Call access control once per check

core/trino-main/src/main/java/io/trino/sql/analyzer/StatementAnalyzer.java

@@ -246,6 +246,7 @@
 import io.trino.sql.tree.WithQuery;
 import io.trino.transaction.TransactionManager;
 import io.trino.type.TypeCoercion;
+import io.trino.util.OnlyOneInvocationHandler;
 
 import java.math.RoundingMode;
 import java.time.Instant;
@@ -274,6 +275,7 @@
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static com.google.common.collect.Iterables.getLast;
 import static com.google.common.collect.Iterables.getOnlyElement;
+import static com.google.common.reflect.Reflection.newProxy;
 import static io.trino.SystemSessionProperties.getMaxGroupingSets;
 import static io.trino.metadata.FunctionResolver.toPath;
 import static io.trino.metadata.MetadataManager.toQualifiedFunctionName;
@@ -423,7 +425,9 @@ class StatementAnalyzer
         this.typeCoercion = new TypeCoercion(plannerContext.getTypeManager()::getType);
         this.sqlParser = requireNonNull(sqlParser, "sqlParser is null");
         this.groupProvider = requireNonNull(groupProvider, "groupProvider is null");
-        this.accessControl = requireNonNull(accessControl, "accessControl is null");
+        this.accessControl = newProxy(
+                AccessControl.class,
+                new OnlyOneInvocationHandler(requireNonNull(accessControl, "accessControl is null")));
         this.transactionManager = requireNonNull(transactionManager, "transactionManager is null");
         this.session = requireNonNull(session, "session is null");
         this.tableProceduresRegistry = requireNonNull(tableProceduresRegistry, "tableProceduresRegistry is null");

core/trino-main/src/main/java/io/trino/util/OnlyOneInvocationHandler.java

@@ -0,0 +1,66 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.trino.util;
+
+import com.google.common.collect.HashBasedTable;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Table;
+import com.google.common.reflect.AbstractInvocationHandler;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.List;
+
+import static java.util.Objects.requireNonNull;
+
+public class OnlyOneInvocationHandler
+        extends AbstractInvocationHandler
+{
+    private static final Object NULL_MARKER = new Object();
+    private final Table<String, List<?>, Object> results = HashBasedTable.create();
+    private final Object delegate;
+
+    public OnlyOneInvocationHandler(Object delegate)
+    {
+        this.delegate = requireNonNull(delegate, "delegate is null");
+    }
+
+    @Override
+    protected Object handleInvocation(Object proxy, Method method, Object[] argumentsArray)
+            throws Throwable
+    {
+        List<?> arguments = ImmutableList.copyOf(argumentsArray);
+        Object cachedResult = results.get(method.toString(), arguments);
+        if (cachedResult != null) {
+            if (cachedResult == NULL_MARKER) {
+                return null;
+            }
+            return cachedResult;
+        }
+        Object result;
+        try {
+            result = method.invoke(delegate, argumentsArray);
+        }
+        catch (InvocationTargetException e) {
+            throw e.getCause();
+        }
+        if (result != null) {
+            results.put(method.toString(), arguments, result);
+        }
+        else {
+            results.put(method.toString(), arguments, NULL_MARKER);
+        }
+        return result;
+    }
+}

testing/trino-tests/src/test/java/io/trino/security/TestAccessControl.java

@@ -40,6 +40,7 @@
 import io.trino.testing.TestingSession;
 import org.testng.annotations.Test;
 
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Optional;
 
@@ -756,4 +757,29 @@ public void testUseStatementAccessControlWithDeniedSchema()
             }
         });
     }
+
+    @Test
+    public void testFunctionAccessControlIsCalledOncePerFunction()
+    {
+        Map<String, Integer> functionCallCounts = new HashMap<>();
+        TestingPrivilege testingPrivilege = new TestingPrivilege(
+                Optional.empty(),
+                name -> {
+                    functionCallCounts.compute(name, (key, value) -> {
+                        if (value == null) {
+                            return 1;
+                        }
+                        return ++value;
+                    });
+                    return false;
+                },
+                EXECUTE_FUNCTION);
+        assertAccessAllowed("SELECT reverse('a1'), reverse('a2'), reverse('a'), length('b'), length('a')", testingPrivilege);
+        assertThat(functionCallCounts)
+                .hasSize(4)
+                .containsEntry("user", 1)
+                .containsEntry("query", 1)
+                .containsEntry("reverse", 1)
+                .containsEntry("length", 1);
+    }
 }