM.WW.MxGateway.Server.Security.Authorization;
 
 public interface IConstraintEnforcer
 {
+    /// <summary>
+    ///     Gets a value indicating whether any read constraint applies to an identity at all, so a
+    ///     bulk caller can hoist the question out of its per-item loop.
+    /// </summary>
+    /// <param name="identity">The API key identity.</param>
+    /// <returns><see langword="true"/> when at least one read constraint applies; otherwise <see langword="false"/>.</returns>
+    /// <remarks>
+    ///     Every per-item <see cref="CheckReadTagAsync"/> / <see cref="CheckReadHandleAsync"/> call for
+    ///     an unconstrained identity allows the item, so skipping the loop removes work without
+    ///     changing a decision. The default implementation answers <see langword="true"/> — an
+    ///     implementation that does not model constraints (test doubles, allow-all enforcers) keeps
+    ///     being consulted per item rather than being silently bypassed.
+    /// </remarks>
+    bool HasReadConstraints(ApiKeyIdentity? identity) => true;
+
+    /// <summary>
+    ///     Gets a value indicating whether any write constraint applies to an identity at all, the
+    ///     write-side counterpart of <see cref="HasReadConstraints"/>.
+    /// </summary>
+    /// <param name="identity">The API key identity.</param>
+    /// <returns><see langword="true"/> when at least one write constraint applies; otherwise <see langword="false"/>.</returns>
+    /// <remarks>The same conservative default as <see cref="HasReadConstraints"/> applies.</remarks>
+    bool HasWriteConstraints(ApiKeyIdentity? identity) => true;
+
     /// <summary>Checks whether a read constraint is satisfied for a tag address.</summary>
     /// <param name="identity">The API key identity.</param>
     /// <param name="tagAddress">Tag address to check.</param>