fix: support URI schemes in OTLP endpoint configuration by Siddhant-K-code · Pull Request #2981 · openfga/openfga

Siddhant-K-code · Mar 15, 2026

Description

OTEL_EXPORTER_OTLP_ENDPOINT uses full URIs (e.g. http://host:4317) per the OpenTelemetry spec, but otlptracegrpc.WithEndpoint() expects a bare host:port. This caused:

too many colons in address http://host:4317:443

What changed

ParseOTLPEndpoint() — strips http:// or https:// from the endpoint, returning the bare authority and whether the scheme indicates TLS (true for https://).
ResolveOTLPSecurity() — return configSecure || schemeSecure. TLS is used if either the config flag or https:// scheme says so.
Startup log now shows the resolved endpoint and effective TLS state.

Backward compatibility

No breaking changes. Bare host:port values behave identically — schemeSecure is false, so the existing --trace-otlp-tls-enabled flag controls TLS as before.

Endpoint	`--trace-otlp-tls-enabled`	Effective TLS
`collector:4317`	`false`	`false`
`collector:4317`	`true`	`true`
`http://collector:4317`	`false`	`false`
`https://collector:4317`	`false`	`true`

Related Issue(s)

Fixes #2970

How to test

go test ./internal/telemetry/ -v

For manual validation: set OTEL_EXPORTER_OTLP_ENDPOINT=http://collector:4317 with --trace-enabled=true and verify traces export without the "too many colons" error.

Documentation follow-up (openfga.dev)

The Tracing section should note that OTEL_EXPORTER_OTLP_ENDPOINT / OTEL_EXPORTER_OTLP_TRACES_ENDPOINT accept full URIs, and that an https:// scheme enables TLS regardless of --trace-otlp-tls-enabled.

linux-foundation-easycla · Mar 15, 2026

The committers listed above are authorized under a signed CLA.

✅ login: Siddhant-K-code / name: Siddhant Khare (7ef16d0, e58f23b)

coderabbitai · Mar 15, 2026

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 32cae2c9-300f-49ec-a609-f0973f0ceea2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Walkthrough

The changes add URL parsing support to normalize OTLP endpoints that include URI schemes (http/https) into host:port format, extracting scheme information to determine insecure mode for gRPC configuration.

Changes

Cohort / File(s) Summary

OTLP Endpoint Parsing
internal/telemetry/tracing.go, internal/telemetry/tracing_test.go Added parseOTLPEndpoint function to parse and normalize OTLP endpoints with optional URI schemes into host:port format and extract insecure flag. Modified MustNewTracerProvider to compute endpoint and schemeInsecure values, using both tracer.insecure and parsed schemeInsecure for gRPC WithInsecure configuration. Comprehensive test suite validates parsing across various endpoint formats including bare host:port, http/https schemes, Kubernetes DNS names, localhost, and edge cases.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The code changes directly address issue `#2970` by implementing parseOTLPEndpoint to handle full URIs per OpenTelemetry spec and infer insecure mode from http scheme.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing URL parsing for OTLP endpoints; no unrelated modifications detected.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: support URI schemes in OTLP endpoint configuration' accurately describes the main change—adding URI scheme support to OTLP endpoint handling.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can validate your CodeRabbit configuration file in your editor.

If your editor has YAML language server, you can enable auto-completion and validation by adding # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json at the top of your CodeRabbit configuration file.

Copilot

Pull request overview

This PR fixes OTLP gRPC exporter configuration by normalizing OTEL_EXPORTER_OTLP_ENDPOINT values that include a URI scheme (e.g. http://host:4317) into the host[:port] format expected by otlptracegrpc.WithEndpoint(), and infers insecure mode from http:// endpoints to avoid gRPC dial target parsing failures.

Changes:

Add parseOTLPEndpoint() to strip http:///https:// schemes and derive an “insecure” signal from http.
Use the parsed endpoint in MustNewTracerProvider, enabling WithInsecure() when either config requests it or the scheme implies it.
Add unit tests covering scheme stripping and insecure inference.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
internal/telemetry/tracing.go	Normalize OTLP endpoint before passing to `otlptracegrpc.WithEndpoint()` and infer insecure mode from `http://`.
internal/telemetry/tracing_test.go	Add table-driven tests for `parseOTLPEndpoint()`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

internal/telemetry/tracing_test.go (1)

7-68: Consider adding test cases for edge cases.

The test coverage is good for the primary scenarios from issue #2970. For more robust coverage, consider adding:

IPv6 addresses: http://[::1]:4317 and bare [::1]:4317
Unknown schemes: grpc://collector:4317 or tcp://collector:4317 (should return original)
URLs with paths: http://collector:4317/v1/traces (verifies path is stripped)

📝 Additional test cases

 		{
 			name:             "empty_string",
 			input:            "",
 			expectedEndpoint: "",
 			expectedInsecure: false,
 		},
+		{
+			name:             "http_ipv6",
+			input:            "http://[::1]:4317",
+			expectedEndpoint: "[::1]:4317",
+			expectedInsecure: true,
+		},
+		{
+			name:             "bare_ipv6",
+			input:            "[::1]:4317",
+			expectedEndpoint: "[::1]:4317",
+			expectedInsecure: false,
+		},
+		{
+			name:             "unknown_scheme",
+			input:            "grpc://collector:4317",
+			expectedEndpoint: "grpc://collector:4317",
+			expectedInsecure: false,
+		},
+		{
+			name:             "http_with_path",
+			input:            "http://collector:4317/v1/traces",
+			expectedEndpoint: "collector:4317",
+			expectedInsecure: true,
+		},
 	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/telemetry/tracing_test.go` around lines 7 - 68, Extend
TestParseOTLPEndpoint to include edge-case subtests verifying parseOTLPEndpoint
behavior for IPv6 (e.g., "http://[::1]:4317" and "[::1]:4317"), for unknown
schemes that should be preserved (e.g., "grpc://collector:4317" or
"tcp://collector:4317"), and for URLs containing paths where the path must be
stripped (e.g., "http://collector:4317/v1/traces"), asserting expectedEndpoint
and expectedInsecure for each new case; add these cases to the tests slice
inside TestParseOTLPEndpoint so they run with the existing test harness.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/telemetry/tracing.go`:
- Around line 118-120: The log currently reports TLS.Enabled without accounting
for the scheme-based override; compute the effective security used (e.g.,
effectiveInsecure := tracer.insecure || schemeInsecure or effectiveTLS :=
!effectiveInsecure) and update the log emitted where TLS.Enabled is reported
(the caller that logs TLS status) to reflect the effective connection security
or include a clarifying note that an "http://" endpoint scheme overrides
explicit TLS settings; reference tracer.insecure, schemeInsecure and the
otlptracegrpc.WithInsecure decision so the log matches the actual behavior.

---

Nitpick comments:
In `@internal/telemetry/tracing_test.go`:
- Around line 7-68: Extend TestParseOTLPEndpoint to include edge-case subtests
verifying parseOTLPEndpoint behavior for IPv6 (e.g., "http://[::1]:4317" and
"[::1]:4317"), for unknown schemes that should be preserved (e.g.,
"grpc://collector:4317" or "tcp://collector:4317"), and for URLs containing
paths where the path must be stripped (e.g., "http://collector:4317/v1/traces"),
asserting expectedEndpoint and expectedInsecure for each new case; add these
cases to the tests slice inside TestParseOTLPEndpoint so they run with the
existing test harness.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 79e97ff5-58b4-4af7-8e2e-51e6371a37c0

📥 Commits

Reviewing files that changed from the base of the PR and between c16a8aa and 4d90425.

📒 Files selected for processing (2)

internal/telemetry/tracing.go
internal/telemetry/tracing_test.go

Copilot

Pull request overview

Fixes gRPC OTLP exporter failures when OTEL_EXPORTER_OTLP_ENDPOINT is provided as a full URI (e.g., http://host:4317) by parsing the endpoint into the authority expected by otlptracegrpc.WithEndpoint().

Changes:

Added parseOTLPEndpoint() to strip http:// / https:// schemes and derive an “insecure” hint from http.
Updated tracer provider initialization to pass the parsed endpoint into the OTLP gRPC exporter and apply insecure mode based on parsing results.
Added table-driven unit tests covering common endpoint formats (schemes, paths, IPv6, empty).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/telemetry/tracing.go	Parses OTLP endpoint URIs before configuring the gRPC exporter; derives insecure mode from scheme.
internal/telemetry/tracing_test.go	Adds unit tests validating endpoint parsing behavior across multiple formats.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

codecov · Mar 15, 2026

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.48%. Comparing base (c96067c) to head (e58f23b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/telemetry/tracing.go	88.24%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2981      +/-   ##
==========================================
- Coverage   90.49%   90.48%   -0.01%     
==========================================
  Files         185      185              
  Lines       19757    19774      +17     
==========================================
+ Hits        17878    17890      +12     
- Misses       1233     1238       +5     
  Partials      646      646

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

OTEL_EXPORTER_OTLP_ENDPOINT uses full URIs (e.g. http://host:4317) per the OpenTelemetry spec, but otlptracegrpc.WithEndpoint expects a bare host:port. When the env var included a scheme, the gRPC dialer produced "too many colons in address" errors. Add ParseOTLPEndpoint to strip the URI scheme and infer the connection security mode. An explicit http:// or https:// scheme takes precedence over the TLS configuration flag. The startup log message now reflects the effective TLS state and resolved endpoint. Fixes openfga#2970

senojj · Mar 16, 2026

Thanks for taking the time to put together a pull request!

I see that the ResolveOTLPInsecure code prioritizes the absence of TLS in the URL's scheme over the presence of TLS enablement in the configuration.Ideally, the code should prioritize the most restrictive of the options (the most secure).

For example, if the scheme is "http", and TLS is enabled in the configuration, then the TCP connection should use TLS. If the scheme is "https" and TLS is not enabled in the configuration, then the TCP connection should use TLS.

Replace *bool three-state with plain bool. ParseOTLPEndpoint now returns whether the scheme indicates TLS (true for https://, false otherwise). Replace ResolveOTLPInsecure with ResolveOTLPSecurity using simple OR: TLS is enabled if either the config flag or the https:// scheme says so.

Siddhant-K-code · Mar 17, 2026

Thanks @senojj for suggestions. I’ve addressed your suggestions in 3d9a92a

# Conflicts: # CHANGELOG.md

Siddhant-K-code · Mar 17, 2026

The go-bench failure is unrelated to this PR - we don't touch any benchmarked code, and the same job is flaky on main as well. Re-running should clear it.

For Codecov: patch coverage is 90%. The 2 uncovered lines are inside MustNewTracerProvider, which uses grpc.WithBlock() and panics on connection failure — it requires a live OTLP collector to exercise. All testable logic (ParseOTLPEndpoint and ResolveOTLPSecurity) has full coverage with 17 test cases.

Add support for exporting logs via OTLP, allowing integration with any OpenTelemetry-compatible backend (Grafana Loki, Datadog, GCP Cloud Logging, etc.). When log.otlp.enabled is set, logs are exported via OTLP in addition to stdout. The otelzap bridge attaches span context (trace ID, span ID) to each log record, enabling log-trace correlation in backends that support it. Configuration mirrors the trace configuration shape: the standard OTel env vars (OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT) only answer where logs are sent, while the explicit OpenFGA flag (log.otlp.enabled / --log-otlp-enabled / OPENFGA_LOG_OTLP_ENABLED) answers whether to export at all — so a cluster that injects the generic endpoint variable for tracing does not silently start exporting logs on upgrade. zap's production sampling is applied outside the tee, so the keep/drop decision is made once, before fan-out: stdout and OTLP receive the same deterministically sampled stream and collector egress stays bounded during log storms. Changes: - Add otelzap bridge core backed by an OTLP log provider (internal/telemetry/logging.go) - Add WithOTELCore logger option that tees log entries to the bridge. The bridge core is capped to the configured log level, the stdout core strips the bridge-only context field via contextFilterCore, and the sampler wraps the tee (pkg/logger/logger.go) - Attach the context field in the *WithContext logging methods only when an OTEL core is configured, and use those methods in the gRPC logging interceptor so the bridge can extract span context (pkg/middleware/logging/logging.go) - Add config: log.otlp.enabled, log.otlp.endpoint, log.otlp.tls.enabled with OPENFGA_LOG_OTLP_* env vars and OTEL_EXPORTER_OTLP_* endpoint fallbacks (pkg/server/config/config.go, cmd/run/, .config-schema.json) feat: add potential v2 breaking change logs for Expand and ListUsers (openfga#3182) release: update changelog for release 1.18.1 (openfga#3188) release: Update changelog to prep for 1.18.1 release (openfga#3186) test: fix flaky TestV2CheckWithIteratorCache_HigherConsistencyBypassesCache (openfga#3061) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * test reproducing ListUsers report * implement fix * additional test with 3 operands fix: match IPv4-mapped IPv6 addresses in the in_cidr condition (openfga#3181) Signed-off-by: kanywst <niwatakuma@icloud.com> fix: use deterministic proto marshaling for stored authorization models (openfga#3171) chore: create draft release and publish after provenance succeeds for immutable tags/releases (openfga#3178) docs: fix changelog entry (openfga#3177) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: add v2Check logs for resolution breaking change (openfga#3149) feat: BatchCheck uses v2Check when ExperimentalWeightedGraphCheck is enabled (openfga#3154) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: update changelog to add CVE identifiers for recent fixes (openfga#3176) chore: update todo comment string in migration guide (openfga#3175) release: update changelog for release `v1.18.0` (openfga#3174) Co-authored-by: adriantam <adrian.tam@okta.com> Merge commit from fork * fix(authn): require issuer and audience when OIDC authn is enabled Enforce configuration authn.oidc.audience and authn.oidc.issuer when `authn.method` is set to `oidc`. * fixed based on code review feedback * fix: adding comments + test case on empty space for audience * update based on code review feedback * Update CHANGELOG.md Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> * update changelog * Update CHANGELOG.md --------- Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * fix(mysql): collate identifier columns as utf8mb4_bin * fix: add operator note to changelog * fix: move tests to shared storage * fix: separate migrations for each table * fix: add runbook for migrations * fix: set lock_wait_timeout * fix: add docker instructions * fix: add docker instructions * fix: combine the migrations back into one, fix documentation for this * fix: include details about table copy and * Update CHANGELOG.md Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use constant-time comparison for preshared key authentication (openfga#3168) chore(deps): bump the dependencies group with 2 updates (openfga#3166) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group with 2 updates (openfga#3167) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.17.1` (openfga#3165) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: bump grpc-health-probe to v0.4.52 (openfga#3164) Co-authored-by: Saad Hussain <saad.hussain@okta.com> docs: update caching docs (openfga#3163) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: continuation token deserializer - handle `|` in type names (openfga#3152) chore(deps): bump the dependencies group across 1 directory with 13 updates (openfga#3162) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#3156) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: use query start time as iterator cache entry LastModified to prevent stale-read survival (openfga#3155) chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in the dependencies group (openfga#3157) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore: Bump go toolchain to 1.26.4 (openfga#3159) fix: prevent v2Check from falling back for throttling and validation (openfga#3150) ci: make pr benchmark comparisons less fragile (openfga#3153) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> release: update changelog for release `v1.17.0` (openfga#3151) Co-authored-by: Vic-Dev <vmichellej@gmail.com> refactor: redesign cache key generation, making it more secure and consistent (openfga#3148) feat: add configurable trace sampler with ParentBased support (openfga#3072) release: update changelog for release `v1.16.1` (openfga#3147) chore: update grpc-health-probe to latest to addres std lib CVEs (openfga#3146) fix: skip v2Check weight2 pruning if iterator is unordered (openfga#3145) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: add concurrency-group to PR-related CI steps (openfga#3140) docs: move OIDC JWKS refresh entry from v1.15.1 to v1.16.0 (openfga#3142) fix: when v2Check is primary algorithm, fix fallback condition and emit metrics (openfga#3141) release: update changelog for release `v1.16.0` (openfga#3139) Merge commit from fork * fix: Standardize cache key generation everywhere * Revert "fix: Standardize cache key generation everywhere" This reverts commit ce60c6f9ae48a310a4dea2b824b5993520c8ba1c. * length-encoded approach * Revert "length-encoded approach" This reverts commit b94637c187c57a2d3f3904247267bbc8ad21a41a. * implement Hexer() and use in some cache keys * appendConditionsHash -> generateConditionsHash * mv Hexer -> BuildKey * BuildKey -> BuildCacheKey refactor to BuildCacheKey on each individual prefix component to remove collision risk * make v2 cacheKey functions the standard * make cache key prefixes consistent * generateConditionsHash -> generateConditionsString * delimit condition name string * remove extra empty check * relocate and reuse existing userTypeRestrictions function * replace hashing of conditions for brevity * fix tests * cleanup, add test file * remove unused slice capacity * make prefix treatments consistent * add nil-byte separator in object ids * hash user type restrictions for brevity * update comment string, use nil-byte separator for future-proofing * remove call to xxhash.new * adjustments for performance, consistency, and interface ergonomics. * make condition hash generation more efficient. * add clarifying comments for size caluculations * fix builder growth calculations to match original intentions * update outdated comment * don't hash potentially zero values * Revert "don't hash potentially zero values" This reverts commit 2ad6c5b796bc20a82c1414c5146c3c708330eefa. * add condition key separator unconditionally * patch test expectations for new key structure * export V2IteratorCachePrefix, use in tests --------- Co-authored-by: justin <justin.cohen@okta.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> fix: unintentional zeroing of slice values by setting slice to nil (openfga#3135) increase the check v2 trace information fidelity (openfga#3134) feat: add datastore ping and ping retry configurations (openfga#3113) fix: prevent v2Check strategies returning spurious false on context cancellation (openfga#3128) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix(authn/oidc): refresh JWKS on unknown kid to handle key rotation (openfga#3101) fix: v2Check falls back to v1 on errors (openfga#3126) fix: don't cache false results from cancelled-context goroutines in v2Check (openfga#3125) Signed-off-by: Saad Hussain <saad.hussain@okta.com> make union cache key unique by including the node input's label (openfga#3117) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> fix: shadow v2check and check use the same trace (openfga#3118) fix: bump go toolchain version to 1.26.3 (openfga#3115) chore: add more spans/attributes to v1 and v2 Check (openfga#3116) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: add matches attribute to shadowv2Check and Check spans (openfga#3114) fix: use the same `request_id` for shadow traces in v2Check (openfga#3110) release: update changelog for release `v1.15.1` (openfga#3112) feat: reuse MySQL container across tests (openfga#3042) fix: close all channels opened thus far, before return on error (openfga#3111) chore: Add more spans/attributes to v2Check (openfga#3102) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: ensure acquired limiter token is released on throttle context cancelation (openfga#3106) fix: cancel context before waiting on worker pool in ResolveUnionEdges (openfga#3105) fix: replace golang.org/x/exp/maps with stdlib maps to resolve govet inline errors (openfga#3104) fix: v2Check EdgeCacheKey collisions (openfga#3097) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: expose context errors when they can be the potential cause of an underlying datastore error (openfga#3096) chore(deps): bump the dependencies group across 1 directory with 2 updates (openfga#3093) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion (openfga#3095) chore(deps): bump the dependencies group with 4 updates (openfga#3092) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: error handler panic (openfga#3091) release: update changelog for release `v1.15.0` (openfga#3090) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#3087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: v2Check correctly uses query cache even when cache controller is disabled (openfga#3086) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3081) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (openfga#3085) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.47 to v0.4.48 in the dependencies group across 1 directory (openfga#3065) Signed-off-by: dependabot[bot] <support@github.com> feat: try to use UDS internally between HTTP server and gRPC server (openfga#2937) feat: add jitter to internal cache TTLs to prevent thundering herd effects (openfga#3033) Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> list objects pipeline edge pruning (openfga#3075) update toolchain go to 1.26.2 to address stdlib CVEs (openfga#3084) chore: add store ID and datastore query/item count to shadowV2Check log (openfga#3073) Signed-off-by: Saad Hussain <saad.hussain@okta.com> CI speed up (openfga#3062) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> Add tracing to v2 Check planner strategy selection (openfga#3077) fix: v2Check honours `check-query-cache-enabled` flag (openfga#3070) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: reuse PostgreSQL container across tests (openfga#3018) chore: fix reporter links in changelog (openfga#3069) release: update changelog for release `v1.14.2` (openfga#3068) fix: add null byte delimiter in contextual tuple cache keys and validation in v2Check (openfga#3064) release: update changelog for release `v1.14.1` (openfga#3060) chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3056) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use a baseURL for AuthZEN configuration endpoint (openfga#3057) chore: replace docker with moby (openfga#3047) Iterator Cache V2: Storage Wrapper Pattern with Lock-Free Design (openfga#3016) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> test: fix flaky condition test (openfga#3058) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 6 updates (openfga#3045) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 (openfga#3054) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> feat: add graceful shutdown timeout configuration (openfga#2976) chore: update changelog to reflect playground off-by-default behavior (openfga#3053) chore: decouple Error() and Unwrap() (openfga#3051) perf: remove `fmt` from cache key generation (openfga#3006) perf: enhancements for list objects (openfga#3043) chore: remove stale notice file (openfga#3050) docs: update 1.14.0 for CVE fix (openfga#3046) feat: Add datastore throttling & concurrency limiting to v2Check (openfga#3035) Signed-off-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.14.0` (openfga#3040) batch check cache (openfga#3025) Merge commit from fork Also prevent enabling playground when the server requires authentication feat: add stats on tuple iterator query (openfga#3030) fix: remove unnecessary non-deterministic test (openfga#3038) remove unnecessary import (openfga#3032) perf: improve the intersection algorithm, reducing latency and memory use (openfga#3031) fix: ListObjects pipeline algorithm enhancements and fix for potential deadlock (openfga#3028) chore: Also update openfga/helm-charts in release script (openfga#3010) chore: update CICD to enforce GRPC healthprobe changes (openfga#2990) fix: SQL `TupleOperation` serialization and `pgx.ErrNoRows` error handling (openfga#3014) docs: update changelog for CVE-2026-33729 (openfga#3017) chore: output the diff after running keep-a-changelog (openfga#3015) chore(deps): bump the dependencies group across 1 directory with 11 updates (openfga#2998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#2999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.13.1` (openfga#3002) Merge commit from fork * strip unicode control characters, encode context key length in cache key * add cache_key tests to ensure we escape control characters and encode context key length * run linter * docs: update changelog * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.h@outlook.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> release: update changelog for release `v1.13.0` (openfga#2997) refactor: Separate caches for v1 and v2 Check (openfga#2968) Co-authored-by: Justin Cohen <justincoh@gmail.com> docs: fix typos in comments (openfga#2972) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> observability: aggregate message statistics for each list-objects sender into a single span (openfga#2993) Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: capture panics in pipeline's base resolver, and return as errors. (openfga#2994) docs: fix typos in RELEASES.md and Makefile (openfga#2980) Co-authored-by: Adrian Tam <adrian.tam@okta.com> AuthZen v1.0 Implementation (openfga#2875) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Rokibul Hasan <mdrokibulhasan@appscode.com> Signed-off-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Karl Persson <kalle.persson92@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Maria Ines Parnisari <maria.inesparnisari@okta.com> Co-authored-by: Rokibul Hasan <mdrokibulhasan18@gmail.com> Co-authored-by: José Padilla <jose.padilla@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> release: update changelog for release `v1.12.1` (openfga#2992) chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (openfga#2988) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore: enforce minor version upgrade rule (openfga#2978) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> perf: tuple validation performance tweaks (openfga#2984) fix: support URI schemes in OTLP endpoint configuration (openfga#2981) refactor: remove custom pipes and replace with channels (openfga#2977) chore(docs): added caching docs (openfga#2664) Co-authored-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.12.0` (openfga#2974) chore: update toolchain go to 1.26.1 (openfga#2975) fix: update toolchain go to 1.25.8 to address stdlib CVEs (openfga#2971) fix: correct swapped format args in DecodeParameterType error message (openfga#2961) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> perf: small tweaks to tuple validation functions (openfga#2963) Co-authored-by: Vic-Dev <vmichellej@gmail.com> test: add tests for condition parameter type any with complex context structures (openfga#2959) Signed-off-by: Artem Muterko <artem@sopho.tech> test: add functional test for ReadAssertions API endpoint (openfga#2960) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> make configurable the maximum received grpc message size (openfga#2952) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> fix: set ExperimentalPipelineListObjects in experimentals by default (openfga#2957) fix: `cache_item_count` metric overcounting (openfga#2950) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#2953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refactor: Make shadowV2Check final log clearer (openfga#2946) Move telemetry package to internal/telemetry (openfga#2938) Signed-off-by: Oleksandr Shestopal <ar.shestopal-oshegithub@gmail.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore(deps): bump the dependencies group across 1 directory with 3 updates (openfga#2956) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: Resolve race condition in check reducers (openfga#2947) Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: gateway grpc client tls cert rotation (openfga#2951) Signed-off-by: Shashank Goel <goelshashank13@gmail.com> fix: disable LO pipeline if ff has it set for a store (openfga#2945) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#2949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: various random fixes (openfga#2942) refactor: check using weighted graph (openfga#2816) Co-authored-by: Yissell Garma <yissell.garma@okta.com> release: update changelog for release `v1.11.6` (openfga#2939) feat: enable pipeline algorithm by default (openfga#2921) add tests to exercise reported bug (openfga#2934) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refine AGENTS.md to make it more concise with higher value. (openfga#2936) Co-authored-by: Justin Cohen <justincoh@gmail.com> migrate grpc dial context to NewClient (openfga#2714) Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (openfga#2935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Siddhant-K-code requested a review from a team as a code owner March 15, 2026 04:39

Copilot AI review requested due to automatic review settings March 15, 2026 04:39

Copilot started reviewing on behalf of Siddhant-K-code March 15, 2026 04:40 View session

Siddhant-K-code force-pushed the fix/otel-endpoint-uri-scheme branch 2 times, most recently from a74298e to 4d90425 Compare March 15, 2026 04:42

Copilot AI reviewed Mar 15, 2026

View reviewed changes

Comment thread internal/telemetry/tracing.go Outdated

Comment thread internal/telemetry/tracing_test.go

Comment thread internal/telemetry/tracing_test.go

Siddhant-K-code force-pushed the fix/otel-endpoint-uri-scheme branch from 019ee28 to 1823455 Compare March 15, 2026 04:47

Siddhant-K-code requested a review from Copilot March 15, 2026 04:47

Copilot started reviewing on behalf of Siddhant-K-code March 15, 2026 04:47 View session

coderabbitai Bot reviewed Mar 15, 2026

View reviewed changes

Comment thread internal/telemetry/tracing.go Outdated

Copilot AI reviewed Mar 15, 2026

View reviewed changes

Comment thread internal/telemetry/tracing.go Outdated

Siddhant-K-code force-pushed the fix/otel-endpoint-uri-scheme branch from 6d5f1e7 to fdff5b6 Compare March 15, 2026 05:01

Siddhant-K-code force-pushed the fix/otel-endpoint-uri-scheme branch from fdff5b6 to 7805b57 Compare March 15, 2026 05:19

Siddhant-K-code force-pushed the fix/otel-endpoint-uri-scheme branch from 7805b57 to 4a267ae Compare March 15, 2026 05:21

senojj reviewed Mar 16, 2026

View reviewed changes

Comment thread internal/telemetry/tracing.go Outdated

senojj reviewed Mar 16, 2026

View reviewed changes

Comment thread internal/telemetry/tracing.go Outdated

Siddhant-K-code changed the title ~~fix: strip URI scheme from OTLP endpoint before passing to gRPC exporter~~ fix: support URI schemes in OTLP endpoint configuration Mar 17, 2026

docs: update changelog entry to match simplified TLS logic

fc3fd4c

Siddhant-K-code requested a review from senojj March 17, 2026 04:08

Siddhant-K-code and others added 2 commits March 17, 2026 12:41

Merge branch 'upstream-main' into fix/otel-endpoint-uri-scheme

7ef16d0

# Conflicts: # CHANGELOG.md

Update CHANGELOG.md for recent changes

e58f23b

senojj approved these changes Mar 17, 2026

View reviewed changes

Siddhant-K-code merged commit f6e0118 into openfga:main Mar 18, 2026
35 of 40 checks passed

Siddhant-K-code deleted the fix/otel-endpoint-uri-scheme branch March 18, 2026 05:24

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

Siddhant-K-code commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What changed

Backward compatibility

Related Issue(s)

How to test

Uh oh!

linux-foundation-easycla Bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

codecov Bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

senojj commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

Siddhant-K-code commented Mar 17, 2026

Uh oh!

Siddhant-K-code commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Siddhant-K-code commented Mar 15, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Mar 15, 2026 •

edited

Loading

coderabbitai Bot commented Mar 15, 2026 •

edited

Loading

codecov Bot commented Mar 15, 2026 •

edited

Loading