build(deps): bump github.com/openfga/openfga from 1.5.3 to 1.5.4

[dependabot]

Bumps github.com/openfga/openfga from 1.5.3 to 1.5.4.

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.5.4

Added

• ListUsers API which answers the question "what users are related to a specific object?". This feature is experimental and can be enabled by configuring OPENFGA_EXPERIMENTALS=enable-list-users. Also see Performing a ListUsers call and ListUsers API docs. Known Limitation: Child usersets that are negated from their parent are currently not returned as excluded_users #1433
• ListObjects throttling to manage resource usage of expensive queries. Throttling improves overall query performance by limiting the number of dispatches, which are the recursive sub-operations of a ListObjects query #1571
• Per-request dispatch throttling threshold configuration via context #1546
• Self-defining usersets for Check, ListObjects and ListUsers. These are implicit tuples that exist by virtue of set theory. For example, the userset document:1#viewer implicitly possess the viewer relation for document:1 #1521
• Panic recovery handling for all APIs #1557
• Logging of non-sensitive server configuration on startup #1609
• Appropriate error codes for throttled requests indicating if a request should be retried #1552
• Minor performance improvements in Check API by reducing quantity of spans created #1550, #1589

Fixed

• Goroutine leak occurring during initial server validation #1617
• Stricter filtering of invalid tuples with ListObjects #1563
• Panic on server close if caching is enabled #1568
• Prevent calling datastore if context has error #1593

Changed

• request_id is now same as trace_id (e.g. 1e20da43269fe07e3d2ac018c0aad2d1) if tracing is enabled. Otherwise, remains an UUID (e.g. 38fee7ac-4bfe-4cf6-baa2-8b5ec296b485) #1576 - thank you, @​00chorch

Removed

• request_duration_by_query_count_ms metric #1579

v1.5.4-rc1

The v1.5.4-rc1 release is an experimental release candidate that introduces support for the ListUsers API. This endpoint answers the question "what users have relation X with object Y?". This can be used for use cases like share dialogues and notifying users on document changes.

This API can be enabled in the server by passing the --experimentals enable-list-users flag. Also note the OPENFGA_LIST_USERS_MAX_RESULTS, OPENFGA_LIST_USERS_DEADLINE and OPENFGA_MAX_CONCURRENT_READS_FOR_LIST_USERS configuration options.

Note: This is not ready for production use. Currently outstanding issues:

• Excluded users are not supported, which impacts models that pair wildcards (e.g. user:*) with exclusion (e.g. but not)
• Chaining multiple exclusion (e.g. but not) operands may not return accurate set of results

Related resources:

• ListUsers API Documentation
• ListUsers RFC
• ListUsers Roadmap Item

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.5.4] - 2024-05-29

Full changelog

Added

• ListUsers API which answers the question "what users are related to a specific object?". This feature is experimental and can be enabled by configuring OPENFGA_EXPERIMENTALS=enable-list-users. Also see Performing a ListUsers call and ListUsers API docs. Known Limitation: Child usersets that are negated from their parent are currently not returned as excluded_users #1433
• ListObjects throttling to manage resource usage of expensive queries. Throttling improves overall query performance by limiting the number of dispatches, which are the recursive sub-operations of a ListObjects query #1571
• Per-request dispatch throttling threshold configuration via context #1546
• Self-defining usersets for Check, ListObjects and ListUsers. These are implicit tuples that exist by virtue of set theory. For example, the userset document:1#viewer implicitly possess the viewer relation for document:1 #1521
• Panic recovery handling for all APIs #1557
• Logging of non-sensitive server configuration on startup #1609
• Appropriate error codes for throttled requests indicating if a request should be retried #1552
• Minor performance improvements in Check API by reducing quantity of spans created #1550, #1589

Fixed

• Goroutine leak occurring during initial server validation #1617
• Stricter filtering of invalid tuples with ListObjects #1563
• Panic on server close if caching is enabled #1568
• Prevent calling datastore if context has error #1593

Changed

• request_id is now same as trace_id (e.g. 1e20da43269fe07e3d2ac018c0aad2d1) if tracing is enabled. Otherwise, remains an UUID (e.g. 38fee7ac-4bfe-4cf6-baa2-8b5ec296b485) #1576 - thank you, @​00chorch

Removed

• request_duration_by_query_count_ms metric #1579

Commits

• 5feb1c8 docs(v1.5.4): add v1.5.4 release notes to CHANGELOG (#1644)
• 39589af chore(deps): bump protobuf dependency for openfga/api (#1648)
• 8812d3e chore: revert "feat: Added Contextual Tuples to Assertions API (#1610)" (#1646)
• 89736da ListUsers API (#1433)
• b0b3501 chore(deps): bump snyk/actions from 8349f9043a8b7f0f3ee8885bf28f0b388d2446e8 ...
• 7ea96f3 chore(deps): bump chainguard/static from 873e970 to 288b818 in the depend...
• ba10408 chore(deps): bump the dependencies group with 4 updates (#1630)
• e8f0200 feat: List objects dispatch throttling with seperate queues and configuration...
• 225d676 chore(deps): bump the dependencies group across 1 directory with 6 updates (#...
• d4f941f chore(deps): bump chainguard/static from dea7cbb to 873e970 in the depend...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like github.com/openfga/openfga is up-to-date now, so this is no longer needed.