OpenFGA v0.3.6 is out with improved tracing, a grpc health probe and fixes to Check and ListObjects

[rhamzeh]

Hey folks!

We just released OpenFGA v0.3.6. It is a re-release of v0.3.5 due to some release pipeline issues with the previous release.

v0.3.6 comes with improved support for telemetry & tracing and a grpc health probe and fixes to Check and ListObjects.

If you are running through docker:

• If you are targeting latest, make sure to update by running docker pull openfga/openfga
• If you are targeting pinned releases, make sure to set your pinned version to: openfga/openfga:v0.3.6

Changes in this release

Added

• grpc-health-probe for Health Checks (Check permissions of multiple stores in one request #520)

  OpenFGA containers now include an embedded grpc_health_probe binary that can be used to probe the Health Check endpoints of OpenFGA servers. Take a look at the docker-compose.yaml file for an example.

• Improvements to telemetry: logging, tracing, and metrics ("Short circuiting" for rules with intersection operators #468, docs: add PlatformMesh as an adopter of OpenFGA #514, Add Distyl to adopters list #517, Migrate postgres schema programmatically? #522)

  • We have added Prometheus as the standard metrics provided for OpenFGA and provide a way to launch Grafana to view the metrics locally. See docker-compose.yaml for more information.

  • We've improved the attributes of various trace spans and made sure that trace span names align with the functions they decorate.

  • Our logging has been enhanced with more logged fields including request level logging which includes a request_id and store_id field in the log message.

  These features will allow operators of OpenFGA to improve their monitoring and observability processes.

* Nightly releases (openfga/openfga#508) - thanks @Siddhant-K-code!

You should now be able to run nightly releases of OpenFGA using docker pull openfga/openfga:nightly

(Note: Nightly releases are having some issues with our pipeline, we'll announce when that's fixed)

Fixed

• Undefined computed relations on tuplesets now behave properly (Modeling inherited entitlements #532)

  If you had a model involving two different computed relations on the same tupleset, then it's possible you may have received an internal server error if one of the computed relations was undefined. For example,

  type document
    relations
      define parent as self
      define viewer as x from parent or y from parent
  
  type folder
    relations
      define x as self
  
  type org
    relations
      define y as self
  

  Given the tuple { user: "org:contoso", relation: "parent", object: "document:1" }, then Check({ user: "jon", relation: "viewer", object: "document:1" }) would return an error prior to this fix because the x computed relation on the document#parent tupleset relation is not defined for the org object type.

• Eliminate duplicate objects in ListObjects response (chore: changed format and updated projects #528)

[Siddhant-K-code]

Nightly releases (#508) - thanks @Siddhant-K-code!

You should now be able to run nightly releases of OpenFGA using docker pull openfga/openfga:nightly

Thanks ❤️. Btw, It's docker pull openfga/openfga:latest

[rhamzeh]

Thanks @Siddhant-K-code - updated the announcement. Latest is last release, we have an issue in the release pipeline blocking the nightlies. We'll re-annoucne once that is resolved

[xXAvoraXx]

Urgent: ListObjects endpoint not working in new update.
In v0.3.4, the ListObjects query was responding in about 30 seconds, returning correct results. Now my ListObject query takes about 8 seconds and returns an empty list.

Possible causes; v0.3.6
OPENFGA_RESOLVE_NODE_LIMIT - May not see nested objects in new version.

OPENFGA_LIST_OBJECTS_DEADLINE - It may not see or detect the set time.

OPENFGA_HTTP_UPSTREAM_TIMEOUT - It may not see or detect the set time.

[xXAvoraXx]

Okay. Can you also try to reproduce the problem in a new store? Is that possible?

I deleted the openfga and postgres images and containers.
I reinstalled both and set up a new store.
My backend app has uploaded about 700 tuples to the store.

Same problem persists, Check endpoint is working but ListObject returns empty string. It runs the same query on both endpoints.

[craigpastro]

It would really help if you could give me a reproducible minimal example so that I can run it locally.

[xXAvoraXx]

Below you can find the code that creates the test data in c# language. @craigpastro

The check endpoint below should return true. This endpoint returns true when I test it.

stores/01GSJ49S8KE94F4KX1S94PTKYS/check

check endpoint is working correctly.

{
    "tuple_key": {
        "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
        "relation": "can_access",
        "object": "permission_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/PermissionService.TEST79"
    },
    "contextual_tuples": {
        "tuple_keys": [
            {
                "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
                "relation": "member_in_context",
                "object": "integrity:b4da2325-4e2c-40dd-a971-f6184496c7eb"
            },
            {
                "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
                "relation": "user_in_context",
                "object": "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1"
            }
        ]
    },
    "authorization_model_id": "01GSJ4A085K0KS8SS014Y1TXES"
}

The following ListObjects endpoint should return full. It returns empty when I test it.
stores/01GSJ49S8KE94F4KX1S94PTKYS/list-objects
Listobjects endpoint is not working correctly.

{
    "authorization_model_id": "01GSJ4A085K0KS8SS014Y1TXES",
    "type": "permission_access",
    "relation": "can_access",
    "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
    "contextual_tuples": {
        "tuple_keys": [
            {
                "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
                "relation": "member_in_context",
                "object": "integrity:b4da2325-4e2c-40dd-a971-f6184496c7eb"
            },
            {
                "user": "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2",
                "relation": "user_in_context",
                "object": "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1"
            }
        ]
    }
}

Below you can find the code that creates the test data in c# language.

public static async Task CreateTestTuples(this IApplicationBuilder app)
        {
            using (var scope = app.ApplicationServices.CreateScope())
            {
                var fgaManager = (IFgaHelper)scope.ServiceProvider.GetRequiredService(typeof(IFgaHelper));

                //configuration.GetSection("FgaOptions").Get<FgaOptions>();
                var configuration = (IConfiguration)scope.ServiceProvider.GetService(typeof(IConfiguration));

                var fgaOptions = configuration.GetSection("FgaOptions").Get<FgaOptions>();

                var plans = new List<string>()
                {
                    "plan:basic",
                    "plan:pro",
                    "plan:extreme"
                };

                var features = new List<string>()
                {
                    "feature:receipt",
                    "feature:tariff",
                    "feature:order-track",
                    "feature:multi-user",
                    "feature:report",
                    "feature:business-person",
                    "feature:kitchen",
                    "feature:product-stock",
                    "feature:multi-business",
                    "feature:product",
                };

                var pages = new List<string>()
                {
                    "page:welcome",
                    "page:hall",
                    "page:business",
                    "page:business/users",
                    "page:business/users/user",
                    "page:business/roles",
                    "page:business/roles/role",
                    "page:business/settings",
                    "page:people",
                    "page:products",
                    "page:tables",
                    "page:tariffs",
                    "page:kitchen",
                    "page:reports",
                    "page:reports/receipts",
                    "page:reports/product",
                    "page:reports/person",
                    "page:receipt",
                    "page:receipt/orders"
                };

                var tupleKeys = new List<TupleKey>();

                foreach (var feature in features)
                {
                    tupleKeys.Add(new() { User = feature, Relation = "associated_feature", Object = "feature_repo:BUSINESS" });
                }

                foreach (var plan in plans)
                {
                    tupleKeys.Add(new() { User = plan, Relation = "associated_plan", Object = "plan_repo:GLOBAL" });
                }

                foreach (var page in pages)
                {
                    tupleKeys.Add(new() { User = page, Relation = "associated_page", Object = "page_repo:BUSINESS" });
                }

                // TEST PERMISSIONS
                for (int index = 0; index < 80; index++)
                {
                    tupleKeys.Add(new() { User = "permission:PermissionService.TEST" + index, Relation = "associated_permission", Object = "permission_repo:BUSINESS" });

                }

                //plan:basic
                for (int index = 0; index < 4; index++)
                {
                    tupleKeys.Add(new() { User = plans[0], Relation = "associated_plan", Object = features[index] });
                }

                //plan:pro
                for (int index = 0; index < 8; index++)
                {
                    tupleKeys.Add(new() { User = plans[1], Relation = "associated_plan", Object = features[index] });
                }

                //plan:extreme
                for (int index = 0; index < 10; index++)
                {
                    tupleKeys.Add(new() { User = plans[2], Relation = "associated_plan", Object = features[index] });
                }

                int permInitCount = 0;
                int permFinish = 8;
                foreach (var feature in features)
                {
                    for (int b = permInitCount; b < permFinish; b++)
                    {
                        tupleKeys.Add(new() { User = feature, Relation = "associated_feature", Object = "permission:PermissionService.TEST" + b });
                    }

                    permInitCount += 8;
                    permFinish += 8;
                }

                tupleKeys.Add(new() { User = "feature:multi-user", Relation = "associated_feature", Object = "page:business/users" });
                tupleKeys.Add(new() { User = "feature:multi-user", Relation = "associated_feature", Object = "page:business/users/user" });
                tupleKeys.Add(new() { User = "feature:multi-user", Relation = "associated_feature", Object = "page:business/roles" });
                tupleKeys.Add(new() { User = "feature:multi-user", Relation = "associated_feature", Object = "page:business/roles/role" });
                tupleKeys.Add(new() { User = "feature:business", Relation = "associated_feature", Object = "page:business/settings" });
                tupleKeys.Add(new() { User = "feature:business-person", Relation = "associated_feature", Object = "page:people" });
                tupleKeys.Add(new() { User = "feature:kitchen", Relation = "associated_feature", Object = "page:kitchen" });
                tupleKeys.Add(new() { User = "feature:report", Relation = "associated_feature", Object = "page:reports" });
                tupleKeys.Add(new() { User = "feature:report", Relation = "associated_feature", Object = "page:reports/receipts" });
                tupleKeys.Add(new() { User = "feature:report", Relation = "associated_feature", Object = "page:reports/product" });
                tupleKeys.Add(new() { User = "feature:business-person", Relation = "associated_feature", Object = "page:reports/person" });



                for (int index = 0; index < 20; index++)
                {
                    var businessId = Guid.NewGuid().ToString();
                    var ownerId = Guid.NewGuid().ToString();
                    tupleKeys.Add(new() { User = "user:" + ownerId, Relation = "member", Object = "user_repo:GLOBAL" });
                    tupleKeys.Add(new() { User = "user:" + ownerId, Relation = "owner_member", Object = "business:" + businessId });
                    tupleKeys.Add(new() { User = "business:" + businessId, Relation = "parent_business", Object = "resource_access_group:" + businessId });
                    tupleKeys.Add(new() { User = "user_repo:GLOBAL", Relation = "user_repo", Object = "business:" + businessId });
                }

                // users without business
                for (int index = 0; index < 10; index++)
                {
                    var userId = Guid.NewGuid().ToString();
                    tupleKeys.Add(new() { User = "user:" + userId, Relation = "member", Object = "user_repo:GLOBAL" });
                }

                // scenerio business
                tupleKeys.Add(new() { User = "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2", Relation = "member", Object = "user_repo:GLOBAL" });
                tupleKeys.Add(new() { User = "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2", Relation = "owner_member", Object = "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1" });
                tupleKeys.Add(new() { User = "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "parent_business", Object = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1" });
                tupleKeys.Add(new() { User = "user_repo:GLOBAL", Relation = "user_repo", Object = "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1" });

                tupleKeys.Add(new() { User = "user:d1ce1fdd-c013-44cb-b4c8-d5088b70bfd2", Relation = "member", Object = "integrity:b4da2325-4e2c-40dd-a971-f6184496c7eb" });
                tupleKeys.Add(new() { User = "integrity:b4da2325-4e2c-40dd-a971-f6184496c7eb", Relation = "integrity", Object = "user_repo:GLOBAL" });

                //subscribe to plan
                tupleKeys.Add(new() { User = "business:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "subscriber", Object = "plan_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/extreme" });
                tupleKeys.Add(new() { User = "plan_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/extreme", Relation = "associated_plan_group", Object = "plan:extreme" });

                // permissions
                for (int index = 0; index < 80; index++)
                {
                    tupleKeys.Add(new() { User = "permission:PermissionService.TEST" + index, Relation = "associated_permission", Object = "permission_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/PermissionService.TEST" + index });
                    tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "permission_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/PermissionService.TEST" + index });
                }


                //pages
                tupleKeys.Add(new() { User = "page:welcome", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/welcome" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/welcome" });



                tupleKeys.Add(new() { User = "page:hall", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/hall" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/hall" });


                tupleKeys.Add(new() { User = "page:business", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business" });


                tupleKeys.Add(new() { User = "page:business/users", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/users" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/users" });


                tupleKeys.Add(new() { User = "page:business/users/user", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/users/user" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/users/user" });

                tupleKeys.Add(new() { User = "page:business/roles", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/roles" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/roles" });

                tupleKeys.Add(new() { User = "page:business/roles/role", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/roles/role" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/roles/role" });

                tupleKeys.Add(new() { User = "page:business/settings", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/settings" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/business/settings" });

                tupleKeys.Add(new() { User = "page:people", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/people" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/people" });


                tupleKeys.Add(new() { User = "page:products", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/products" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/products" });

                tupleKeys.Add(new() { User = "page:tables", Relation = "associated_page", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/tables" });
                tupleKeys.Add(new() { User = "resource_access_group:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1", Relation = "associated_resource_access_group", Object = "page_access:6a7ffbcb-2296-49ac-80da-b0e237a5c5a1/tables" });



                var initialTuplesPartition = tupleKeys.Partition(100);

                foreach (var tuples in initialTuplesPartition)
                {
                    await fgaManager.Write(new WriteRequest
                    {
                        AuthorizationModelId = fgaOptions.AuthorizationModelId,
                        Writes = new TupleKeys(tuples)
                    });
                }
            }
        }

Env vars.
OPENFGA_DATASTORE_ENGINE postgres
OPENFGA_DATASTORE_URI postgres://postgres:password@postgres:5432/postgres?sslmode=disable
OPENFGA_PLAYGROUND_ENABLED false
OPENFGA_AUTHN_METHOD preshared
OPENFGA_AUTHN_PRESHARED_KEYS keys1
OPENFGA_RESOLVE_NODE_LIMIT 120
OPENFGA_LIST_OBJECTS_DEADLINE 100s
OPENFGA_HTTP_UPSTREAM_TIMEOUT 110s

[jon-whit]

@xXAvoraXx would you please file an issue for this in https://github.com/openfga/openfga/issues?

[xXAvoraXx]

@xXAvoraXx would you please file an issue for this in https://github.com/openfga/openfga/issues?

openfga/openfga#557