fga4postgres 0.3.0

What's new

• Built on cel4postgres 0.1.0. The installer now ships cel4postgres 0.1.0, which keeps fga's condition functions (ipaddress, in_cidr) in fga's own CEL environment instead of also adding them to plain CEL.
• Checked against OpenFGA v1.22.1 (was v1.19.0), with upstream's test cases and its own test runners. One list_users answer changed upstream in that version (security fix GHSA-h7w8-xr72-cv4r); fga4postgres already answered that way.

Behaviour changes

• Deep permission chains: a check that needs exactly 25 steps through some relations used to answer "allowed". It now refuses with 2002 (too complex), like OpenFGA's default resolver. The engine applies the same limit of 24 steps on every relation, so it never grants where OpenFGA refuses.
• Condition parameters: if a condition declares a parameter and the request leaves it out, the check now refuses with 2000, even when the expression never reads that parameter. Before, it could grant.
• Inline conditions: models that use [user with $expression] are refused at write with 2000. The feature is experimental in OpenFGA and off by default there.

Upgrading

1. Install the cel4postgres 0.1.0 bundle (vendor/cel4postgres--0.1.0.sql, or the one bundled in fga4postgres--0.3.0.sql).
2. Re-run the fga4postgres installer (each sql/*.sql file, or the flattened release bundle).

It upgrades in place. On a database first installed with cel4postgres 0.0.2, it also removes fga's functions from the plain standard CEL environment. SELECT fga.version() then returns 0.3.0.

Known differences from OpenFGA (see docs/CONFORMANCE.md)

• CEL cost limit (PIN-COST-1, can grant): OpenFGA refuses a condition whose evaluation costs more than 100. fga4postgres has no cost limit yet, so it evaluates the condition and answers. Tracked as emfga/cel4postgres#16.
• Depth (PIN-DEPTH-1, refuses): on simple recursive relations OpenFGA allows exactly 25 steps; fga4postgres refuses there.
• Inline $expression (PIN-EXPR-1, refuses): not supported.
• list_users form (PIN-LU-1): in one nested-wildcard case OpenFGA lists user:bob next to user:*; fga4postgres lists only user:*. Both grant the same users.
• Condition type errors are found late: a condition that misuses its parameters is accepted at model write and refused when it is evaluated.

Development: Go 1.27, updated Go modules and images, pg_tle v1.5.3 validation, Renovate, and two flaky tests fixed.

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.3.0.sql. Verify downloads against SHA256SUMS.

fga4postgres 0.2.0

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.2.0.sql. Verify downloads against SHA256SUMS.

fga4postgres 0.1.1

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.1.1.sql. Verify downloads against SHA256SUMS.

fga4postgres 0.1.0

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.1.0.sql. Verify downloads against SHA256SUMS.

fga4postgres 0.0.2

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.0.2.sql. Verify downloads against SHA256SUMS.

fga4postgres 0.0.1

Install with: psql -v ON_ERROR_STOP=1 -f fga4postgres--0.0.1.sql. Verify downloads against SHA256SUMS.