The way it currently works is at webserver start time it reads the acs_object_types table and creates a function for each one. It writes the tcl proc on the fly and evals it. The function it creates checks that the value is a number then gets the object type of that id and compares it to the expected value. If that fails it checks the subtypes also. You could cache this if you assume objects do not change types.
The attribute function creates a function for each attribute type. It gets the table name from acs_attributes or if null acs_object_types. It uses column_name from attributes and if it's null it uses the attribute_name. The attribute check does not require database access (except at at startup).
It would be easy enough to add a parameter to bypass the database checks on object_id. The nice thing about that is you could turn it off if you don't want the performance hit. The page contract remains the same either way.
For example for Person you end up with
set object_type person
if { ![regexp {^[0-9]+$} $value] } {
ad_complain "Value is not a Person id"
return 0
}
set type [db_string t { select object_type from acs_objects where object_id = :value } -default ""]
if { $type != "person" } {
if { [db_string c { select count(*)
from acs_object_type_supertype_map
where object_type = :type
and ancestor_type = :object_type }] == 0 } {
ad_complain "Value is not a Person id"
return 0
}
}
return 1
