Search v1: Remove unnecessary subqueries (#72388)

* Add feature flag * Introduce interface and dummy implementation * Add tests for the new filter * accessControlDashboardPermissionFilterNoFolderSubquery implementation * join only if it's necessary * force ordering for tests * Temporarily enable new query for benchmarks
2025-02-25 18:55:37 -06:00 · 2023-08-02 10:39:25 +03:00
parent 4ad7aed096
commit 2c26a02b82
15 changed files with 500 additions and 149 deletions
--- a/pkg/services/sqlstore/permissions/dashboard.go
+++ b/pkg/services/sqlstore/permissions/dashboard.go
@@ -34,8 +34,19 @@ type accessControlDashboardPermissionFilter struct {
 	recursiveQueriesAreSupported bool
 }

+type PermissionsFilter interface {
+	LeftJoin() string
+	With() (string, []interface{})
+	Where() (string, []interface{})
+
+	buildClauses()
+	nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{})
+}
+
 // NewAccessControlDashboardPermissionFilter creates a new AccessControlDashboardPermissionFilter that is configured with specific actions calculated based on the dashboards.PermissionType and query type
-func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel dashboards.PermissionType, queryType string, features featuremgmt.FeatureToggles, recursiveQueriesAreSupported bool) *accessControlDashboardPermissionFilter {
+// The filter is configured to use the new permissions filter (without subqueries) if the feature flag is enabled
+// The filter is configured to use the old permissions filter (with subqueries) if the feature flag is disabled
+func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel dashboards.PermissionType, queryType string, features featuremgmt.FeatureToggles, recursiveQueriesAreSupported bool) PermissionsFilter {
 	needEdit := permissionLevel > dashboards.PERMISSION_VIEW

 	var folderActions []string
@@ -71,13 +82,25 @@ func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissi
 		}
 	}

-	f := accessControlDashboardPermissionFilter{user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
-		recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+	var f PermissionsFilter
+	if features.IsEnabled(featuremgmt.FlagPermissionsFilterRemoveSubquery) {
+		f = &accessControlDashboardPermissionFilterNoFolderSubquery{
+			accessControlDashboardPermissionFilter: accessControlDashboardPermissionFilter{
+				user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
+				recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+			},
+		}
+	} else {
+		f = &accessControlDashboardPermissionFilter{user: user, folderActions: folderActions, dashboardActions: dashboardActions, features: features,
+			recursiveQueriesAreSupported: recursiveQueriesAreSupported,
+		}
 	}
-
 	f.buildClauses()
+	return f
+}

-	return &f
+func (f *accessControlDashboardPermissionFilter) LeftJoin() string {
+	return ""
 }

 // Where returns:
@@ -178,7 +201,7 @@ func (f *accessControlDashboardPermissionFilter) buildClauses() {
 					builder.WriteString("(dashboard.folder_id IN (SELECT d.id FROM dashboard as d ")
 					builder.WriteString(fmt.Sprintf("WHERE d.uid IN (SELECT uid FROM %s)", recQueryName))
 				default:
-					nestedFoldersSelectors, nestedFoldersArgs := nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "folder_id", "id")
+					nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.folder_id", "d.id")
 					builder.WriteRune('(')
 					builder.WriteString(nestedFoldersSelectors)
 					args = append(args, nestedFoldersArgs...)
@@ -245,7 +268,7 @@ func (f *accessControlDashboardPermissionFilter) buildClauses() {
 					builder.WriteString("(dashboard.uid IN ")
 					builder.WriteString(fmt.Sprintf("(SELECT uid FROM %s)", recQueryName))
 				default:
-					nestedFoldersSelectors, nestedFoldersArgs := nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "uid", "uid")
+					nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.uid", "d.uid")
 					builder.WriteRune('(')
 					builder.WriteString(nestedFoldersSelectors)
 					builder.WriteRune(')')
@@ -327,7 +350,7 @@ func actionsToCheck(actions []string, permissions map[string][]string, wildcards
 	return toCheck
 }

-func nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{}) {
+func (f *accessControlDashboardPermissionFilter) nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, rightTableCol string) (string, []interface{}) {
 	wheres := make([]string, 0, folder.MaxNestedFolderDepth+1)
 	args := make([]interface{}, 0, len(permSelectorArgs)*(folder.MaxNestedFolderDepth+1))

@@ -342,7 +365,7 @@ func nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{},
 		s := fmt.Sprintf(tmpl, t, prev, onCol, t, prev, t)
 		joins = append(joins, s)

-		wheres = append(wheres, fmt.Sprintf("(dashboard.%s IN (SELECT d.%s FROM dashboard d %s WHERE %s.uid IN %s)", leftTableCol, rightTableCol, strings.Join(joins, " "), t, permSelector))
+		wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT %s FROM dashboard d %s WHERE %s.uid IN %s)", leftTableCol, rightTableCol, strings.Join(joins, " "), t, permSelector))
 		args = append(args, permSelectorArgs...)

 		prev = t
--- a/pkg/services/sqlstore/permissions/dashboard_filter_no_subquery.go
+++ b/pkg/services/sqlstore/permissions/dashboard_filter_no_subquery.go
@@ -0,0 +1,236 @@
+package permissions
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/dashboards"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/login"
+)
+
+type accessControlDashboardPermissionFilterNoFolderSubquery struct {
+	accessControlDashboardPermissionFilter
+
+	folderIsRequired bool
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) LeftJoin() string {
+	if !f.folderIsRequired {
+		return ""
+	}
+	return " dashboard AS folder ON dashboard.org_id = folder.org_id AND dashboard.folder_id = folder.id"
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) buildClauses() {
+	if f.user == nil || f.user.Permissions == nil || f.user.Permissions[f.user.OrgID] == nil {
+		f.where = clause{string: "(1 = 0)"}
+		return
+	}
+	dashWildcards := accesscontrol.WildcardsFromPrefix(dashboards.ScopeDashboardsPrefix)
+	folderWildcards := accesscontrol.WildcardsFromPrefix(dashboards.ScopeFoldersPrefix)
+
+	filter, params := accesscontrol.UserRolesFilter(f.user.OrgID, f.user.UserID, f.user.Teams, accesscontrol.GetOrgRoles(f.user))
+	rolesFilter := " AND role_id IN(SELECT id FROM role " + filter + ") "
+	var args []interface{}
+	builder := strings.Builder{}
+	builder.WriteRune('(')
+
+	permSelector := strings.Builder{}
+	var permSelectorArgs []interface{}
+
+	// useSelfContainedPermissions is true if the user's permissions are stored and set from the JWT token
+	// currently it's used for the extended JWT module (when the user is authenticated via a JWT token generated by Grafana)
+	useSelfContainedPermissions := f.user.AuthenticatedBy == login.ExtendedJWTModule
+
+	if len(f.dashboardActions) > 0 {
+		toCheck := actionsToCheck(f.dashboardActions, f.user.Permissions[f.user.OrgID], dashWildcards, folderWildcards)
+
+		if len(toCheck) > 0 {
+			if !useSelfContainedPermissions {
+				builder.WriteString("(dashboard.uid IN (SELECT substr(scope, 16) FROM permission WHERE scope LIKE 'dashboards:uid:%'")
+				builder.WriteString(rolesFilter)
+				args = append(args, params...)
+
+				if len(toCheck) == 1 {
+					builder.WriteString(" AND action = ?")
+					args = append(args, toCheck[0])
+				} else {
+					builder.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					args = append(args, toCheck...)
+					args = append(args, len(toCheck))
+				}
+				builder.WriteString(") AND NOT dashboard.is_folder)")
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				args = getAllowedUIDs(actions, f.user, dashboards.ScopeDashboardsPrefix)
+
+				// Only add the IN clause if we have any dashboards to check
+				if len(args) > 0 {
+					builder.WriteString("(dashboard.uid IN (?" + strings.Repeat(", ?", len(args)-1) + "")
+					builder.WriteString(") AND NOT dashboard.is_folder)")
+				} else {
+					builder.WriteString("(1 = 0)")
+				}
+			}
+
+			builder.WriteString(" OR ")
+
+			if !useSelfContainedPermissions {
+				permSelector.WriteString("(SELECT substr(scope, 13) FROM permission WHERE scope LIKE 'folders:uid:%' ")
+				permSelector.WriteString(rolesFilter)
+				permSelectorArgs = append(permSelectorArgs, params...)
+
+				if len(toCheck) == 1 {
+					permSelector.WriteString(" AND action = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck[0])
+				} else {
+					permSelector.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck...)
+					permSelectorArgs = append(permSelectorArgs, len(toCheck))
+				}
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				permSelectorArgs = getAllowedUIDs(actions, f.user, dashboards.ScopeFoldersPrefix)
+
+				// Only add the IN clause if we have any folders to check
+				if len(permSelectorArgs) > 0 {
+					permSelector.WriteString("(?" + strings.Repeat(", ?", len(permSelectorArgs)-1) + "")
+				} else {
+					permSelector.WriteString("(")
+				}
+			}
+
+			permSelector.WriteRune(')')
+
+			switch f.features.IsEnabled(featuremgmt.FlagNestedFolders) {
+			case true:
+				switch f.recursiveQueriesAreSupported {
+				case true:
+					recQueryName := fmt.Sprintf("RecQry%d", len(f.recQueries))
+					f.addRecQry(recQueryName, permSelector.String(), permSelectorArgs)
+					builder.WriteString("(folder.uid IN (SELECT uid FROM " + recQueryName)
+				default:
+					nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "folder.uid", "")
+					builder.WriteRune('(')
+					builder.WriteString(nestedFoldersSelectors)
+					args = append(args, nestedFoldersArgs...)
+				}
+				f.folderIsRequired = true
+				builder.WriteString(") AND NOT dashboard.is_folder)")
+			default:
+				builder.WriteString("(")
+				if len(permSelectorArgs) > 0 {
+					builder.WriteString("folder.uid IN ")
+					builder.WriteString(permSelector.String())
+					args = append(args, permSelectorArgs...)
+					f.folderIsRequired = true
+				} else {
+					builder.WriteString("1 = 0 ")
+				}
+				builder.WriteString(" AND NOT dashboard.is_folder)")
+			}
+		} else {
+			builder.WriteString("NOT dashboard.is_folder")
+		}
+	}
+
+	// recycle and reuse
+	permSelector.Reset()
+	permSelectorArgs = permSelectorArgs[:0]
+
+	if len(f.folderActions) > 0 {
+		if len(f.dashboardActions) > 0 {
+			builder.WriteString(" OR ")
+		}
+
+		toCheck := actionsToCheck(f.folderActions, f.user.Permissions[f.user.OrgID], folderWildcards)
+		if len(toCheck) > 0 {
+			if !useSelfContainedPermissions {
+				permSelector.WriteString("(SELECT substr(scope, 13) FROM permission WHERE scope LIKE 'folders:uid:%'")
+				permSelector.WriteString(rolesFilter)
+				permSelectorArgs = append(permSelectorArgs, params...)
+				if len(toCheck) == 1 {
+					permSelector.WriteString(" AND action = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck[0])
+				} else {
+					permSelector.WriteString(" AND action IN (?" + strings.Repeat(", ?", len(toCheck)-1) + ") GROUP BY role_id, scope HAVING COUNT(action) = ?")
+					permSelectorArgs = append(permSelectorArgs, toCheck...)
+					permSelectorArgs = append(permSelectorArgs, len(toCheck))
+				}
+			} else {
+				actions := parseStringSliceFromInterfaceSlice(toCheck)
+
+				permSelectorArgs = getAllowedUIDs(actions, f.user, dashboards.ScopeFoldersPrefix)
+
+				if len(permSelectorArgs) > 0 {
+					permSelector.WriteString("(?" + strings.Repeat(", ?", len(permSelectorArgs)-1) + "")
+				} else {
+					permSelector.WriteString("(")
+				}
+			}
+			permSelector.WriteRune(')')
+
+			switch f.features.IsEnabled(featuremgmt.FlagNestedFolders) {
+			case true:
+				switch f.recursiveQueriesAreSupported {
+				case true:
+					recQueryName := fmt.Sprintf("RecQry%d", len(f.recQueries))
+					f.addRecQry(recQueryName, permSelector.String(), permSelectorArgs)
+					builder.WriteString("(dashboard.uid IN ")
+					builder.WriteString(fmt.Sprintf("(SELECT uid FROM %s)", recQueryName))
+				default:
+					nestedFoldersSelectors, nestedFoldersArgs := f.nestedFoldersSelectors(permSelector.String(), permSelectorArgs, "dashboard.uid", "")
+					builder.WriteRune('(')
+					builder.WriteString(nestedFoldersSelectors)
+					builder.WriteRune(')')
+					args = append(args, nestedFoldersArgs...)
+				}
+			default:
+				if len(permSelectorArgs) > 0 {
+					builder.WriteString("(dashboard.uid IN ")
+					builder.WriteString(permSelector.String())
+					args = append(args, permSelectorArgs...)
+				} else {
+					builder.WriteString("(1 = 0")
+				}
+			}
+			builder.WriteString(" AND dashboard.is_folder)")
+		} else {
+			builder.WriteString("dashboard.is_folder")
+		}
+	}
+	builder.WriteRune(')')
+
+	f.where = clause{string: builder.String(), params: args}
+}
+
+func (f *accessControlDashboardPermissionFilterNoFolderSubquery) nestedFoldersSelectors(permSelector string, permSelectorArgs []interface{}, leftTableCol string, _ string) (string, []interface{}) {
+	wheres := make([]string, 0, folder.MaxNestedFolderDepth+1)
+	args := make([]interface{}, 0, len(permSelectorArgs)*(folder.MaxNestedFolderDepth+1))
+
+	joins := make([]string, 0, folder.MaxNestedFolderDepth+2)
+
+	tmpl := "INNER JOIN folder %s ON %s.parent_uid = %s.uid AND %s.org_id = %s.org_id "
+
+	wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT f1.uid FROM folder f1 WHERE f1.uid IN %s)", leftTableCol, permSelector))
+	args = append(args, permSelectorArgs...)
+
+	prev := "f1"
+	for i := 2; i <= folder.MaxNestedFolderDepth+2; i++ {
+		t := fmt.Sprintf("f%d", i)
+		s := fmt.Sprintf(tmpl, t, prev, t, prev, t)
+		joins = append(joins, s)
+
+		wheres = append(wheres, fmt.Sprintf("(%s IN (SELECT f1.uid FROM folder f1 %s WHERE %s.uid IN %s)", leftTableCol, strings.Join(joins, " "), t, permSelector))
+		args = append(args, permSelectorArgs...)
+
+		prev = t
+	}
+
+	return strings.Join(wheres, ") OR "), args
+}
--- a/pkg/services/sqlstore/permissions/dashboard_test.go
+++ b/pkg/services/sqlstore/permissions/dashboard_test.go
@@ -3,6 +3,7 @@ package permissions_test
 import (
 	"context"
 	"strconv"
+	"strings"
 	"testing"
 	"time"

@@ -162,26 +163,39 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
 	}

 	for _, tt := range tests {
-		t.Run(tt.desc, func(t *testing.T) {
-			store := setupTest(t, 10, 100, tt.permissions)
-			recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
+		store := setupTest(t, 10, 100, tt.permissions)
+		recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
+		require.NoError(t, err)

-			usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, featuremgmt.WithFeatures(), recursiveQueriesAreSupported)
+		usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}

-			var result int
-			err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				_, err := sess.SQL(recQry+"\nSELECT COUNT(*) FROM dashboard WHERE "+q, params...).Get(&result)
-				return err
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(), featuremgmt.WithFeatures(featuremgmt.FlagPermissionsFilterRemoveSubquery)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+			t.Run(tt.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, features, recursiveQueriesAreSupported)
+
+				var result int
+				err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					leftJoin := filter.LeftJoin()
+					s := recQry + "\nSELECT COUNT(*) FROM dashboard WHERE " + q
+					if leftJoin != "" {
+						s = recQry + "\nSELECT COUNT(*) FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q
+					}
+					_, err := sess.SQL(s, params...).Get(&result)
+					return err
+				})
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.expectedResult, result)
 			})
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.expectedResult, result)
-		})
+		}
 	}
 }

@@ -323,26 +337,39 @@ func TestIntegration_DashboardPermissionFilter_WithSelfContainedPermissions(t *t
 	}

 	for _, tt := range tests {
-		t.Run(tt.desc, func(t *testing.T) {
-			store := setupTest(t, 10, 100, []accesscontrol.Permission{})
-			recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
+		store := setupTest(t, 10, 100, []accesscontrol.Permission{})
+		recursiveQueriesAreSupported, err := store.RecursiveQueriesAreSupported()
+		require.NoError(t, err)

-			usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.signedInUserPermissions)}}
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, featuremgmt.WithFeatures(), recursiveQueriesAreSupported)
+		usr := &user.SignedInUser{OrgID: 1, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.signedInUserPermissions)}}

-			var result int
-			err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				_, err := sess.SQL(recQry+"\nSELECT COUNT(*) FROM dashboard WHERE "+q, params...).Get(&result)
-				return err
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(), featuremgmt.WithFeatures(featuremgmt.FlagPermissionsFilterRemoveSubquery)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+			t.Run(tt.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tt.permission, tt.queryType, features, recursiveQueriesAreSupported)
+
+				var result int
+				err = store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT COUNT(*) FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT COUNT(*) FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q
+					}
+					_, err := sess.SQL(s, params...).Get(&result)
+					return err
+				})
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.expectedResult, result)
 			})
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.expectedResult, result)
-		})
+		}
 	}
 }

@@ -353,7 +380,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 		permission     dashboards.PermissionType
 		permissions    []accesscontrol.Permission
 		expectedResult []string
-		features       featuremgmt.FeatureToggles
+		features       []interface{}
 	}{
 		{
 			desc:       "Should be able to view dashboards under inherited folders if nested folders are enabled",
@@ -362,7 +389,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -372,7 +399,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"dashboard under parent folder"},
 		},
 		{
@@ -382,7 +409,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder"},
 		},
 		{
@@ -392,7 +419,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 			permissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent"},
 		},
 		{
@@ -402,7 +429,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -412,7 +439,7 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent", "dashboard under parent folder"},
 		},
 	}
@@ -426,29 +453,43 @@ func TestIntegration_DashboardNestedPermissionFilter(t *testing.T) {
 	var orgID int64 = 1

 	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			tc.permissions = append(tc.permissions, accesscontrol.Permission{
-				Action: dashboards.ActionFoldersCreate,
-			}, accesscontrol.Permission{
-				Action: dashboards.ActionFoldersWrite,
-				Scope:  dashboards.ScopeFoldersAll,
-			})
-			usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.permissions)}}
-			db := setupNestedTest(t, usr, tc.permissions, orgID, tc.features)
-			recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, tc.features, recursiveQueriesAreSupported)
-			var result []string
-			err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				err := sess.SQL(recQry+"\nSELECT title FROM dashboard WHERE "+q, params...).Find(&result)
-				return err
-			})
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
+		tc.permissions = append(tc.permissions, accesscontrol.Permission{
+			Action: dashboards.ActionFoldersCreate,
+		}, accesscontrol.Permission{
+			Action: dashboards.ActionFoldersWrite,
+			Scope:  dashboards.ScopeFoldersAll,
 		})
+		usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.permissions)}}
+
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(tc.features...), featuremgmt.WithFeatures(append(tc.features, featuremgmt.FlagPermissionsFilterRemoveSubquery)...)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
+			}
+
+			t.Run(tc.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				db := setupNestedTest(t, usr, tc.permissions, orgID, features)
+				recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
+				require.NoError(t, err)
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, features, recursiveQueriesAreSupported)
+				var result []string
+				err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT dashboard.title FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT dashboard.title FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q + "ORDER BY dashboard.id ASC"
+					}
+					err := sess.SQL(s, params...).Find(&result)
+					return err
+				})
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedResult, result)
+			})
+		}
 	}
 }

@@ -459,7 +500,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 		permission              dashboards.PermissionType
 		signedInUserPermissions []accesscontrol.Permission
 		expectedResult          []string
-		features                featuremgmt.FeatureToggles
+		features                []interface{}
 	}{
 		{
 			desc:       "Should be able to view dashboards under inherited folders if nested folders are enabled",
@@ -468,7 +509,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -478,7 +519,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"dashboard under parent folder"},
 		},
 		{
@@ -488,7 +529,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder"},
 		},
 		{
@@ -498,7 +539,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 			signedInUserPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent"},
 		},
 		{
@@ -508,7 +549,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"parent", "subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 		{
@@ -518,7 +559,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(),
+			features:       []interface{}{},
 			expectedResult: []string{"parent", "dashboard under parent folder"},
 		},
 		{
@@ -532,7 +573,7 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 				{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:parent"},
 				{Action: dashboards.ActionDashboardsWrite, Scope: "folders:uid:parent"},
 			},
-			features:       featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features:       []interface{}{featuremgmt.FlagNestedFolders},
 			expectedResult: []string{"subfolder", "dashboard under parent folder", "dashboard under subfolder"},
 		},
 	}
@@ -546,35 +587,48 @@ func TestIntegration_DashboardNestedPermissionFilter_WithSelfContainedPermission
 	var orgID int64 = 1

 	for _, tc := range testCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			helperUser := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule,
-				Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction([]accesscontrol.Permission{
-					{
-						Action: dashboards.ActionFoldersCreate,
-					},
-					{
-						Action: dashboards.ActionFoldersWrite,
-						Scope:  dashboards.ScopeFoldersAll,
-					},
-				}),
+		helperUser := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule,
+			Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction([]accesscontrol.Permission{
+				{
+					Action: dashboards.ActionFoldersCreate,
 				},
+				{
+					Action: dashboards.ActionFoldersWrite,
+					Scope:  dashboards.ScopeFoldersAll,
+				},
+			}),
+			},
+		}
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(tc.features...), featuremgmt.WithFeatures(append(tc.features, featuremgmt.FlagPermissionsFilterRemoveSubquery)...)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
 			}
-			usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.signedInUserPermissions)}}
-			db := setupNestedTest(t, helperUser, []accesscontrol.Permission{}, orgID, tc.features)
-			recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
-			require.NoError(t, err)
-			filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, tc.features, recursiveQueriesAreSupported)
-			var result []string
-			err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
-				q, params := filter.Where()
-				recQry, recQryParams := filter.With()
-				params = append(recQryParams, params...)
-				err := sess.SQL(recQry+"\nSELECT title FROM dashboard WHERE "+q, params...).Find(&result)
-				return err
+
+			t.Run(tc.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				usr := &user.SignedInUser{OrgID: orgID, OrgRole: org.RoleViewer, AuthenticatedBy: login.ExtendedJWTModule, Permissions: map[int64]map[string][]string{orgID: accesscontrol.GroupScopesByAction(tc.signedInUserPermissions)}}
+				db := setupNestedTest(t, helperUser, []accesscontrol.Permission{}, orgID, features)
+				recursiveQueriesAreSupported, err := db.RecursiveQueriesAreSupported()
+				require.NoError(t, err)
+				filter := permissions.NewAccessControlDashboardPermissionFilter(usr, tc.permission, tc.queryType, features, recursiveQueriesAreSupported)
+				var result []string
+				err = db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+					q, params := filter.Where()
+					recQry, recQryParams := filter.With()
+					params = append(recQryParams, params...)
+					s := recQry + "\nSELECT dashboard.title FROM dashboard WHERE " + q
+					leftJoin := filter.LeftJoin()
+					if leftJoin != "" {
+						s = recQry + "\nSELECT dashboard.title FROM dashboard LEFT OUTER JOIN " + leftJoin + " WHERE " + q + " ORDER BY dashboard.id ASC"
+					}
+					err := sess.SQL(s, params...).Find(&result)
+					return err
+				})
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedResult, result)
 			})
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
-		})
+		}
 	}
 }

--- a/pkg/services/sqlstore/searchstore/builder.go
+++ b/pkg/services/sqlstore/searchstore/builder.go
@@ -99,7 +99,10 @@ func (b *Builder) applyFilters() (ordering string) {

 	for _, f := range b.Filters {
 		if f, ok := f.(FilterLeftJoin); ok {
-			joins = append(joins, fmt.Sprintf(" LEFT OUTER JOIN %s ", f.LeftJoin()))
+			s := f.LeftJoin()
+			if s != "" {
+				joins = append(joins, fmt.Sprintf(" LEFT OUTER JOIN %s ", s))
+			}
 		}

 		if f, ok := f.(FilterWhere); ok {
--- a/pkg/services/sqlstore/searchstore/search_test.go
+++ b/pkg/services/sqlstore/searchstore/search_test.go
@@ -3,6 +3,7 @@ package searchstore_test

 import (
 	"context"
+	"strings"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -117,12 +118,12 @@ func TestBuilder_RBAC(t *testing.T) {
 	testsCases := []struct {
 		desc            string
 		userPermissions []accesscontrol.Permission
-		features        featuremgmt.FeatureToggles
+		features        []interface{}
 		expectedParams  []interface{}
 	}{
 		{
 			desc:     "no user permissions",
-			features: featuremgmt.WithFeatures(),
+			features: []interface{}{},
 			expectedParams: []interface{}{
 				int64(1),
 			},
@@ -132,7 +133,7 @@ func TestBuilder_RBAC(t *testing.T) {
 			userPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "dashboards:uid:1"},
 			},
-			features: featuremgmt.WithFeatures(),
+			features: []interface{}{},
 			expectedParams: []interface{}{
 				int64(1),
 				int64(1),
@@ -169,7 +170,7 @@ func TestBuilder_RBAC(t *testing.T) {
 			userPermissions: []accesscontrol.Permission{
 				{Action: dashboards.ActionDashboardsRead, Scope: "dashboards:uid:1"},
 			},
-			features: featuremgmt.WithFeatures(featuremgmt.FlagNestedFolders),
+			features: []interface{}{featuremgmt.FlagNestedFolders},
 			expectedParams: []interface{}{
 				int64(1),
 				int64(1),
@@ -216,39 +217,47 @@ func TestBuilder_RBAC(t *testing.T) {
 	require.NoError(t, err)

 	for _, tc := range testsCases {
-		t.Run(tc.desc, func(t *testing.T) {
-			if len(tc.userPermissions) > 0 {
-				user.Permissions = map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tc.userPermissions)}
+		for _, features := range []*featuremgmt.FeatureManager{featuremgmt.WithFeatures(tc.features...), featuremgmt.WithFeatures(append(tc.features, featuremgmt.FlagPermissionsFilterRemoveSubquery)...)} {
+			m := features.GetEnabled(context.Background())
+			keys := make([]string, 0, len(m))
+			for k := range m {
+				keys = append(keys, k)
 			}

-			level := dashboards.PERMISSION_EDIT
+			t.Run(tc.desc+" with features "+strings.Join(keys, ","), func(t *testing.T) {
+				if len(tc.userPermissions) > 0 {
+					user.Permissions = map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tc.userPermissions)}
+				}

-			builder := &searchstore.Builder{
-				Filters: []interface{}{
-					searchstore.OrgFilter{OrgId: user.OrgID},
-					searchstore.TitleSorter{},
-					permissions.NewAccessControlDashboardPermissionFilter(
-						user,
-						level,
-						"",
-						tc.features,
-						recursiveQueriesAreSupported,
-					),
-				},
-				Dialect: store.GetDialect(),
-			}
+				level := dashboards.PERMISSION_EDIT

-			res := []dashboards.DashboardSearchProjection{}
-			err := store.WithDbSession(context.Background(), func(sess *db.Session) error {
-				sql, params := builder.ToSQL(limit, page)
-				// TODO: replace with a proper test
-				assert.Equal(t, tc.expectedParams, params)
-				return sess.SQL(sql, params...).Find(&res)
+				builder := &searchstore.Builder{
+					Filters: []interface{}{
+						searchstore.OrgFilter{OrgId: user.OrgID},
+						searchstore.TitleSorter{},
+						permissions.NewAccessControlDashboardPermissionFilter(
+							user,
+							level,
+							"",
+							features,
+							recursiveQueriesAreSupported,
+						),
+					},
+					Dialect: store.GetDialect(),
+				}
+
+				res := []dashboards.DashboardSearchProjection{}
+				err := store.WithDbSession(context.Background(), func(sess *db.Session) error {
+					sql, params := builder.ToSQL(limit, page)
+					// TODO: replace with a proper test
+					assert.Equal(t, tc.expectedParams, params)
+					return sess.SQL(sql, params...).Find(&res)
+				})
+				require.NoError(t, err)
+
+				assert.Len(t, res, 0)
 			})
-			require.NoError(t, err)
-
-			assert.Len(t, res, 0)
-		})
+		}
 	}
 }