Add tracing to v2 Check planner strategy selection by Vic-Dev · Pull Request #3077 · openfga/openfga

Vic-Dev · Apr 20, 2026

Description

What problem is being solved?

Adds trace attributes to the v2 Check resolution path to make planner strategy decisions observable. This helps debug slow requests by showing what choices the Thompson Sampling planner is making and how long each chosen strategy takes to execute.

Changes

At every planner decision point (specificTypeAndRelation, ttu, resolveRecursiveUserset, resolveRecursiveTTU), each span now includes:

plan_key — the planner lookup key identifying this decision point (encodes model ID, object type, relation, user type, and edge info)
strategy — the strategy selected by the planner (e.g. default, weight2, recursive)
candidate_strategies — how many strategies were eligible, distinguishing forced defaults (1) from real planner selections (2+)

In executeStrategy:

strategy_duration_ms — wall-clock time the chosen strategy took to execute

Bug fix

Fixed a pre-existing issue in resolveRecursiveUserset where span.SetAttributes(attribute.Bool("allowed", true)) was set unconditionally before executing the strategy. Replaced with the correct plan_key/strategy/candidate_strategies attributes.

How to use

In a trace viewer, filter for spans with plan_key to see all planner decisions in a request. To find sub-optimal choices, look for spans where strategy_duration_ms is high and compare the strategy selected against candidate_strategies to see if an alternative was available.

References

Review Checklist

I have clicked on "allow edits by maintainers".
I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
The correct base branch is being used, if not main
I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

Release Notes

Chores

Enhanced observability with improved tracing and monitoring metrics for the check operation system.
Added performance measurement for strategy execution and expanded tracing attributes for better insight into system operations and cache behavior.

coderabbitai · Apr 20, 2026

📝 Walkthrough

Walkthrough

Added OpenTelemetry tracing instrumentation to the v2Check method and internal check execution. Enhanced span attributes to capture plan keys, strategy selection details, candidate strategy counts, cache invalidation status, and result outcome. Improved duration measurement and error tracing.

Changes

Cohort / File(s)	Summary
Internal check tracing enhancements `internal/check/check.go`	Enhanced tracing across strategy execution and multiple planning functions (`resolveRecursiveUserset`, `resolveRecursiveTTU`, `specificTypeAndRelation`, `ttu`). Added plan_key, selected strategy, and candidate_strategies attributes; precomputed duration for consistency in stats updates.
v2Check request-level span `pkg/server/check.go`	Created explicit OpenTelemetry span at method start with request-scoped attributes (store_id, object, relation, user, consistency, cache_invalidation_active). Recorded result outcome and added error tracing before error conversion.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

feat: Add datastore throttling & concurrency limiting to v2Check #3035 — Also modifies pkg/server/check.go's v2Check method to add datastore throttling and telemetry metadata alongside tracing enhancements.

Suggested reviewers

justincoh

Poem

🐰 A span for each hop, a trace for each bound,
Strategy secrets now clearly unwound,
With plan keys and durations all measured with care,
The telemetry lights up—observability's rare! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'Add tracing to v2 Check planner strategy selection' directly aligns with the main objective of instrumenting the v2 Check resolution path with trace attributes for planner strategy decisions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/add-tracing-to-v2Check

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…ies to attributes

Copilot

Pull request overview

This PR improves observability for the v2 Check path by adding tracing attributes around planner strategy selection points and recording per-strategy execution timing, helping diagnose slow checks and understand Thompson Sampling planner choices.

Changes:

Start a dedicated v2Check span and attach request-identifying attributes plus cache invalidation state.
Add plan_key / strategy / candidate_strategies attributes to spans at key planner decision points in the v2 resolver.
Record strategy_duration_ms for chosen strategies inside executeStrategy, and remove an incorrect unconditional allowed=true span attribute in resolveRecursiveUserset.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/server/check.go	Adds a `v2Check` tracing span with request attributes, cache invalidation attribute, and error tracing.
internal/check/check.go	Adds strategy timing (`strategy_duration_ms`) and planner decision attributes (`plan_key`, `strategy`, `candidate_strategies`) across decision points; fixes an incorrect `allowed` attribute.

Comments suppressed due to low confidence (1)

pkg/server/check.go:266

In v2Check, errors returned from modelGraphResolver.Resolve currently exit without recording the error on the newly created span. Consider calling telemetry.TraceError(span, err) before returning so failed v2 check spans are marked as errors in traces (similar to the later q.Execute error handling).

	mg, err := modelGraphResolver.Resolve(ctx, storeID, req.GetAuthorizationModelId())
	if err != nil {
		return nil, err
	}

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/server/check.go (1)
286-312: ⚠️ Potential issue | 🟡 Minor

Minor: allowed attribute is recorded even on error paths.

On line 290, span.SetAttributes(attribute.Bool("allowed", res.GetAllowed())) runs before the err != nil check on line 309. When q.Execute returns an error, res is typically nil; res.GetAllowed() is nil-safe and returns false, so the span will be tagged allowed=false alongside the recorded error. That is misleading for consumers filtering on allowed=false because it conflates "denied" with "failed".
Proposed fix
 	res, metadata, err := q.Execute(ctx, req)

-	span.SetAttributes(attribute.Bool("allowed", res.GetAllowed()))
-
 	// Publish metrics from datastore metadata.
 	queryCount := float64(metadata.DatastoreQueryCount)
@@
 	if err != nil {
 		telemetry.TraceError(span, err)
 		return nil, commands.CheckCommandErrorToServerError(err)
 	}
 
+	span.SetAttributes(attribute.Bool("allowed", res.GetAllowed()))
 	return res, nil
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/server/check.go` around lines 286 - 312, The span is being annotated with
allowed via span.SetAttributes(attribute.Bool("allowed", res.GetAllowed()))
before checking err from q.Execute, which can tag failures as allowed=false;
update the logic in the function handling q.Execute so you only call
span.SetAttributes(attribute.Bool("allowed", ...)) (and any related grpc_ctxtags
update) after confirming err == nil and res != nil (i.e., move or guard the
allowed attribute-setting behind the err check), referencing q.Execute, res,
span.SetAttributes, attribute.Bool and the existing err != nil handling to
locate where to change.

🧹 Nitpick comments (3)

internal/check/check.go (2)
286-334: Minor: redundant initial strategy="default" attribute.

The span is opened with attribute.String("strategy", "default") and, in the optimization path, immediately overwritten by SetAttributes(attribute.String("strategy", strategy.Name), ...). OTel SDKs overwrite by key, so this is harmless, but the default-valued initial attribute is dead weight on that code path (same pattern in resolveRecursiveTTU, specificTypeAndRelation, and ttu).

Consider dropping the initial strategy attribute and only setting it once the selection is known. Not blocking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/check/check.go` around lines 286 - 334, The span created in
resolveRecursiveUserset (and the same pattern in resolveRecursiveTTU,
specificTypeAndRelation, and ttu) includes a redundant initial attribute
attribute.String("strategy", "default") which gets overwritten later by
span.SetAttributes when the chosen strategy is known; remove the "strategy"
attribute from the tracer.Start call(s) so the span is only annotated with
strategy once selected (keep the other attributes like tuple_key and allowed),
and continue to call span.SetAttributes(attribute.String("strategy",
strategy.Name), ...) after strategy selection as before.
327-337: Verify that plan_key attribute values are bounded-cardinality for your tracing backend.

plan_key encodes model ID + object type + relation + user type + edge info. If traces are sampled into a backend that indexes attributes (e.g., Tempo/Jaeger with attribute indexing, or exported to metrics via span-metrics), high-cardinality plan_key values can cause index blow-up or cost spikes. Worth confirming sampling/indexing config before enabling broadly. Same for resolveRecursiveTTU, specificTypeAndRelation, and ttu.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/check/check.go` around lines 327 - 337, The plan_key attribute
(created by createRecursiveUsersetPlanKey and set via span.SetAttributes) can be
high-cardinality; replace the raw plan_key with a bounded-cardinality
representation: compute and store a stable hash (e.g., sha256) as
"plan_key_hash" and optionally a very short preview (first N chars) or separate
low-cardinality fields (model id, object type, relation) instead of the full
string; update this usage in the userset planning path (where planKey is used,
and in related places like resolveRecursiveTTU, specificTypeAndRelation, and
ttu) so span.SetAttributes sets only low-cardinality attributes and the hashed
preview, and keep executeStrategy/Userset calls unchanged.
pkg/server/check.go (1)
244-253: Note: nested span with duplicate request attributes.

Server.Check already opens a span (line 46) with the same store_id/object/relation/user/consistency attributes. v2Check now opens a child span repeating them. That is fine for the shadow-check path (line 214) which builds its own context with context.Background() descent — but on the primary path the duplication is pure noise. Consider either (a) not re-setting the request attributes on the child span, or (b) for the main path, using span := trace.SpanFromContext(ctx) and only creating a dedicated span in shadowV2Check.

Non-blocking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/server/check.go` around lines 244 - 253, Server.Check opens a span with
request attributes, and v2Check currently creates a child span duplicating those
same attributes; remove the redundant attribute setting on the child span for
the primary path by using the existing span from context
(trace.SpanFromContext(ctx)) instead of starting a new span with
commands.V2CheckMethodName, and only create a dedicated span with request
attributes inside shadowV2Check (or when ctx is backgrounded) so that shadow
checks keep their attributes but the main path does not log duplicates; update
v2Check to conditionally reuse the parent span or omit attribute re-setting when
not running the shadow path.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@pkg/server/check.go`:
- Around line 286-312: The span is being annotated with allowed via
span.SetAttributes(attribute.Bool("allowed", res.GetAllowed())) before checking
err from q.Execute, which can tag failures as allowed=false; update the logic in
the function handling q.Execute so you only call
span.SetAttributes(attribute.Bool("allowed", ...)) (and any related grpc_ctxtags
update) after confirming err == nil and res != nil (i.e., move or guard the
allowed attribute-setting behind the err check), referencing q.Execute, res,
span.SetAttributes, attribute.Bool and the existing err != nil handling to
locate where to change.

---

Nitpick comments:
In `@internal/check/check.go`:
- Around line 286-334: The span created in resolveRecursiveUserset (and the same
pattern in resolveRecursiveTTU, specificTypeAndRelation, and ttu) includes a
redundant initial attribute attribute.String("strategy", "default") which gets
overwritten later by span.SetAttributes when the chosen strategy is known;
remove the "strategy" attribute from the tracer.Start call(s) so the span is
only annotated with strategy once selected (keep the other attributes like
tuple_key and allowed), and continue to call
span.SetAttributes(attribute.String("strategy", strategy.Name), ...) after
strategy selection as before.
- Around line 327-337: The plan_key attribute (created by
createRecursiveUsersetPlanKey and set via span.SetAttributes) can be
high-cardinality; replace the raw plan_key with a bounded-cardinality
representation: compute and store a stable hash (e.g., sha256) as
"plan_key_hash" and optionally a very short preview (first N chars) or separate
low-cardinality fields (model id, object type, relation) instead of the full
string; update this usage in the userset planning path (where planKey is used,
and in related places like resolveRecursiveTTU, specificTypeAndRelation, and
ttu) so span.SetAttributes sets only low-cardinality attributes and the hashed
preview, and keep executeStrategy/Userset calls unchanged.

In `@pkg/server/check.go`:
- Around line 244-253: Server.Check opens a span with request attributes, and
v2Check currently creates a child span duplicating those same attributes; remove
the redundant attribute setting on the child span for the primary path by using
the existing span from context (trace.SpanFromContext(ctx)) instead of starting
a new span with commands.V2CheckMethodName, and only create a dedicated span
with request attributes inside shadowV2Check (or when ctx is backgrounded) so
that shadow checks keep their attributes but the main path does not log
duplicates; update v2Check to conditionally reuse the parent span or omit
attribute re-setting when not running the shadow path.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 658750b4-8f8d-4794-af5d-d959e8baa443

📥 Commits

Reviewing files that changed from the base of the PR and between c9a0444 and 896d977.

📒 Files selected for processing (2)

internal/check/check.go
pkg/server/check.go

codecov · Apr 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.82%. Comparing base (c9a0444) to head (896d977).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3077      +/-   ##
==========================================
- Coverage   90.88%   90.82%   -0.06%     
==========================================
  Files         194      194              
  Lines       21456    21489      +33     
==========================================
+ Hits        19498    19515      +17     
- Misses       1297     1306       +9     
- Partials      661      668       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Add support for exporting logs via OTLP, allowing integration with any OpenTelemetry-compatible backend (Grafana Loki, Datadog, GCP Cloud Logging, etc.). When log.otlp.enabled is set, logs are exported via OTLP in addition to stdout. The otelzap bridge attaches span context (trace ID, span ID) to each log record, enabling log-trace correlation in backends that support it. Configuration mirrors the trace configuration shape: the standard OTel env vars (OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT) only answer where logs are sent, while the explicit OpenFGA flag (log.otlp.enabled / --log-otlp-enabled / OPENFGA_LOG_OTLP_ENABLED) answers whether to export at all — so a cluster that injects the generic endpoint variable for tracing does not silently start exporting logs on upgrade. zap's production sampling is applied outside the tee, so the keep/drop decision is made once, before fan-out: stdout and OTLP receive the same deterministically sampled stream and collector egress stays bounded during log storms. Changes: - Add otelzap bridge core backed by an OTLP log provider (internal/telemetry/logging.go) - Add WithOTELCore logger option that tees log entries to the bridge. The bridge core is capped to the configured log level, the stdout core strips the bridge-only context field via contextFilterCore, and the sampler wraps the tee (pkg/logger/logger.go) - Attach the context field in the *WithContext logging methods only when an OTEL core is configured, and use those methods in the gRPC logging interceptor so the bridge can extract span context (pkg/middleware/logging/logging.go) - Add config: log.otlp.enabled, log.otlp.endpoint, log.otlp.tls.enabled with OPENFGA_LOG_OTLP_* env vars and OTEL_EXPORTER_OTLP_* endpoint fallbacks (pkg/server/config/config.go, cmd/run/, .config-schema.json) feat: add potential v2 breaking change logs for Expand and ListUsers (openfga#3182) release: update changelog for release 1.18.1 (openfga#3188) release: Update changelog to prep for 1.18.1 release (openfga#3186) test: fix flaky TestV2CheckWithIteratorCache_HigherConsistencyBypassesCache (openfga#3061) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * test reproducing ListUsers report * implement fix * additional test with 3 operands fix: match IPv4-mapped IPv6 addresses in the in_cidr condition (openfga#3181) Signed-off-by: kanywst <niwatakuma@icloud.com> fix: use deterministic proto marshaling for stored authorization models (openfga#3171) chore: create draft release and publish after provenance succeeds for immutable tags/releases (openfga#3178) docs: fix changelog entry (openfga#3177) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: add v2Check logs for resolution breaking change (openfga#3149) feat: BatchCheck uses v2Check when ExperimentalWeightedGraphCheck is enabled (openfga#3154) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: update changelog to add CVE identifiers for recent fixes (openfga#3176) chore: update todo comment string in migration guide (openfga#3175) release: update changelog for release `v1.18.0` (openfga#3174) Co-authored-by: adriantam <adrian.tam@okta.com> Merge commit from fork * fix(authn): require issuer and audience when OIDC authn is enabled Enforce configuration authn.oidc.audience and authn.oidc.issuer when `authn.method` is set to `oidc`. * fixed based on code review feedback * fix: adding comments + test case on empty space for audience * update based on code review feedback * Update CHANGELOG.md Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> * update changelog * Update CHANGELOG.md --------- Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * fix(mysql): collate identifier columns as utf8mb4_bin * fix: add operator note to changelog * fix: move tests to shared storage * fix: separate migrations for each table * fix: add runbook for migrations * fix: set lock_wait_timeout * fix: add docker instructions * fix: add docker instructions * fix: combine the migrations back into one, fix documentation for this * fix: include details about table copy and * Update CHANGELOG.md Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use constant-time comparison for preshared key authentication (openfga#3168) chore(deps): bump the dependencies group with 2 updates (openfga#3166) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group with 2 updates (openfga#3167) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.17.1` (openfga#3165) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: bump grpc-health-probe to v0.4.52 (openfga#3164) Co-authored-by: Saad Hussain <saad.hussain@okta.com> docs: update caching docs (openfga#3163) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: continuation token deserializer - handle `|` in type names (openfga#3152) chore(deps): bump the dependencies group across 1 directory with 13 updates (openfga#3162) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#3156) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: use query start time as iterator cache entry LastModified to prevent stale-read survival (openfga#3155) chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in the dependencies group (openfga#3157) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore: Bump go toolchain to 1.26.4 (openfga#3159) fix: prevent v2Check from falling back for throttling and validation (openfga#3150) ci: make pr benchmark comparisons less fragile (openfga#3153) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> release: update changelog for release `v1.17.0` (openfga#3151) Co-authored-by: Vic-Dev <vmichellej@gmail.com> refactor: redesign cache key generation, making it more secure and consistent (openfga#3148) feat: add configurable trace sampler with ParentBased support (openfga#3072) release: update changelog for release `v1.16.1` (openfga#3147) chore: update grpc-health-probe to latest to addres std lib CVEs (openfga#3146) fix: skip v2Check weight2 pruning if iterator is unordered (openfga#3145) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: add concurrency-group to PR-related CI steps (openfga#3140) docs: move OIDC JWKS refresh entry from v1.15.1 to v1.16.0 (openfga#3142) fix: when v2Check is primary algorithm, fix fallback condition and emit metrics (openfga#3141) release: update changelog for release `v1.16.0` (openfga#3139) Merge commit from fork * fix: Standardize cache key generation everywhere * Revert "fix: Standardize cache key generation everywhere" This reverts commit ce60c6f9ae48a310a4dea2b824b5993520c8ba1c. * length-encoded approach * Revert "length-encoded approach" This reverts commit b94637c187c57a2d3f3904247267bbc8ad21a41a. * implement Hexer() and use in some cache keys * appendConditionsHash -> generateConditionsHash * mv Hexer -> BuildKey * BuildKey -> BuildCacheKey refactor to BuildCacheKey on each individual prefix component to remove collision risk * make v2 cacheKey functions the standard * make cache key prefixes consistent * generateConditionsHash -> generateConditionsString * delimit condition name string * remove extra empty check * relocate and reuse existing userTypeRestrictions function * replace hashing of conditions for brevity * fix tests * cleanup, add test file * remove unused slice capacity * make prefix treatments consistent * add nil-byte separator in object ids * hash user type restrictions for brevity * update comment string, use nil-byte separator for future-proofing * remove call to xxhash.new * adjustments for performance, consistency, and interface ergonomics. * make condition hash generation more efficient. * add clarifying comments for size caluculations * fix builder growth calculations to match original intentions * update outdated comment * don't hash potentially zero values * Revert "don't hash potentially zero values" This reverts commit 2ad6c5b796bc20a82c1414c5146c3c708330eefa. * add condition key separator unconditionally * patch test expectations for new key structure * export V2IteratorCachePrefix, use in tests --------- Co-authored-by: justin <justin.cohen@okta.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> fix: unintentional zeroing of slice values by setting slice to nil (openfga#3135) increase the check v2 trace information fidelity (openfga#3134) feat: add datastore ping and ping retry configurations (openfga#3113) fix: prevent v2Check strategies returning spurious false on context cancellation (openfga#3128) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix(authn/oidc): refresh JWKS on unknown kid to handle key rotation (openfga#3101) fix: v2Check falls back to v1 on errors (openfga#3126) fix: don't cache false results from cancelled-context goroutines in v2Check (openfga#3125) Signed-off-by: Saad Hussain <saad.hussain@okta.com> make union cache key unique by including the node input's label (openfga#3117) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> fix: shadow v2check and check use the same trace (openfga#3118) fix: bump go toolchain version to 1.26.3 (openfga#3115) chore: add more spans/attributes to v1 and v2 Check (openfga#3116) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: add matches attribute to shadowv2Check and Check spans (openfga#3114) fix: use the same `request_id` for shadow traces in v2Check (openfga#3110) release: update changelog for release `v1.15.1` (openfga#3112) feat: reuse MySQL container across tests (openfga#3042) fix: close all channels opened thus far, before return on error (openfga#3111) chore: Add more spans/attributes to v2Check (openfga#3102) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: ensure acquired limiter token is released on throttle context cancelation (openfga#3106) fix: cancel context before waiting on worker pool in ResolveUnionEdges (openfga#3105) fix: replace golang.org/x/exp/maps with stdlib maps to resolve govet inline errors (openfga#3104) fix: v2Check EdgeCacheKey collisions (openfga#3097) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: expose context errors when they can be the potential cause of an underlying datastore error (openfga#3096) chore(deps): bump the dependencies group across 1 directory with 2 updates (openfga#3093) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion (openfga#3095) chore(deps): bump the dependencies group with 4 updates (openfga#3092) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: error handler panic (openfga#3091) release: update changelog for release `v1.15.0` (openfga#3090) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#3087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: v2Check correctly uses query cache even when cache controller is disabled (openfga#3086) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3081) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (openfga#3085) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.47 to v0.4.48 in the dependencies group across 1 directory (openfga#3065) Signed-off-by: dependabot[bot] <support@github.com> feat: try to use UDS internally between HTTP server and gRPC server (openfga#2937) feat: add jitter to internal cache TTLs to prevent thundering herd effects (openfga#3033) Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> list objects pipeline edge pruning (openfga#3075) update toolchain go to 1.26.2 to address stdlib CVEs (openfga#3084) chore: add store ID and datastore query/item count to shadowV2Check log (openfga#3073) Signed-off-by: Saad Hussain <saad.hussain@okta.com> CI speed up (openfga#3062) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> Add tracing to v2 Check planner strategy selection (openfga#3077) fix: v2Check honours `check-query-cache-enabled` flag (openfga#3070) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: reuse PostgreSQL container across tests (openfga#3018) chore: fix reporter links in changelog (openfga#3069) release: update changelog for release `v1.14.2` (openfga#3068) fix: add null byte delimiter in contextual tuple cache keys and validation in v2Check (openfga#3064) release: update changelog for release `v1.14.1` (openfga#3060) chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3056) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use a baseURL for AuthZEN configuration endpoint (openfga#3057) chore: replace docker with moby (openfga#3047) Iterator Cache V2: Storage Wrapper Pattern with Lock-Free Design (openfga#3016) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> test: fix flaky condition test (openfga#3058) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 6 updates (openfga#3045) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 (openfga#3054) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> feat: add graceful shutdown timeout configuration (openfga#2976) chore: update changelog to reflect playground off-by-default behavior (openfga#3053) chore: decouple Error() and Unwrap() (openfga#3051) perf: remove `fmt` from cache key generation (openfga#3006) perf: enhancements for list objects (openfga#3043) chore: remove stale notice file (openfga#3050) docs: update 1.14.0 for CVE fix (openfga#3046) feat: Add datastore throttling & concurrency limiting to v2Check (openfga#3035) Signed-off-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.14.0` (openfga#3040) batch check cache (openfga#3025) Merge commit from fork Also prevent enabling playground when the server requires authentication feat: add stats on tuple iterator query (openfga#3030) fix: remove unnecessary non-deterministic test (openfga#3038) remove unnecessary import (openfga#3032) perf: improve the intersection algorithm, reducing latency and memory use (openfga#3031) fix: ListObjects pipeline algorithm enhancements and fix for potential deadlock (openfga#3028) chore: Also update openfga/helm-charts in release script (openfga#3010) chore: update CICD to enforce GRPC healthprobe changes (openfga#2990) fix: SQL `TupleOperation` serialization and `pgx.ErrNoRows` error handling (openfga#3014) docs: update changelog for CVE-2026-33729 (openfga#3017) chore: output the diff after running keep-a-changelog (openfga#3015) chore(deps): bump the dependencies group across 1 directory with 11 updates (openfga#2998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#2999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.13.1` (openfga#3002) Merge commit from fork * strip unicode control characters, encode context key length in cache key * add cache_key tests to ensure we escape control characters and encode context key length * run linter * docs: update changelog * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.h@outlook.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> release: update changelog for release `v1.13.0` (openfga#2997) refactor: Separate caches for v1 and v2 Check (openfga#2968) Co-authored-by: Justin Cohen <justincoh@gmail.com> docs: fix typos in comments (openfga#2972) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> observability: aggregate message statistics for each list-objects sender into a single span (openfga#2993) Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: capture panics in pipeline's base resolver, and return as errors. (openfga#2994) docs: fix typos in RELEASES.md and Makefile (openfga#2980) Co-authored-by: Adrian Tam <adrian.tam@okta.com> AuthZen v1.0 Implementation (openfga#2875) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Rokibul Hasan <mdrokibulhasan@appscode.com> Signed-off-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Karl Persson <kalle.persson92@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Maria Ines Parnisari <maria.inesparnisari@okta.com> Co-authored-by: Rokibul Hasan <mdrokibulhasan18@gmail.com> Co-authored-by: José Padilla <jose.padilla@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> release: update changelog for release `v1.12.1` (openfga#2992) chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (openfga#2988) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore: enforce minor version upgrade rule (openfga#2978) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> perf: tuple validation performance tweaks (openfga#2984) fix: support URI schemes in OTLP endpoint configuration (openfga#2981) refactor: remove custom pipes and replace with channels (openfga#2977) chore(docs): added caching docs (openfga#2664) Co-authored-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.12.0` (openfga#2974) chore: update toolchain go to 1.26.1 (openfga#2975) fix: update toolchain go to 1.25.8 to address stdlib CVEs (openfga#2971) fix: correct swapped format args in DecodeParameterType error message (openfga#2961) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> perf: small tweaks to tuple validation functions (openfga#2963) Co-authored-by: Vic-Dev <vmichellej@gmail.com> test: add tests for condition parameter type any with complex context structures (openfga#2959) Signed-off-by: Artem Muterko <artem@sopho.tech> test: add functional test for ReadAssertions API endpoint (openfga#2960) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> make configurable the maximum received grpc message size (openfga#2952) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> fix: set ExperimentalPipelineListObjects in experimentals by default (openfga#2957) fix: `cache_item_count` metric overcounting (openfga#2950) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#2953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refactor: Make shadowV2Check final log clearer (openfga#2946) Move telemetry package to internal/telemetry (openfga#2938) Signed-off-by: Oleksandr Shestopal <ar.shestopal-oshegithub@gmail.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore(deps): bump the dependencies group across 1 directory with 3 updates (openfga#2956) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: Resolve race condition in check reducers (openfga#2947) Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: gateway grpc client tls cert rotation (openfga#2951) Signed-off-by: Shashank Goel <goelshashank13@gmail.com> fix: disable LO pipeline if ff has it set for a store (openfga#2945) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#2949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: various random fixes (openfga#2942) refactor: check using weighted graph (openfga#2816) Co-authored-by: Yissell Garma <yissell.garma@okta.com> release: update changelog for release `v1.11.6` (openfga#2939) feat: enable pipeline algorithm by default (openfga#2921) add tests to exercise reported bug (openfga#2934) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refine AGENTS.md to make it more concise with higher value. (openfga#2936) Co-authored-by: Justin Cohen <justincoh@gmail.com> migrate grpc dial context to NewClient (openfga#2714) Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (openfga#2935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: add span to v2Check

73d40ee

fix: add strategy duration, plan_key, strategy, and candidate strateg…

896d977

…ies to attributes

Vic-Dev changed the title ~~fix: add span to v2Check~~ Add tracing to v2 Check planner strategy selection Apr 20, 2026

Vic-Dev added the Skip-Changelog Indicates that a PR does not need a changelog entry label Apr 20, 2026

Vic-Dev marked this pull request as ready for review April 20, 2026 20:21

Vic-Dev requested a review from a team as a code owner April 20, 2026 20:21

Copilot AI review requested due to automatic review settings April 20, 2026 20:21

Copilot started reviewing on behalf of Vic-Dev April 20, 2026 20:22 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Comment thread pkg/server/check.go

coderabbitai Bot reviewed Apr 20, 2026

View reviewed changes

justincoh approved these changes Apr 21, 2026

View reviewed changes

Vic-Dev merged commit f3c3621 into main Apr 21, 2026
33 of 35 checks passed

Vic-Dev deleted the fix/add-tracing-to-v2Check branch April 21, 2026 14:44

senojj pushed a commit that referenced this pull request Apr 21, 2026

Add tracing to v2 Check planner strategy selection (#3077)

0d1ebc7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add tracing to v2 Check planner strategy selection#3077

Add tracing to v2 Check planner strategy selection#3077
Vic-Dev merged 2 commits into
mainopenfga/openfga:mainfrom
fix/add-tracing-to-v2Checkopenfga/openfga:fix/add-tracing-to-v2CheckCopy head branch name to clipboard

Vic-Dev commented Apr 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

codecov Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

Vic-Dev commented Apr 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What problem is being solved?

Changes

Bug fix

How to use

References

Review Checklist

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Vic-Dev commented Apr 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading

codecov Bot commented Apr 20, 2026 •

edited

Loading