Added Adds configurable pipeline optimization for weight-one difference subtract edges with high cardinality on wildcard leaves. For now, this configuration is internal only. #3267 Fixed Fixed validation-ordering defect where malformed RelationReference (relation_or_wildcard oneof set but yielding neither wildcard nor non-empty relation) panicked WriteAuthorizationModel. NewAndValidate now runs al…
What's Changed Added Added WithServiceName server option to allow embedders to override the serviceName field used for the grpc_service label on OpenFGA's package-level Prometheus metrics and telemetry.RPCInfo.Service. This enables multiple Server instances in the same process to emit separate metric series. Note it does not rename the standard gRPC server metrics (e.g. grpc_server_handled_total),…
What's Changed Fixed Fixed experimental weighted_graph_check intermittently returning false when evaluating relations that cross two or more distinct recursive TTUs which share the same tupleset relation. #3244 Full Changelog: v1.18.2...v1.18.3
What's Changed Added Extended experimental weighted_graph_check diagnostic logging to cover the wildcard_with_exclusion and userset_with_exclusion shapes: the log now fires when v2 Check rejects one of these shapes and Check falls back to v1, and when v2 Check is skipped entirely because the weighted graph fails to build. These logs surface authorization models that may be affected by a future v1…
Added Added diagnostic logging in experimental weighted_graph_check when v2 Check resolution might produce a different result than v1 for the same query. These logs surface authorization models that may be affected by a future v1 deprecation, and no operator action is required. #3149 Added diagnostic logging in Expand and ListUsers when v2 resolution might produce a different result than v1 for th…
🚨 Operational warning for MySQL users 🚨 This release contains a migration for MySQL which acquires a shared lock on the tuple and changelog tables. This is a potentially-lengthy migration, during which you will not be able to perform Write operations. What you should do: Do not execute auto-migrations on startup for production instances with large datasets. Please refer to this migration guide bef…
Changed Update PR workflow benchmark comparison to be less flakey. #3153 Fixed Fixed experimental weighted_graph_check falling back to the standard algorithm on errors that v1 would reject identically or that should not be retried. ErrTransactionThrottled, check.ErrValidation, check.ErrInvalidUser, and *tuple.InvalidTupleError (from contextual-tuple validation) are now returned directly instead of…
Added Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preser…
Changed Added workflow-level concurrency.group and cancel-in-progress for PR-related workflow runs to reduce wasted effort. #3140 Fixed Fixed experimental weighted_graph_check incorrectly falling back to the standard algorithm on deadline/cancellation/throttle-timeout errors; these are now returned directly. Also fixed weighted_graph_check emitting metrics under the wrong method label when used as…
Added Added datastore ping timeout (PingTimeout) and datastore ping retry timeout (PingRetryMaxElapsedTime) configurations. #3113 Changed Report allowed result and tuple_key on Check and experimental weighted_graph_check resolution trace spans. #3116 Fixed Fixed cache key collisions in experimental weighted_graph_check union resolution by moving result caching from the union node level to the indi…
Changed Reuse a single MySQL container across tests by replacing the test fixture implementation, improving test performance and reducing resource usage. #3042 Fixed Fixed a potential panic within command error handling. #3091 Fixed a bug that propagated expected errors from list objects when a path short-circuits. #3096 Fixed cache key collisions in experimental weighted_graph_check for edges in…
Changed Implemented edge pruning in the list objects pipeline algorithm. This introduces a measurable improvement to request latency for larger, more complex authorization models. #3075 Fixed Fixed experimental weighted_graph_check query cache being skipped when the cache controller returns a zero invalidation time (e.g., on cold start or when disabled), despite the cache controller documenting th…
Added Added configuration for the server shutdown timeout. #2976 Changed Made some minor changes in ListObjects to reduce heap allocations. Results in minor latency reduction. #3043 Improve cache key generation performance by removing fmt usage and extend control-character sanitization to all cache key inputs (tuples, conditions, context). #3006 Fixed Fixed AuthZEN discovery metadata to publish en…
Fixed Use delimiter in contextual tuple key in experimental weighted_graph_check, and add validation in v2Check. Thanks to @0xmrma for reporting this bug. #3064 Full Changelog: v1.14.1...v1.14.2