1.17.0 — ReBAC Batch Optimization & Batch Tooling

Expands batch evaluation with ReBAC optimizations, timeouts, metrics, and FastAPI integration:

• SpiceDB: async batch_check now uses a single BulkCheckPermissions gRPC call instead of N sequential CheckPermission calls

  • Results reconstructed in input order
  • Fail-closed on RPC error ([False] * N)
  • Sync mode keeps sequential fallback

• OpenFGA: batch_check([]) now returns [] immediately (no HTTP call)

• Batch timeout: evaluate_batch_async() / evaluate_batch_sync() accept timeout (seconds)

  • Enforces wall-clock deadline for the entire batch
  • Raises asyncio.TimeoutError when exceeded

• Metrics: new rbacx_batch_size metric

  • Emitted after each non-empty batch (metrics.observe("rbacx_batch_size", N))
  • Exposed as histogram in Prometheus and OpenTelemetry integrations

• FastAPI integration: new require_batch_access dependency

  • Evaluates multiple (action, resource_type) pairs in a single batch
  • Returns list[Decision] for UI-state and bulk-permission endpoints

Example:

from rbacx.adapters.fastapi import require_batch_access

@app.get("/ui-state")
async def ui_state(
    decisions=Depends(
        require_batch_access(
            guard,
            [("read", "doc"), ("write", "doc"), ("delete", "doc")],
            build_subject,
            timeout=2.0
        )
    )
):
    return {
        "can_read": decisions[0].allowed,
        "can_write": decisions[1].allowed
    }

No breaking changes

Upgrade

pip install -U rbacx