Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: resolve exclusion more deterministically in Check resolution #1239

Merged
merged 15 commits into from
Jan 3, 2024

Conversation

jon-whit
Copy link
Member

@jon-whit jon-whit commented Dec 15, 2023

Description

Resolve non-deterministic resolution of Check queries with relations involving exclusion.

Given a definition a but not b and concurrent resolution of both branches a and b, then the following should occur:

  • If a resolves to an {allowed: false} outcome we should short-circuit and return. No further resolution of b is necessary.
  • If b resolves to an {allowed: true} outcome we should short-circuit and return. No further resolution of a is necessary.
  • If a returns an error first, we must wait for b to resolve, because if b resolves to {allowed: true} the outcome should be {allowed: false}, because we can resolve this with a deterministic outcome.
  • If b returns an error first, we must wait for a to resolve, because of a resolves to {allowed: false} the outcome should be {allowed: false}, because we can resolve this with a deterministic outcome.

References

Closes #1238

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

internal/graph/check.go Outdated Show resolved Hide resolved
Copy link

codecov bot commented Dec 15, 2023

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (92324d8) 82.64% compared to head (0d0dba1) 82.64%.

Files Patch % Lines
internal/graph/check.go 76.93% 2 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1239      +/-   ##
==========================================
+ Coverage   82.64%   82.64%   +0.01%     
==========================================
  Files          84       84              
  Lines        9736     9746      +10     
==========================================
+ Hits         8045     8054       +9     
- Misses       1334     1336       +2     
+ Partials      357      356       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

assets/tests/abac_tests.yaml Outdated Show resolved Hide resolved
@jon-whit jon-whit marked this pull request as ready for review December 19, 2023 18:32
@jon-whit jon-whit requested a review from a team as a code owner December 19, 2023 18:32
@jon-whit jon-whit requested a review from a team as a code owner December 21, 2023 22:48
We have these same tests as unit tests elsewhere and it's hard to
produce the non-determinism with a single test.
internal/graph/check.go Outdated Show resolved Hide resolved
internal/graph/check_test.go Outdated Show resolved Hide resolved
internal/graph/check_test.go Outdated Show resolved Hide resolved
internal/graph/check_test.go Show resolved Hide resolved
@jon-whit jon-whit merged commit fa080db into main Jan 3, 2024
13 of 14 checks passed
@jon-whit jon-whit deleted the check-fix-exclusion branch January 3, 2024 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Check gives two responses at random if one of the branches of evaluation errors
3 participants