Skip to content

Commit 296eca9

Browse files
Siddhant-K-codesergiught
Siddhant-K-code
and
sergiught
authored
fix: update github.com/openfga/openfga to v1.8.13 to resolve security vulnerability (#505)
* fix: update github.com/openfga/openfga to v1.8.11 to resolve security vulnerability - Fixes GO-2025-3657: OpenFGA Authorization Bypass vulnerability - Updates github.com/openfga/openfga from v1.8.9 to v1.8.11 - Resolves build errors caused by vulnerable dependency version * lint fix * more fix * more fix * fix more tests * fix * final fix * fix * refactor: improve function parameter formatting for better readability * chore: update changelog to include OpenFGA v1.8.13 security fix * Update CHANGELOG.md --------- Co-authored-by: Sergiu Ghitea <28300158+sergiught@users.noreply.github.com>
1 parent 9442e8e commit 296eca9

34 files changed

Lines changed: 237 additions & 202 deletions

‎.golangci.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ linters:
1212
- gochecknoinits
1313
- mnd
1414
- testpackage
15+
- usetesting
1516
settings:
1617
depguard:
1718
rules:

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
#### [Unreleased](https://github.com/openfga/cli/compare/v0.6.6...HEAD)
44

5+
Fixed:
6+
- Bump OpenFGA to v1.8.13 to resolve a security vulnerability [GHSA-c72g-53hw-82q7](https://github.com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7)
7+
58

69
#### [0.6.6](https://github.com/openfga/cli/compare/v0.6.5...v0.6.6) (2025-04-23)
710

‎cmd/model/get.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ var getCmd = &cobra.Command{
4141
return fmt.Errorf("failed to initialize FGA Client due to %w", err)
4242
}
4343

44-
response, err := authorizationmodel.ReadFromStore(clientConfig, fgaClient)
44+
response, err := authorizationmodel.ReadFromStore(cmd.Context(), clientConfig, fgaClient)
4545
if err != nil {
4646
return err //nolint:wrapcheck
4747
}

‎cmd/model/get_test.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package model
22

33
import (
4-
"context"
54
"encoding/json"
65
"errors"
76
"testing"
@@ -39,11 +38,11 @@ func TestGetModelNoAuthModelID(t *testing.T) {
3938
mockRequest := mock_client.NewMockSdkClientReadLatestAuthorizationModelRequestInterface(mockCtrl)
4039
options := client.ClientReadLatestAuthorizationModelOptions{}
4140
mockRequest.EXPECT().Options(options).Return(mockExecute)
42-
mockFgaClient.EXPECT().ReadLatestAuthorizationModel(context.Background()).Return(mockRequest)
41+
mockFgaClient.EXPECT().ReadLatestAuthorizationModel(t.Context()).Return(mockRequest)
4342

4443
var clientConfig fga.ClientConfig
4544

46-
output, err := authorizationmodel.ReadFromStore(clientConfig, mockFgaClient)
45+
output, err := authorizationmodel.ReadFromStore(t.Context(), clientConfig, mockFgaClient)
4746
if err != nil {
4847
t.Fatalf("%v", err)
4948
} else if *output != expectedResponse {
@@ -75,13 +74,13 @@ func TestGetModelAuthModelID(t *testing.T) {
7574
AuthorizationModelId: openfga.PtrString("01GXSA8YR785C4FYS3C0RTG7B1"),
7675
}
7776
mockRequest.EXPECT().Options(options).Return(mockExecute)
78-
mockFgaClient.EXPECT().ReadAuthorizationModel(context.Background()).Return(mockRequest)
77+
mockFgaClient.EXPECT().ReadAuthorizationModel(t.Context()).Return(mockRequest)
7978

8079
clientConfig := fga.ClientConfig{
8180
AuthorizationModelID: "01GXSA8YR785C4FYS3C0RTG7B1",
8281
}
8382

84-
output, err := authorizationmodel.ReadFromStore(clientConfig, mockFgaClient)
83+
output, err := authorizationmodel.ReadFromStore(t.Context(), clientConfig, mockFgaClient)
8584
if err != nil {
8685
t.Fatalf("%v", err)
8786
} else if *output != expectedResponse {
@@ -106,11 +105,11 @@ func TestGetModelNoAuthModelIDError(t *testing.T) {
106105
mockRequest := mock_client.NewMockSdkClientReadLatestAuthorizationModelRequestInterface(mockCtrl)
107106
options := client.ClientReadLatestAuthorizationModelOptions{}
108107
mockRequest.EXPECT().Options(options).Return(mockExecute)
109-
mockFgaClient.EXPECT().ReadLatestAuthorizationModel(context.Background()).Return(mockRequest)
108+
mockFgaClient.EXPECT().ReadLatestAuthorizationModel(t.Context()).Return(mockRequest)
110109

111110
var clientConfig fga.ClientConfig
112111

113-
_, err := authorizationmodel.ReadFromStore(clientConfig, mockFgaClient)
112+
_, err := authorizationmodel.ReadFromStore(t.Context(), clientConfig, mockFgaClient)
114113
if err == nil {
115114
t.Fatalf("Expect error but there is none")
116115
}

‎cmd/model/list.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ import (
3333
// MaxModelsPagesLength Limit the models so that we are not paginating indefinitely.
3434
var MaxModelsPagesLength = 20
3535

36-
func listModels(fgaClient client.SdkClient, maxPages int) (*openfga.ReadAuthorizationModelsResponse, error) {
36+
func listModels(
37+
ctx context.Context, fgaClient client.SdkClient, maxPages int,
38+
) (*openfga.ReadAuthorizationModelsResponse, error) {
3739
// This is needed to ensure empty array is marshaled as [] instead of nil
3840
models := make([]openfga.AuthorizationModel, 0)
3941

@@ -46,7 +48,7 @@ func listModels(fgaClient client.SdkClient, maxPages int) (*openfga.ReadAuthoriz
4648
ContinuationToken: &continuationToken,
4749
}
4850

49-
response, err := fgaClient.ReadAuthorizationModels(context.Background()).Options(options).Execute()
51+
response, err := fgaClient.ReadAuthorizationModels(ctx).Options(options).Execute()
5052
if err != nil {
5153
return nil, fmt.Errorf("failed to list models due to %w", err)
5254
}
@@ -83,7 +85,7 @@ var listCmd = &cobra.Command{
8385
return fmt.Errorf("failed to parse max pages due to %w", err)
8486
}
8587

86-
response, err := listModels(fgaClient, maxPages)
88+
response, err := listModels(cmd.Context(), fgaClient, maxPages)
8789
if err != nil {
8890
return err
8991
}

‎cmd/model/list_test.go‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package model
22

33
import (
4-
"context"
54
"encoding/json"
65
"errors"
76
"testing"
@@ -39,9 +38,9 @@ func TestListModelsEmpty(t *testing.T) {
3938
ContinuationToken: openfga.PtrString(""),
4039
}
4140
mockRequest.EXPECT().Options(options).Return(mockExecute)
42-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest)
41+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest)
4342

44-
output, err := listModels(mockFgaClient, 5)
43+
output, err := listModels(t.Context(), mockFgaClient, 5)
4544
if err != nil {
4645
t.Error(err)
4746
}
@@ -74,9 +73,9 @@ func TestListModelsFail(t *testing.T) {
7473
ContinuationToken: openfga.PtrString(""),
7574
}
7675
mockRequest.EXPECT().Options(options).Return(mockExecute)
77-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest)
76+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest)
7877

79-
_, err := listModels(mockFgaClient, 5)
78+
_, err := listModels(t.Context(), mockFgaClient, 5)
8079
if err == nil {
8180
t.Error("Expect error but there is none")
8281
}
@@ -112,9 +111,9 @@ func TestListModelsSinglePage(t *testing.T) {
112111
ContinuationToken: openfga.PtrString(""),
113112
}
114113
mockRequest.EXPECT().Options(options).Return(mockExecute)
115-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest)
114+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest)
116115

117-
output, err := listModels(mockFgaClient, 5)
116+
output, err := listModels(t.Context(), mockFgaClient, 5)
118117
if err != nil {
119118
t.Error(err)
120119
}
@@ -191,11 +190,11 @@ func TestListModelsMultiPage(t *testing.T) {
191190
mockRequest2.EXPECT().Options(options2).Return(mockExecute2),
192191
)
193192
gomock.InOrder(
194-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest1),
195-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest2),
193+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest1),
194+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest2),
196195
)
197196

198-
output, err := listModels(mockFgaClient, 2)
197+
output, err := listModels(t.Context(), mockFgaClient, 2)
199198
if err != nil {
200199
t.Error(err)
201200
}
@@ -244,9 +243,9 @@ func TestListModelsMultiPageMaxPage(t *testing.T) {
244243
mockExecute1.EXPECT().Execute().Return(&response1, nil)
245244

246245
mockRequest1.EXPECT().Options(options1).Return(mockExecute1)
247-
mockFgaClient.EXPECT().ReadAuthorizationModels(context.Background()).Return(mockRequest1)
246+
mockFgaClient.EXPECT().ReadAuthorizationModels(t.Context()).Return(mockRequest1)
248247

249-
output, err := listModels(mockFgaClient, 0)
248+
output, err := listModels(t.Context(), mockFgaClient, 0)
250249
if err != nil {
251250
t.Error(err)
252251
}

‎cmd/model/write_test.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package model
22

33
import (
4-
"context"
54
"encoding/json"
65
"errors"
76
"testing"
@@ -45,7 +44,7 @@ func TestWriteModelFail(t *testing.T) {
4544
return
4645
}
4746

48-
_, err = Write(context.TODO(), mockFgaClient, model)
47+
_, err = Write(t.Context(), mockFgaClient, model)
4948
if err == nil {
5049
t.Fatalf("Expect error but there is none")
5150
}
@@ -87,7 +86,7 @@ func TestWriteModel(t *testing.T) {
8786
return
8887
}
8988

90-
output, err := Write(context.TODO(), mockFgaClient, model)
89+
output, err := Write(t.Context(), mockFgaClient, model)
9190
if err != nil {
9291
t.Fatal(err)
9392
}

‎cmd/query/check.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
)
3030

3131
func check(
32+
ctx context.Context,
3233
fgaClient client.SdkClient,
3334
user string,
3435
relation string,
@@ -51,7 +52,7 @@ func check(
5152
options.Consistency = consistency
5253
}
5354

54-
response, err := fgaClient.Check(context.Background()).Body(*body).Options(*options).Execute()
55+
response, err := fgaClient.Check(ctx).Body(*body).Options(*options).Execute()
5556
if err != nil {
5657
return nil, err //nolint:wrapcheck
5758
}
@@ -88,7 +89,9 @@ var checkCmd = &cobra.Command{
8889
return fmt.Errorf("error parsing consistency for check: %w", err)
8990
}
9091

91-
response, err := check(fgaClient, args[0], args[1], args[2], contextualTuples, queryContext, consistency)
92+
response, err := check(
93+
cmd.Context(), fgaClient, args[0], args[1], args[2], contextualTuples, queryContext, consistency,
94+
)
9295
if err != nil {
9396
return fmt.Errorf("check failed: %w", err)
9497
}

‎cmd/query/check_test.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package query
22

33
import (
4-
"context"
54
"errors"
65
"testing"
76

@@ -45,9 +44,10 @@ func TestCheckWithError(t *testing.T) {
4544
}
4645
mockBody.EXPECT().Body(body).Return(mockRequest)
4746

48-
mockFgaClient.EXPECT().Check(context.Background()).Return(mockBody)
47+
mockFgaClient.EXPECT().Check(t.Context()).Return(mockBody)
4948

5049
_, err := check(
50+
t.Context(),
5151
mockFgaClient,
5252
"user:foo",
5353
"writer",
@@ -97,9 +97,10 @@ func TestCheckWithNoError(t *testing.T) {
9797
}
9898
mockBody.EXPECT().Body(body).Return(mockRequest)
9999

100-
mockFgaClient.EXPECT().Check(context.Background()).Return(mockBody)
100+
mockFgaClient.EXPECT().Check(t.Context()).Return(mockBody)
101101

102102
output, err := check(
103+
t.Context(),
103104
mockFgaClient,
104105
"user:foo",
105106
"writer",
@@ -155,9 +156,10 @@ func TestCheckWithConsistency(t *testing.T) {
155156
}
156157
mockBody.EXPECT().Body(body).Return(mockRequest)
157158

158-
mockFgaClient.EXPECT().Check(context.Background()).Return(mockBody)
159+
mockFgaClient.EXPECT().Check(t.Context()).Return(mockBody)
159160

160161
output, err := check(
162+
t.Context(),
161163
mockFgaClient,
162164
"user:foo",
163165
"writer",

‎cmd/query/expand.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
)
3030

3131
func expand(
32+
ctx context.Context,
3233
fgaClient client.SdkClient,
3334
relation string,
3435
object string,
@@ -45,7 +46,7 @@ func expand(
4546
options.Consistency = consistency
4647
}
4748

48-
tuples, err := fgaClient.Expand(context.Background()).Body(*body).Options(*options).Execute()
49+
tuples, err := fgaClient.Expand(ctx).Body(*body).Options(*options).Execute()
4950
if err != nil {
5051
return nil, fmt.Errorf("failed to expand tuples due to %w", err)
5152
}
@@ -73,7 +74,7 @@ var expandCmd = &cobra.Command{
7374
return fmt.Errorf("error parsing consistency for check: %w", err)
7475
}
7576

76-
response, err := expand(fgaClient, args[0], args[1], consistency)
77+
response, err := expand(cmd.Context(), fgaClient, args[0], args[1], consistency)
7778
if err != nil {
7879
return err
7980
}

0 commit comments

Comments
 (0)