fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion by senojj · Pull Request #3095 · openfga/openfga

senojj · Apr 28, 2026

Description

When a cache entry exists, this change eliminates unnecessary goroutines and queries within ResolveRecursive. Currently ResolveRecursive is only called by ResolveUnion and ResolveUnionEdges is called by ResolveUnion and ResolveRecursive.

What problem is being solved?

Currently, when ResolveUnion calls ResolveRecursive, two goroutines are spawned and begin to execute queries for their respective subproblems. The first goroutine calls ResolveUnionEdges which checks the subproblem cache for the current request. If a request cache entry exists, it returns immediately. If the returned response has Allowed == true, the second goroutine is short-circuited via context cancelation.

ResolveUnion begins the resolution of the request subproblem for a given node; the cached request subproblem entry represents the resolution of all branches on that node, thus checking for the existence of a cache entry at the top of ResolveUnion is logical.

The spawning of the two goroutines in ResolveRecursive can be avoided entirely by moving the request subproblem cache check into ResolveUnion.

Additionally, ResolveUnionEdges is currently setting the subproblem cache entry when it fails to establish reachability. Moving the checking of the subproblem cache entry into ResolveUnion requires that we also move setting the cache entry into ResolveUnion. This is especially important when ResolveRecursive is called by ResolveUnion; when ResolveUnionEdges sets the cache to false, there is still an opportunity for the recursive edges to return a true value. If ResolveUnionEdges cached a false value for the subproblem in this scenario, subsequent calls to ResolveUnion will observe a false cache entry and return immediately.

How is it being solved?

Move the request subproblem cache lookup out of ResolveUnionEdges into ResolveUnion. This ensures that the cache is checked before ResolveRecursive is called and before ResolveUnionEdges is called, either by ResolveUnion or ResolveRecursive.

References

Review Checklist

I have clicked on "allow edits by maintainers".
I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
The correct base branch is being used, if not main
I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

Refactor
- Centralized and reorganized union-resolution caching so request-level results are checked early and actual caching is deferred until a successful computation; no user-visible behavior changes.
Tests
- Updated and refactored union-resolution tests to validate the new caching interactions and ensure correct outcomes across cached, partial-hit, and empty scenarios.

When a cache entry exists, this change eliminates unnecessary goroutines and queries within ResolveRecursive. Currently ResolveRecursive is only called by ResolveUnion and ResolveUnionEdges is called by ResolveUnion and ResolveRecursive.

coderabbitai · Apr 28, 2026

📝 Walkthrough

Walkthrough

Request-level caching for union resolution was moved from ResolveUnionEdges into ResolveUnion. ResolveUnion now checks and returns a cached *Response early and performs cache writes after successful computation; ResolveUnionEdges always computes branch results and continues using per-edge cache entries.

Changes

Cohort / File(s)	Summary
Union resolution logic `internal/check/check.go`	Shifted request-level cache check/return to `ResolveUnion`; removed early-return/cache-write behavior from `ResolveUnionEdges`. Request-level Set is deferred until successful completion in `ResolveUnion`. Per-edge caching remains in-place.
Union resolution tests `internal/check/check_test.go`	Refactored tests from `ResolveUnionEdges` to `ResolveUnion`; replaced cache-noop patterns with explicit in-memory cache expectations (`Get`/`Set`) for union and edge subproblems; updated datastore mock call expectations and response assertions.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant ResolveUnion
    participant ResolveUnionEdges
    participant RequestCache
    participant SubproblemCache
    participant Datastore

    Client->>ResolveUnion: request with cache key
    ResolveUnion->>RequestCache: Get(req.CacheKey)
    alt cache hit
        RequestCache-->>ResolveUnion: cached *Response
        ResolveUnion-->>Client: return cached *Response
    else cache miss
        ResolveUnion->>ResolveUnionEdges: compute union branches
        ResolveUnionEdges->>SubproblemCache: Get(edge cache keys...)
        alt subproblem cache hits
            SubproblemCache-->>ResolveUnionEdges: cached branch results
        else misses
            ResolveUnionEdges->>Datastore: ReadUserTuple (for missing edges)
            Datastore-->>ResolveUnionEdges: edge results
            ResolveUnionEdges->>SubproblemCache: Set(subproblem results)
        end
        ResolveUnionEdges-->>ResolveUnion: aggregated *Response
        ResolveUnion->>RequestCache: Set(req.CacheKey, *Response) (on success)
        ResolveUnion-->>Client: return computed *Response
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

fix: various random fixes #2942: Modifies caching control flow in internal/check/check.go — closely related to moving request-level cache behavior.

Suggested reviewers

saad-h1

Poem

🐰
I hopped through keys and branches bright,
Moved the root check to set things right,
Per-edge crumbs still line the trail,
Now the union's cache tells the tale,
A tiny hop, a steadier flight. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: moving subproblem cache lookup responsibility from ResolveUnionEdges to ResolveUnion, which aligns with the core refactoring shown in the file summaries.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/v2-check-union-cache

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · Apr 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.24%. Comparing base (04e7311) to head (6b2ba1b).
⚠️ Report is 1 commits behind head on main.

❌ Your project status has failed because the head coverage (80.24%) is below the target coverage (85.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3095      +/-   ##
==========================================
+ Coverage   79.99%   80.24%   +0.26%     
==========================================
  Files         191      196       +5     
  Lines       20623    21685    +1062     
==========================================
+ Hits        16495    17399     +904     
- Misses       3410     3526     +116     
- Partials      718      760      +42

Flag	Coverage Δ
matrix	`84.83% <ø> (?)`
storage	`86.28% <ø> (ø)`
unit	`78.97% <100.00%> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Check v2 unit tests now reflect the move of the subproblem cache management to ResolveUnion. Tests have been updated to ensure that the ResolveUnion subproblem cache is read from and written to as expected.

coderabbitai

♻️ Duplicate comments (1)

internal/check/check_test.go (1)

115-118: ⚠️ Potential issue | 🟡 Minor

Tighten edge-cache Get matchers to exclude the subproblem key.

Line 115 and Line 118 still use Get(gomock.Any()). That can accidentally absorb extra req.GetCacheKey() lookups and mask regressions between subproblem-level and edge-level cache access.

Suggested fix

+ edgeKeyMatcher := gomock.Not(gomock.Eq(req.GetCacheKey()))
+
- mockCache.EXPECT().Get(gomock.Any()).Return(cachedFalse).Times(1)
+ mockCache.EXPECT().Get(edgeKeyMatcher).Return(cachedFalse).Times(1)

- mockCache.EXPECT().Get(gomock.Any()).Return(nil).Times(2)
+ mockCache.EXPECT().Get(edgeKeyMatcher).Return(nil).Times(2)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/check/check_test.go` around lines 115 - 118, The mock expectations
for mockCache.EXPECT().Get currently use gomock.Any(), which can match the
subproblem cache key and mask regressions; tighten these to explicitly exclude
the subproblem key by replacing gomock.Any() in the two edge-level expectations
with a matcher that is not equal to req.GetCacheKey(), e.g. use
gomock.Not(gomock.Eq(req.GetCacheKey())) when setting mockCache.EXPECT().Get for
the edge calls so subproblem-level Get calls are not absorbed.

🧹 Nitpick comments (1)

internal/check/check_test.go (1)

182-188: Consider restoring an upper bound for short-circuit datastore calls.

Line 188 now only enforces MinTimes(1). Adding MaxTimes(2) keeps the short-circuit test stricter against unexpected extra reads.

Suggested fix

- }).MinTimes(1)
+ }).MinTimes(1).MaxTimes(2)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/check/check_test.go` around lines 182 - 188, The test's mock
expectation for mockDatastore.EXPECT().ReadUserTuple currently uses MinTimes(1)
which allows unbounded extra calls; tighten it by adding a MaxTimes(2) to
enforce the intended short-circuit behavior (i.e., change the expectation on
ReadUserTuple to MinTimes(1).MaxTimes(2)) so unexpected extra reads are
caught—keep the existing DoAndReturn logic that checks filter.Relation ==
"admin" and returns storage.ErrNotFound for that case.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@internal/check/check_test.go`:
- Around line 115-118: The mock expectations for mockCache.EXPECT().Get
currently use gomock.Any(), which can match the subproblem cache key and mask
regressions; tighten these to explicitly exclude the subproblem key by replacing
gomock.Any() in the two edge-level expectations with a matcher that is not equal
to req.GetCacheKey(), e.g. use gomock.Not(gomock.Eq(req.GetCacheKey())) when
setting mockCache.EXPECT().Get for the edge calls so subproblem-level Get calls
are not absorbed.

---

Nitpick comments:
In `@internal/check/check_test.go`:
- Around line 182-188: The test's mock expectation for
mockDatastore.EXPECT().ReadUserTuple currently uses MinTimes(1) which allows
unbounded extra calls; tighten it by adding a MaxTimes(2) to enforce the
intended short-circuit behavior (i.e., change the expectation on ReadUserTuple
to MinTimes(1).MaxTimes(2)) so unexpected extra reads are caught—keep the
existing DoAndReturn logic that checks filter.Relation == "admin" and returns
storage.ErrNotFound for that case.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4dde4ed3-3c40-45b8-8a25-02ae42a23c09

📥 Commits

Reviewing files that changed from the base of the PR and between 31feec5 and 6b2ba1b.

📒 Files selected for processing (2)

internal/check/check.go
internal/check/check_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

internal/check/check.go

coderabbitai

♻️ Duplicate comments (1)

internal/check/check_test.go (1)

115-118: ⚠️ Potential issue | 🟡 Minor

Narrow edge-cache Get matchers to exclude the subproblem key.

Get(gomock.Any()) can still consume req.GetCacheKey() calls, which weakens this test’s ability to catch regressions between union-level and edge-level caching.

Suggested tightening

+		edgeKeyMatcher := gomock.Not(gomock.Eq(req.GetCacheKey()))
+
 		// simulate an edge with a cached false result
-		mockCache.EXPECT().Get(gomock.Any()).Return(cachedFalse).Times(1)
+		mockCache.EXPECT().Get(edgeKeyMatcher).Return(cachedFalse).Times(1)

 		// other two edges call cache, but get nothing
-		mockCache.EXPECT().Get(gomock.Any()).Return(nil).Times(2)
+		mockCache.EXPECT().Get(edgeKeyMatcher).Return(nil).Times(2)

 		// each edge sets the results of its resolution
 		edgeCacheSets := mockCache.EXPECT().
-			Set(gomock.Not(gomock.Eq(req.GetCacheKey())), gomock.Any(), gomock.Any()).
+			Set(edgeKeyMatcher, gomock.Any(), gomock.Any()).
 			Times(2)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/check/check_test.go` around lines 115 - 118, The test currently uses
mockCache.EXPECT().Get(gomock.Any()) which can match the union-level subproblem
key (req.GetCacheKey()) and mask regressions; change the two edge-cache
expectations to narrow the matcher so they exclude the subproblem key (e.g.
mockCache.EXPECT().Get(gomock.Not(gomock.Eq(req.GetCacheKey()))).Return(nil).Times(2))
while leaving the first expectation that returns cachedFalse targeting the exact
key it should match; update references to mockCache.Get, gomock.Any, and
req.GetCacheKey() accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@internal/check/check_test.go`:
- Around line 115-118: The test currently uses
mockCache.EXPECT().Get(gomock.Any()) which can match the union-level subproblem
key (req.GetCacheKey()) and mask regressions; change the two edge-cache
expectations to narrow the matcher so they exclude the subproblem key (e.g.
mockCache.EXPECT().Get(gomock.Not(gomock.Eq(req.GetCacheKey()))).Return(nil).Times(2))
while leaving the first expectation that returns cachedFalse targeting the exact
key it should match; update references to mockCache.Get, gomock.Any, and
req.GetCacheKey() accordingly.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fe939188-a008-4e2b-85c7-9ece76ad912c

📥 Commits

Reviewing files that changed from the base of the PR and between 31feec5 and 6b2ba1b.

📒 Files selected for processing (2)

internal/check/check.go
internal/check/check_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

internal/check/check.go

Add support for exporting logs via OTLP, allowing integration with any OpenTelemetry-compatible backend (Grafana Loki, Datadog, GCP Cloud Logging, etc.). When log.otlp.enabled is set, logs are exported via OTLP in addition to stdout. The otelzap bridge attaches span context (trace ID, span ID) to each log record, enabling log-trace correlation in backends that support it. Configuration mirrors the trace configuration shape: the standard OTel env vars (OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT) only answer where logs are sent, while the explicit OpenFGA flag (log.otlp.enabled / --log-otlp-enabled / OPENFGA_LOG_OTLP_ENABLED) answers whether to export at all — so a cluster that injects the generic endpoint variable for tracing does not silently start exporting logs on upgrade. zap's production sampling is applied outside the tee, so the keep/drop decision is made once, before fan-out: stdout and OTLP receive the same deterministically sampled stream and collector egress stays bounded during log storms. Changes: - Add otelzap bridge core backed by an OTLP log provider (internal/telemetry/logging.go) - Add WithOTELCore logger option that tees log entries to the bridge. The bridge core is capped to the configured log level, the stdout core strips the bridge-only context field via contextFilterCore, and the sampler wraps the tee (pkg/logger/logger.go) - Attach the context field in the *WithContext logging methods only when an OTEL core is configured, and use those methods in the gRPC logging interceptor so the bridge can extract span context (pkg/middleware/logging/logging.go) - Add config: log.otlp.enabled, log.otlp.endpoint, log.otlp.tls.enabled with OPENFGA_LOG_OTLP_* env vars and OTEL_EXPORTER_OTLP_* endpoint fallbacks (pkg/server/config/config.go, cmd/run/, .config-schema.json) feat: add potential v2 breaking change logs for Expand and ListUsers (openfga#3182) release: update changelog for release 1.18.1 (openfga#3188) release: Update changelog to prep for 1.18.1 release (openfga#3186) test: fix flaky TestV2CheckWithIteratorCache_HigherConsistencyBypassesCache (openfga#3061) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * test reproducing ListUsers report * implement fix * additional test with 3 operands fix: match IPv4-mapped IPv6 addresses in the in_cidr condition (openfga#3181) Signed-off-by: kanywst <niwatakuma@icloud.com> fix: use deterministic proto marshaling for stored authorization models (openfga#3171) chore: create draft release and publish after provenance succeeds for immutable tags/releases (openfga#3178) docs: fix changelog entry (openfga#3177) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: add v2Check logs for resolution breaking change (openfga#3149) feat: BatchCheck uses v2Check when ExperimentalWeightedGraphCheck is enabled (openfga#3154) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: update changelog to add CVE identifiers for recent fixes (openfga#3176) chore: update todo comment string in migration guide (openfga#3175) release: update changelog for release `v1.18.0` (openfga#3174) Co-authored-by: adriantam <adrian.tam@okta.com> Merge commit from fork * fix(authn): require issuer and audience when OIDC authn is enabled Enforce configuration authn.oidc.audience and authn.oidc.issuer when `authn.method` is set to `oidc`. * fixed based on code review feedback * fix: adding comments + test case on empty space for audience * update based on code review feedback * Update CHANGELOG.md Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> * update changelog * Update CHANGELOG.md --------- Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * fix(mysql): collate identifier columns as utf8mb4_bin * fix: add operator note to changelog * fix: move tests to shared storage * fix: separate migrations for each table * fix: add runbook for migrations * fix: set lock_wait_timeout * fix: add docker instructions * fix: add docker instructions * fix: combine the migrations back into one, fix documentation for this * fix: include details about table copy and * Update CHANGELOG.md Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use constant-time comparison for preshared key authentication (openfga#3168) chore(deps): bump the dependencies group with 2 updates (openfga#3166) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group with 2 updates (openfga#3167) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.17.1` (openfga#3165) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: bump grpc-health-probe to v0.4.52 (openfga#3164) Co-authored-by: Saad Hussain <saad.hussain@okta.com> docs: update caching docs (openfga#3163) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: continuation token deserializer - handle `|` in type names (openfga#3152) chore(deps): bump the dependencies group across 1 directory with 13 updates (openfga#3162) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#3156) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: use query start time as iterator cache entry LastModified to prevent stale-read survival (openfga#3155) chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in the dependencies group (openfga#3157) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore: Bump go toolchain to 1.26.4 (openfga#3159) fix: prevent v2Check from falling back for throttling and validation (openfga#3150) ci: make pr benchmark comparisons less fragile (openfga#3153) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> release: update changelog for release `v1.17.0` (openfga#3151) Co-authored-by: Vic-Dev <vmichellej@gmail.com> refactor: redesign cache key generation, making it more secure and consistent (openfga#3148) feat: add configurable trace sampler with ParentBased support (openfga#3072) release: update changelog for release `v1.16.1` (openfga#3147) chore: update grpc-health-probe to latest to addres std lib CVEs (openfga#3146) fix: skip v2Check weight2 pruning if iterator is unordered (openfga#3145) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: add concurrency-group to PR-related CI steps (openfga#3140) docs: move OIDC JWKS refresh entry from v1.15.1 to v1.16.0 (openfga#3142) fix: when v2Check is primary algorithm, fix fallback condition and emit metrics (openfga#3141) release: update changelog for release `v1.16.0` (openfga#3139) Merge commit from fork * fix: Standardize cache key generation everywhere * Revert "fix: Standardize cache key generation everywhere" This reverts commit ce60c6f9ae48a310a4dea2b824b5993520c8ba1c. * length-encoded approach * Revert "length-encoded approach" This reverts commit b94637c187c57a2d3f3904247267bbc8ad21a41a. * implement Hexer() and use in some cache keys * appendConditionsHash -> generateConditionsHash * mv Hexer -> BuildKey * BuildKey -> BuildCacheKey refactor to BuildCacheKey on each individual prefix component to remove collision risk * make v2 cacheKey functions the standard * make cache key prefixes consistent * generateConditionsHash -> generateConditionsString * delimit condition name string * remove extra empty check * relocate and reuse existing userTypeRestrictions function * replace hashing of conditions for brevity * fix tests * cleanup, add test file * remove unused slice capacity * make prefix treatments consistent * add nil-byte separator in object ids * hash user type restrictions for brevity * update comment string, use nil-byte separator for future-proofing * remove call to xxhash.new * adjustments for performance, consistency, and interface ergonomics. * make condition hash generation more efficient. * add clarifying comments for size caluculations * fix builder growth calculations to match original intentions * update outdated comment * don't hash potentially zero values * Revert "don't hash potentially zero values" This reverts commit 2ad6c5b796bc20a82c1414c5146c3c708330eefa. * add condition key separator unconditionally * patch test expectations for new key structure * export V2IteratorCachePrefix, use in tests --------- Co-authored-by: justin <justin.cohen@okta.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> fix: unintentional zeroing of slice values by setting slice to nil (openfga#3135) increase the check v2 trace information fidelity (openfga#3134) feat: add datastore ping and ping retry configurations (openfga#3113) fix: prevent v2Check strategies returning spurious false on context cancellation (openfga#3128) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix(authn/oidc): refresh JWKS on unknown kid to handle key rotation (openfga#3101) fix: v2Check falls back to v1 on errors (openfga#3126) fix: don't cache false results from cancelled-context goroutines in v2Check (openfga#3125) Signed-off-by: Saad Hussain <saad.hussain@okta.com> make union cache key unique by including the node input's label (openfga#3117) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> fix: shadow v2check and check use the same trace (openfga#3118) fix: bump go toolchain version to 1.26.3 (openfga#3115) chore: add more spans/attributes to v1 and v2 Check (openfga#3116) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: add matches attribute to shadowv2Check and Check spans (openfga#3114) fix: use the same `request_id` for shadow traces in v2Check (openfga#3110) release: update changelog for release `v1.15.1` (openfga#3112) feat: reuse MySQL container across tests (openfga#3042) fix: close all channels opened thus far, before return on error (openfga#3111) chore: Add more spans/attributes to v2Check (openfga#3102) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: ensure acquired limiter token is released on throttle context cancelation (openfga#3106) fix: cancel context before waiting on worker pool in ResolveUnionEdges (openfga#3105) fix: replace golang.org/x/exp/maps with stdlib maps to resolve govet inline errors (openfga#3104) fix: v2Check EdgeCacheKey collisions (openfga#3097) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: expose context errors when they can be the potential cause of an underlying datastore error (openfga#3096) chore(deps): bump the dependencies group across 1 directory with 2 updates (openfga#3093) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion (openfga#3095) chore(deps): bump the dependencies group with 4 updates (openfga#3092) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: error handler panic (openfga#3091) release: update changelog for release `v1.15.0` (openfga#3090) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#3087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: v2Check correctly uses query cache even when cache controller is disabled (openfga#3086) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3081) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (openfga#3085) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.47 to v0.4.48 in the dependencies group across 1 directory (openfga#3065) Signed-off-by: dependabot[bot] <support@github.com> feat: try to use UDS internally between HTTP server and gRPC server (openfga#2937) feat: add jitter to internal cache TTLs to prevent thundering herd effects (openfga#3033) Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> list objects pipeline edge pruning (openfga#3075) update toolchain go to 1.26.2 to address stdlib CVEs (openfga#3084) chore: add store ID and datastore query/item count to shadowV2Check log (openfga#3073) Signed-off-by: Saad Hussain <saad.hussain@okta.com> CI speed up (openfga#3062) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> Add tracing to v2 Check planner strategy selection (openfga#3077) fix: v2Check honours `check-query-cache-enabled` flag (openfga#3070) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: reuse PostgreSQL container across tests (openfga#3018) chore: fix reporter links in changelog (openfga#3069) release: update changelog for release `v1.14.2` (openfga#3068) fix: add null byte delimiter in contextual tuple cache keys and validation in v2Check (openfga#3064) release: update changelog for release `v1.14.1` (openfga#3060) chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3056) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use a baseURL for AuthZEN configuration endpoint (openfga#3057) chore: replace docker with moby (openfga#3047) Iterator Cache V2: Storage Wrapper Pattern with Lock-Free Design (openfga#3016) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> test: fix flaky condition test (openfga#3058) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 6 updates (openfga#3045) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 (openfga#3054) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> feat: add graceful shutdown timeout configuration (openfga#2976) chore: update changelog to reflect playground off-by-default behavior (openfga#3053) chore: decouple Error() and Unwrap() (openfga#3051) perf: remove `fmt` from cache key generation (openfga#3006) perf: enhancements for list objects (openfga#3043) chore: remove stale notice file (openfga#3050) docs: update 1.14.0 for CVE fix (openfga#3046) feat: Add datastore throttling & concurrency limiting to v2Check (openfga#3035) Signed-off-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.14.0` (openfga#3040) batch check cache (openfga#3025) Merge commit from fork Also prevent enabling playground when the server requires authentication feat: add stats on tuple iterator query (openfga#3030) fix: remove unnecessary non-deterministic test (openfga#3038) remove unnecessary import (openfga#3032) perf: improve the intersection algorithm, reducing latency and memory use (openfga#3031) fix: ListObjects pipeline algorithm enhancements and fix for potential deadlock (openfga#3028) chore: Also update openfga/helm-charts in release script (openfga#3010) chore: update CICD to enforce GRPC healthprobe changes (openfga#2990) fix: SQL `TupleOperation` serialization and `pgx.ErrNoRows` error handling (openfga#3014) docs: update changelog for CVE-2026-33729 (openfga#3017) chore: output the diff after running keep-a-changelog (openfga#3015) chore(deps): bump the dependencies group across 1 directory with 11 updates (openfga#2998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#2999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.13.1` (openfga#3002) Merge commit from fork * strip unicode control characters, encode context key length in cache key * add cache_key tests to ensure we escape control characters and encode context key length * run linter * docs: update changelog * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.h@outlook.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> release: update changelog for release `v1.13.0` (openfga#2997) refactor: Separate caches for v1 and v2 Check (openfga#2968) Co-authored-by: Justin Cohen <justincoh@gmail.com> docs: fix typos in comments (openfga#2972) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> observability: aggregate message statistics for each list-objects sender into a single span (openfga#2993) Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: capture panics in pipeline's base resolver, and return as errors. (openfga#2994) docs: fix typos in RELEASES.md and Makefile (openfga#2980) Co-authored-by: Adrian Tam <adrian.tam@okta.com> AuthZen v1.0 Implementation (openfga#2875) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Rokibul Hasan <mdrokibulhasan@appscode.com> Signed-off-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Karl Persson <kalle.persson92@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Maria Ines Parnisari <maria.inesparnisari@okta.com> Co-authored-by: Rokibul Hasan <mdrokibulhasan18@gmail.com> Co-authored-by: José Padilla <jose.padilla@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> release: update changelog for release `v1.12.1` (openfga#2992) chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (openfga#2988) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore: enforce minor version upgrade rule (openfga#2978) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> perf: tuple validation performance tweaks (openfga#2984) fix: support URI schemes in OTLP endpoint configuration (openfga#2981) refactor: remove custom pipes and replace with channels (openfga#2977) chore(docs): added caching docs (openfga#2664) Co-authored-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.12.0` (openfga#2974) chore: update toolchain go to 1.26.1 (openfga#2975) fix: update toolchain go to 1.25.8 to address stdlib CVEs (openfga#2971) fix: correct swapped format args in DecodeParameterType error message (openfga#2961) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> perf: small tweaks to tuple validation functions (openfga#2963) Co-authored-by: Vic-Dev <vmichellej@gmail.com> test: add tests for condition parameter type any with complex context structures (openfga#2959) Signed-off-by: Artem Muterko <artem@sopho.tech> test: add functional test for ReadAssertions API endpoint (openfga#2960) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> make configurable the maximum received grpc message size (openfga#2952) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> fix: set ExperimentalPipelineListObjects in experimentals by default (openfga#2957) fix: `cache_item_count` metric overcounting (openfga#2950) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#2953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refactor: Make shadowV2Check final log clearer (openfga#2946) Move telemetry package to internal/telemetry (openfga#2938) Signed-off-by: Oleksandr Shestopal <ar.shestopal-oshegithub@gmail.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore(deps): bump the dependencies group across 1 directory with 3 updates (openfga#2956) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: Resolve race condition in check reducers (openfga#2947) Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: gateway grpc client tls cert rotation (openfga#2951) Signed-off-by: Shashank Goel <goelshashank13@gmail.com> fix: disable LO pipeline if ff has it set for a store (openfga#2945) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#2949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: various random fixes (openfga#2942) refactor: check using weighted graph (openfga#2816) Co-authored-by: Yissell Garma <yissell.garma@okta.com> release: update changelog for release `v1.11.6` (openfga#2939) feat: enable pipeline algorithm by default (openfga#2921) add tests to exercise reported bug (openfga#2934) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refine AGENTS.md to make it more concise with higher value. (openfga#2936) Co-authored-by: Justin Cohen <justincoh@gmail.com> migrate grpc dial context to NewClient (openfga#2714) Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (openfga#2935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

senojj requested review from Copilot, saad-h1 and yissellokta April 28, 2026 16:26

senojj requested a review from a team as a code owner April 28, 2026 16:26

senojj added the bug Something isn't working label Apr 28, 2026

Copilot started reviewing on behalf of senojj April 28, 2026 16:27 View session

senojj added the Skip-Changelog Indicates that a PR does not need a changelog entry label Apr 28, 2026

This comment was marked as outdated.

Sign in to view

senojj marked this pull request as draft April 28, 2026 16:33

senojj requested a review from Copilot April 28, 2026 18:11

Copilot started reviewing on behalf of senojj April 28, 2026 18:11 View session

This comment was marked as resolved.

Sign in to view

only set the request subproblem cache entry when ResolveUnion returns

9ad0f18

senojj force-pushed the fix/v2-check-union-cache branch 2 times, most recently from 0a03499 to 03de449 Compare April 28, 2026 18:44

update tests

3fb3db6

Check v2 unit tests now reflect the move of the subproblem cache management to ResolveUnion. Tests have been updated to ensure that the ResolveUnion subproblem cache is read from and written to as expected.

senojj force-pushed the fix/v2-check-union-cache branch from 03de449 to 3fb3db6 Compare April 28, 2026 18:49

set min datastore calls in short-circuit test

6b2ba1b

coderabbitai Bot reviewed Apr 28, 2026

View reviewed changes

senojj marked this pull request as ready for review April 28, 2026 19:46

coderabbitai Bot reviewed Apr 28, 2026

View reviewed changes

saad-h1 approved these changes Apr 28, 2026

View reviewed changes

senojj merged commit 5ec1c4d into main Apr 28, 2026
33 of 36 checks passed

senojj deleted the fix/v2-check-union-cache branch April 28, 2026 20:21

This was referenced May 4, 2026

fix: cancel context before waiting on worker pool in ResolveUnionEdges #3105

Merged

chore: add more spans/attributes to v1 and v2 Check #3116

Merged

This was referenced May 8, 2026

fix: move v2Check union cache to edge-level in ResolveUnionEdges and ResolveRecursive #3117

Merged

fix: don't cache false results from cancelled-context goroutines in v2Check #3125

Merged

coderabbitai Bot mentioned this pull request May 19, 2026

fix: unintentional zeroing of slice values by setting slice to nil #3135

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion#3095

fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion#3095
senojj merged 4 commits into
mainopenfga/openfga:mainfrom
fix/v2-check-union-cacheopenfga/openfga:fix/v2-check-union-cacheCopy head branch name to clipboard

senojj commented Apr 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

senojj commented Apr 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What problem is being solved?

How is it being solved?

References

Review Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

senojj commented Apr 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading

codecov Bot commented Apr 28, 2026 •

edited

Loading