[v10.1.x] Search v1: Remove unnecessary subqueries (#72710)

Search v1: Remove unnecessary subqueries (#72388)

* Add feature flag

* Introduce interface and dummy implementation

* Add tests for the new filter

* accessControlDashboardPermissionFilterNoFolderSubquery implementation

* join only if it's necessary

* force ordering for tests

* Temporarily enable new query for benchmarks

(cherry picked from commit 2c26a02b82)

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>

pkg/services/sqlstore/permissions/dashboard.go

@@ -34,8 +34,19 @@ type accessControlDashboardPermissionFilter struct {
 	recursiveQueriesAreSupported bool
 }
 
+type PermissionsFilter interface {
+	LeftJoin() string
+	With() (string, []interface{})
+	Where() (string, []interface{})
+
+	buildClauses()
+	nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{})
+}
+
 // NewAccessControlDashboardPermissionFilter creates a new AccessControlDashboardPermissionFilter that is configured with specific actions calculated based on the dashboards.PermissionType and query type
-func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel dashboards.PermissionType, queryType string, features featuremgmt.FeatureToggles, recursiveQueriesAreSupported bool) *accessControlDashboardPermissionFilter {
+// The filter is configured to use the new permissions filter (without subqueries) if the feature flag is enabled
+// The filter is configured to use the old permissions filter (with subqueries) if the feature flag is disabled
+func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel dashboards.PermissionType, queryType string, features featuremgmt.FeatureToggles, recursiveQueriesAreSupported bool) PermissionsFilter {
 	needEdit := permissionLevel > dashboards.PERMISSION_VIEW
 
 	var folderActions []string
@@ -71,13 +82,25 @@ func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissi
 		}
 	}
 
-	f := accessControlDashboardPermissionFilter{user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
-		recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+	var f PermissionsFilter
+	if features.IsEnabled(featuremgmt.FlagPermissionsFilterRemoveSubquery) {
+		f = &accessControlDashboardPermissionFilterNoFolderSubquery{
+			accessControlDashboardPermissionFilter: accessControlDashboardPermissionFilter{
+				user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
+				recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+			},
+		}
+	} else {
+		f = &accessControlDashboardPermissionFilter{user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
+			recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+		}
 	}
-
 	f.buildClauses()
+	return f
+}
 
-	return &f
+func (f *accessControlDashboardPermissionFilter) LeftJoin() string {
+	return ""
 }
 
 // Where returns:
@@ -179,7 +202,7 @@ func (f *accessControlDashboardPermissionFilter) buildClauses() {
 						f.addRecQry(recQueryName, permSelector.String(), permSelectorArgs)
 						builder.WriteString(fmt.Sprintf("WHERE d.uid IN (SELECT uid FROM %s)", recQueryName))
 					default:
-						nestedFoldersSelectors, nestedFoldersArgs := nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "folder_id", "id")
+						nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.folder_id", "d.id")
 						builder.WriteRune('(')
 						builder.WriteString(nestedFoldersSelectors)
 						args = append(args, nestedFoldersArgs...)
@@ -251,7 +274,7 @@ func (f *accessControlDashboardPermissionFilter) buildClauses() {
 						builder.WriteString("(dashboard.uid IN ")
 						builder.WriteString(fmt.Sprintf("(SELECT uid FROM %s)", recQueryName))
 					default:
-						nestedFoldersSelectors, nestedFoldersArgs := nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "uid", "uid")
+						nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.uid", "d.uid")
 						builder.WriteRune('(')
 						builder.WriteString(nestedFoldersSelectors)
 						builder.WriteRune(')')
@@ -336,7 +359,7 @@ func actionsToCheck(actions []string, permissions map[string][]string, wildcards
 	return toCheck
 }
 
-func nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{}) {
+func (f *accessControlDashboardPermissionFilter) nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{}) {
 	wheres := make([]string, 0, folder.MaxNestedFolderDepth+1)
 	args := make([]interface{}, 0, len(permSelectorArgs)*(folder.MaxNestedFolderDepth+1))
 
@@ -351,7 +374,7 @@ func nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{},
 		s := fmt.Sprintf(tmpl, t, prev, onCol, t, prev, t)
 		joins = append(joins, s)
 
-		wheres = append(wheres, fmt.Sprintf("(dashboard.%s IN (SELECT d.%s FROM dashboard d %s WHERE %s.uid IN %s)", leftTableCol, rightTableCol, strings.Join(joins, " "), t, permSelector))
+		wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT %s FROM dashboard d %s WHERE %s.uid IN %s)", leftTableCol, rightTableCol, strings.Join(joins, " "), t, permSelector))
 		args = append(args, permSelectorArgs...)
 
 		prev = t

pkg/services/sqlstore/permissions/dashboard_filter_no_subquery.go

@@ -0,0 +1,244 @@
+package permissions
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/login"
+)
+
+type accessControlDashboardPermissionFilterNoFolderSubquery struct {
+	accessControlDashboardPermissionFilter
+
+	folderIsRequired bool
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) LeftJoin() string {
+	if !f.folderIsRequired {
+		return ""
+	}
+	return " dashboard AS folder ON dashboard.org_id = folder.org_id AND dashboard.folder_id = folder.id"
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) buildClauses() {
+	if f.user == nil || f.user.Permissions == nil || f.user.Permissions[f.user.OrgID] == nil {
+		f.where = clause{string: "(1 = 0)"}
+		return
+	}
+	dashWildcards := accesscontrol.WildcardsFromPrefix(dashboards.ScopeDashboardsPrefix)
+	folderWildcards := accesscontrol.WildcardsFromPrefix(dashboards.ScopeFoldersPrefix)
+
+	filter, params := accesscontrol.UserRolesFilter(f.user.OrgID, f.user.UserID, f.user.Teams, accesscontrol.GetOrgRoles(f.user))
+	rolesFilter := " AND role_id IN(SELECT id FROM role " + filter + ") "
+	var args []interface{}
+	builder := strings.Builder{}
+	builder.WriteRune('(')
+
+	permSelector := strings.Builder{}
+	var permSelectorArgs []interface{}
+
+	// useSelfContainedPermissions is true if the user's permissions are stored and set from the JWT token
+	// currently it's used for the extended JWT module (when the user is authenticated via a JWT token generated by Grafana)
+	useSelfContainedPermissions := f.user.AuthenticatedBy == login.ExtendedJWTModule
+
+	if len(f.dashboardActions) > 0 {
+		toCheck := actionsToCheck(f.dashboardActions, f.user.Permissions[f.user.OrgID], dashWildcards, folderWildcards)
+
+		if len(toCheck) > 0 {
+			if !useSelfContainedPermissions {
+				builder.WriteString("(dashboard.uid IN (SELECT substr(scope, 16) FROM permission WHERE scope LIKE 'dashboards:uid:%'")
+				builder.WriteString(rolesFilter)
+				args = append(args, params...)
+
+				if len(toCheck) == 1 {
+					builder.WriteString(" AND action = ?")
+					args = append(args, toCheck[0])
+				} else {
+					builder.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					args = append(args, toCheck...)
+					args = append(args, len(toCheck))
+				}
+				builder.WriteString(") AND NOT dashboard.is_folder)")
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				args = getAllowedUIDs(actions, f.user, dashboards.ScopeDashboardsPrefix)
+
+				// Only add the IN clause if we have any dashboards to check
+				if len(args) > 0 {
+					builder.WriteString("(dashboard.uid IN (?" + strings.Repeat(", ?", len(args)-1) + "")
+					builder.WriteString(") AND NOT dashboard.is_folder)")
+				} else {
+					builder.WriteString("(1 = 0)")
+				}
+			}
+
+			builder.WriteString(" OR ")
+
+			if !useSelfContainedPermissions {
+				permSelector.WriteString("(SELECT substr(scope, 13) FROM permission WHERE scope LIKE 'folders:uid:%' ")
+				permSelector.WriteString(rolesFilter)
+				permSelectorArgs = append(permSelectorArgs, params...)
+
+				if len(toCheck) == 1 {
+					permSelector.WriteString(" AND action = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck[0])
+				} else {
+					permSelector.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck...)
+					permSelectorArgs = append(permSelectorArgs, len(toCheck))
+				}
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				permSelectorArgs = getAllowedUIDs(actions, f.user, dashboards.ScopeFoldersPrefix)
+
+				// Only add the IN clause if we have any folders to check
+				if len(permSelectorArgs) > 0 {
+					permSelector.WriteString("(?" + strings.Repeat(", ?", len(permSelectorArgs)-1) + "")
+				} else {
+					permSelector.WriteString("(")
+				}
+			}
+
+			permSelector.WriteRune(')')
+
+			switch f.features.IsEnabled(featuremgmt.FlagNestedFolders) {
+			case true:
+				if len(permSelectorArgs) > 0 {
+					switch f.recursiveQueriesAreSupported {
+					case true:
+						recQueryName := fmt.Sprintf("RecQry%d", len(f.recQueries))
+						f.addRecQry(recQueryName, permSelector.String(), permSelectorArgs)
+						builder.WriteString("(folder.uid IN (SELECT uid FROM " + recQueryName)
+					default:
+						nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "folder.uid", "")
+						builder.WriteRune('(')
+						builder.WriteString(nestedFoldersSelectors)
+						args = append(args, nestedFoldersArgs...)
+					}
+					f.folderIsRequired = true
+					builder.WriteString(") AND NOT dashboard.is_folder)")
+				} else {
+					builder.WriteString("( 1 = 0 AND NOT dashboard.is_folder)")
+				}
+			default:
+				builder.WriteString("(")
+				if len(permSelectorArgs) > 0 {
+					builder.WriteString("folder.uid IN ")
+					builder.WriteString(permSelector.String())
+					args = append(args, permSelectorArgs...)
+					f.folderIsRequired = true
+				} else {
+					builder.WriteString("1 = 0 ")
+				}
+				builder.WriteString(" AND NOT dashboard.is_folder)")
+			}
+		} else {
+			builder.WriteString("NOT dashboard.is_folder")
+		}
+	}
+
+	// recycle and reuse
+	permSelector.Reset()
+	permSelectorArgs = permSelectorArgs[:0]
+
+	if len(f.folderActions) > 0 {
+		if len(f.dashboardActions) > 0 {
+			builder.WriteString(" OR ")
+		}
+
+		toCheck := actionsToCheck(f.folderActions, f.user.Permissions[f.user.OrgID], folderWildcards)
+		if len(toCheck) > 0 {
+			if !useSelfContainedPermissions {
+				permSelector.WriteString("(SELECT substr(scope, 13) FROM permission WHERE scope LIKE 'folders:uid:%'")
+				permSelector.WriteString(rolesFilter)
+				permSelectorArgs = append(permSelectorArgs, params...)
+				if len(toCheck) == 1 {
+					permSelector.WriteString(" AND action = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck[0])
+				} else {
+					permSelector.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck...)
+					permSelectorArgs = append(permSelectorArgs, len(toCheck))
+				}
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				permSelectorArgs = getAllowedUIDs(actions, f.user, dashboards.ScopeFoldersPrefix)
+
+				if len(permSelectorArgs) > 0 {
+					permSelector.WriteString("(?" + strings.Repeat(", ?", len(permSelectorArgs)-1) + "")
+				} else {
+					permSelector.WriteString("(")
+				}
+			}
+			permSelector.WriteRune(')')
+
+			switch f.features.IsEnabled(featuremgmt.FlagNestedFolders) {
+			case true:
+				if len(permSelectorArgs) > 0 {
+					switch f.recursiveQueriesAreSupported {
+					case true:
+						recQueryName := fmt.Sprintf("RecQry%d", len(f.recQueries))
+						f.addRecQry(recQueryName, permSelector.String(), permSelectorArgs)
+						builder.WriteString("(dashboard.uid IN ")
+						builder.WriteString(fmt.Sprintf("(SELECT uid FROM %s)", recQueryName))
+					default:
+						nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.uid", "")
+						builder.WriteRune('(')
+						builder.WriteString(nestedFoldersSelectors)
+						builder.WriteRune(')')
+						args = append(args, nestedFoldersArgs...)
+					}
+				} else {
+					builder.WriteString("(1 = 0")
+				}
+			default:
+				if len(permSelectorArgs) > 0 {
+					builder.WriteString("(dashboard.uid IN ")
+					builder.WriteString(permSelector.String())
+					args = append(args, permSelectorArgs...)
+				} else {
+					builder.WriteString("(1 = 0")
+				}
+			}
+			builder.WriteString(" AND dashboard.is_folder)")
+		} else {
+			builder.WriteString("dashboard.is_folder")
+		}
+	}
+	builder.WriteRune(')')
+
+	f.where = clause{string: builder.String(), params: args}
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, _ string) (string, []interface{}) {
+	wheres := make([]string, 0, folder.MaxNestedFolderDepth+1)
+	args := make([]interface{}, 0, len(permSelectorArgs)*(folder.MaxNestedFolderDepth+1))
+
+	joins := make([]string, 0, folder.MaxNestedFolderDepth+2)
+
+	tmpl := "INNER JOIN folder %s ON %s.parent_uid = %s.uid AND %s.org_id = %s.org_id "
+
+	wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT f1.uid FROM folder f1 WHERE f1.uid IN %s)", leftTableCol, permSelector))
+	args = append(args, permSelectorArgs...)
+
+	prev := "f1"
+	for i := 2; i <= folder.MaxNestedFolderDepth+2; i++ {
+		t := fmt.Sprintf("f%d", i)
+		s := fmt.Sprintf(tmpl, t, prev, t, prev, t)
+		joins = append(joins, s)
+
+		wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT f1.uid FROM folder f1 %s WHERE %s.uid IN %s)", leftTableCol, strings.Join(joins, " "), t, permSelector))
+		args = append(args, permSelectorArgs...)
+
+		prev = t
+	}
+
+	return strings.Join(wheres, ") OR "), args
+}

pkg/services/sqlstore/permissions/dashboard_test.go

@@ -3,6 +3,7 @@ package permissions_test
 import (
 	"context"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -162,26 +163,39 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.desc, func(t *testing.T) {
-			store := setupTest(t, 10, 100, tt.permissions)
-			recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
+		store := setupTest(t, 10, 100, tt.permissions)
+		recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
+		require.NoError(t, err)
 
-			usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, featuremgmt.WithFeatures(), recursiveQueriesAreSupported)
+		usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}
 
-			var result int
-			err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				_, err := sess.SQL(recQry+"\nSELECT COUNT(*) FROM dashboard WHERE "+q, params...).Get(&result)
-				return err
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(), featuremgmt.WithFeatures(featuremgmt.FlagPermissionsFilterRemoveSubquery)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+			t.Run(tt.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, features, recursiveQueriesAreSupported)
+
+				var result int
+				err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					leftJoin := filter.LeftJoin()
+					s := recQry + "\nSELECT COUNT(*) FROM dashboard WHERE " + q
+					if leftJoin != "" {
+						s = recQry + "\nSELECT COUNT(*) FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q
+					}
+					_, err := sess.SQL(s, params...).Get(&result)
+					return err
+				})
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.expectedResult, result)
 			})
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.expectedResult, result)
-		})
+		}
 	}
 }
 
@@ -323,26 +337,39 @@ func TestIntegration_DashboardPermissionFilter_WithSelfContainedPermissions(t *t
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.desc, func(t *testing.T) {
-			store := setupTest(t, 10, 100, []accesscontrol.Permission{})
-			recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
+		store := setupTest(t, 10, 100, []accesscontrol.Permission{})
+		recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
+		require.NoError(t, err)
 
-			usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.signedInUserPermissions)}}
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, featuremgmt.WithFeatures(), recursiveQueriesAreSupported)
+		usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.signedInUserPermissions)}}
 
-			var result int
-			err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				_, err := sess.SQL(recQry+"\nSELECT COUNT(*) FROM dashboard WHERE "+q, params...).Get(&result)
-				return err
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(), featuremgmt.WithFeatures(featuremgmt.FlagPermissionsFilterRemoveSubquery)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+			t.Run(tt.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, features, recursiveQueriesAreSupported)
+
+				var result int
+				err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT COUNT(*) FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT COUNT(*) FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q
+					}
+					_, err := sess.SQL(s, params...).Get(&result)
+					return err
+				})
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.expectedResult, result)
 			})
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.expectedResult, result)
-		})
+		}
 	}
 }
 
@@ -353,14 +380,14 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 		permission     dashboards.PermissionType
 		permissions    []accesscontrol.Permission
 		expectedResult []string
-		features       featuremgmt.FeatureToggles
+		features       []interface{}
 	}{
 		{
 			desc:           "Should not be able to view dashboards under inherited folders with no permissions if nested folders are enabled",
 			queryType:      searchstore.TypeDashboard,
 			permission:     dashboards.PERMISSION_VIEW,
 			permissions:    nil,
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: nil,
 		},
 		{
@@ -368,14 +395,14 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			queryType:      searchstore.TypeFolder,
 			permission:     dashboards.PERMISSION_VIEW,
 			permissions:    nil,
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: nil,
 		},
 		{
 			desc:           "Should not be able to view inherited dashboards and folders with no permissions if nested folders are enabled",
 			permission:     dashboards.PERMISSION_VIEW,
 			permissions:    nil,
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: nil,
 		},
 		{
@@ -385,7 +412,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: dashboards.ScopeFoldersAll},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -395,7 +422,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -405,7 +432,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"dashboard under parent folder"},
 		},
 		{
@@ -415,7 +442,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder"},
 		},
 		{
@@ -425,7 +452,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent"},
 		},
 		{
@@ -435,7 +462,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -445,7 +472,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent", "dashboard under parent folder"},
 		},
 	}
@@ -459,29 +486,43 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 	var orgID int64 = 1
 
 	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			tc.permissions = append(tc.permissions, accesscontrol.Permission{
-				Action: dashboards.ActionFoldersCreate,
-			}, accesscontrol.Permission{
-				Action: dashboards.ActionFoldersWrite,
-				Scope:  dashboards.ScopeFoldersAll,
-			})
-			usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.permissions)}}
-			db := setupNestedTest(t, usr, tc.permissions, orgID, tc.features)
-			recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, tc.features, recursiveQueriesAreSupported)
-			var result []string
-			err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				err := sess.SQL(recQry+"\nSELECT title FROM dashboard WHERE "+q, params...).Find(&result)
-				return err
-			})
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
+		tc.permissions = append(tc.permissions, accesscontrol.Permission{
+			Action: dashboards.ActionFoldersCreate,
+		}, accesscontrol.Permission{
+			Action: dashboards.ActionFoldersWrite,
+			Scope:  dashboards.ScopeFoldersAll,
 		})
+		usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.permissions)}}
+
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(tc.features...), featuremgmt.WithFeatures(append(tc.features, featuremgmt.FlagPermissionsFilterRemoveSubquery)...)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+
+			t.Run(tc.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				db := setupNestedTest(t, usr, tc.permissions, orgID, features)
+				recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
+				require.NoError(t, err)
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, features, recursiveQueriesAreSupported)
+				var result []string
+				err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT dashboard.title FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT dashboard.title FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q + "ORDER BY dashboard.id ASC"
+					}
+					err := sess.SQL(s, params...).Find(&result)
+					return err
+				})
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedResult, result)
+			})
+		}
 	}
 }
 
@@ -492,14 +533,14 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 		permission              dashboards.PermissionType
 		signedInUserPermissions []accesscontrol.Permission
 		expectedResult          []string
-		features                featuremgmt.FeatureToggles
+		features                []interface{}
 	}{
 		{
 			desc:                    "Should not be able to view dashboards under inherited folders with no permissions if nested folders are enabled",
 			queryType:               searchstore.TypeDashboard,
 			permission:              dashboards.PERMISSION_VIEW,
 			signedInUserPermissions: nil,
-			features:                featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:                []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult:          nil,
 		},
 		{
@@ -507,14 +548,14 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			queryType:               searchstore.TypeFolder,
 			permission:              dashboards.PERMISSION_VIEW,
 			signedInUserPermissions: nil,
-			features:                featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:                []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult:          nil,
 		},
 		{
 			desc:                    "Should not be able to view inherited dashboards and folders with no permissions if nested folders are enabled",
 			permission:              dashboards.PERMISSION_VIEW,
 			signedInUserPermissions: nil,
-			features:                featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:                []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult:          nil,
 		},
 		{
@@ -524,7 +565,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: dashboards.ScopeFoldersAll},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -534,7 +575,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -544,7 +585,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"dashboard under parent folder"},
 		},
 		{
@@ -554,7 +595,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder"},
 		},
 		{
@@ -564,7 +605,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent"},
 		},
 		{
@@ -574,7 +615,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -584,7 +625,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent", "dashboard under parent folder"},
 		},
 		{
@@ -598,7 +639,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsWrite, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 	}
@@ -612,35 +653,48 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 	var orgID int64 = 1
 
 	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			helperUser := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule,
-				Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction([]accesscontrol.Permission{
-					{
-						Action: dashboards.ActionFoldersCreate,
-					},
-					{
-						Action: dashboards.ActionFoldersWrite,
-						Scope:  dashboards.ScopeFoldersAll,
-					},
-				}),
+		helperUser := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule,
+			Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction([]accesscontrol.Permission{
+				{
+					Action: dashboards.ActionFoldersCreate,
 				},
+				{
+					Action: dashboards.ActionFoldersWrite,
+					Scope:  dashboards.ScopeFoldersAll,
+				},
+			}),
+			},
+		}
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(tc.features...), featuremgmt.WithFeatures(append(tc.features, featuremgmt.FlagPermissionsFilterRemoveSubquery)...)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
 			}
-			usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.signedInUserPermissions)}}
-			db := setupNestedTest(t, helperUser, []accesscontrol.Permission{}, orgID, tc.features)
-			recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, tc.features, recursiveQueriesAreSupported)
-			var result []string
-			err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				err := sess.SQL(recQry+"\nSELECT title FROM dashboard WHERE "+q, params...).Find(&result)
-				return err
+
+			t.Run(tc.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.signedInUserPermissions)}}
+				db := setupNestedTest(t, helperUser, []accesscontrol.Permission{}, orgID, features)
+				recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
+				require.NoError(t, err)
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, features, recursiveQueriesAreSupported)
+				var result []string
+				err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT dashboard.title FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT dashboard.title FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q + " ORDER BY dashboard.id ASC"
+					}
+					err := sess.SQL(s, params...).Find(&result)
+					return err
+				})
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedResult, result)
 			})
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
-		})
+		}
 	}
 }