From 5d2ca65ea424aa5730f4085484de27c209781a70 Mon Sep 17 00:00:00 2001
From: Stavros <steveiliop56@gmail.com>
Date: Mon, 18 May 2026 11:50:38 +0300
Subject: [PATCH] fix: avoid o(2n) complexity in acl lookup

---
 internal/service/access_controls_service.go | 16 +++++-----------
 internal/service/docker_service.go          | 16 +++++++++-------
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/internal/service/access_controls_service.go b/internal/service/access_controls_service.go
index 7ee5723a..64c4d6fc 100644
--- a/internal/service/access_controls_service.go
+++ b/internal/service/access_controls_service.go
@@ -30,27 +30,21 @@ func NewAccessControlsService(
 }
 
 func (service *AccessControlsService) lookupStaticACLs(domain string) *model.App {
-	var appAcls *model.App
+	var nameMatch *model.App
 
-	// first pass - try to find an exact match for the domain
+	// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
 	for app, config := range service.config.Apps {
 		if config.Config.Domain == domain {
 			service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
-			appAcls = &config
-			break // If we find a match by domain, we can stop searching
+			return &config
 		}
-	}
-
-	// second pass - if we didn't find a match by domain, try to find a match by app name (subdomain)
-	for app, config := range service.config.Apps {
 		if strings.SplitN(domain, ".", 2)[0] == app {
 			service.log.App.Debug().Str("name", app).Msg("Found matching container by app name")
-			appAcls = &config
-			break // If we find a match by app name, we can stop searching
+			nameMatch = &config
 		}
 	}
 
-	return appAcls
+	return nameMatch
 }
 
 func (service *AccessControlsService) GetAccessControls(domain string) (*model.App, error) {
diff --git a/internal/service/docker_service.go b/internal/service/docker_service.go
index e1d4b877..1413f04e 100644
--- a/internal/service/docker_service.go
+++ b/internal/service/docker_service.go
@@ -85,21 +85,23 @@ func (docker *DockerService) GetLabels(appDomain string) (*model.App, error) {
 			return nil, err
 		}
 
-		// fist pass - try to find an exact match for the domain
-		for _, appLabels := range labels.Apps {
+		var nameMatch *model.App
+
+		// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
+		for appName, appLabels := range labels.Apps {
 			if appLabels.Config.Domain == appDomain {
 				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by domain")
 				return &appLabels, nil
 			}
-		}
-
-		// second pass - if we didn't find a match by domain, try to find a match by app name (subdomain)
-		for appName, appLabels := range labels.Apps {
 			if strings.SplitN(appDomain, ".", 2)[0] == appName {
 				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by app name")
-				return &appLabels, nil
+				nameMatch = &appLabels
 			}
 		}
+
+		if nameMatch != nil {
+			return nameMatch, nil
+		}
 	}
 
 	docker.log.App.Debug().Str("domain", appDomain).Msg("No matching container found for domain")