chore: cleanup and test improvements

Co-authored-by: Henning Perl <hperl@users.noreply.github.com>

.gitignore

@@ -4,4 +4,5 @@ coverage.txt
 dist/
 **/*.sqlite
 **/*.sqlite-journal
-.vscode/
+.vscode/
+.fuzzer/

Makefile

@@ -1,7 +1,7 @@
 SHELL=/bin/bash -o pipefail
 
-export PATH := .bin/gobin:.bin/brew/bin:.bin/brew/sbin:${PATH}
 export PWD := $(shell pwd)
+export PATH := ${PWD}/.bin/gobin:${PWD}/.bin/brew/bin:${PWD}/.bin/brew/sbin:${PATH}
 
 GO_DEPENDENCIES = golang.org/x/tools/cmd/goimports \
 				  github.com/mattn/goveralls \
@@ -11,7 +11,9 @@ GO_DEPENDENCIES = golang.org/x/tools/cmd/goimports \
 				  google.golang.org/grpc/cmd/protoc-gen-go-grpc \
 				  github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc \
 				  github.com/josephburnett/jd \
-				  github.com/mikefarah/yq/v4
+				  github.com/mikefarah/yq/v4 \
+				  golang.org/x/tools/cmd/stringer \
+				  github.com/mdempsky/go114-fuzz-build
 
 BREW_DEPENDENCIES = go-swagger@0.29.0 \
 					grype@0.40.1 \
@@ -132,6 +134,17 @@ test-docs-samples: tools/jd
 		&& \
 		npm test
 
+.PHONY: fuzz-test
+fuzz-test:
+		go test -tags=sqlite -fuzz=FuzzParser -fuzztime=10s ./internal/schema
+
+.PHONY: libfuzzer-fuzz-test
+libfuzzer-fuzz-test: .bin/go114-fuzz-build
+		mkdir -p .fuzzer
+		.bin/go114-fuzz-build -o ./.fuzzer/parser.a ./internal/schema
+		clang -fsanitize=fuzzer ./.fuzzer/parser.a -o ./.fuzzer/parser
+		./.fuzzer/parser -timeout=1 -max_total_time=10 -use_value_profile
+
 .PHONY: cve-scan
 cve-scan: docker tools/grype
 		grype oryd/keto:latest
@@ -141,3 +154,7 @@ post-release: tools/yq
 		cat docker-compose.yml | yq '.services.keto.image = "oryd/keto:'$$DOCKER_TAG'"' | sponge docker-compose.yml
 		cat docker-compose-mysql.yml | yq '.services.keto-migrate.image = "oryd/keto:'$$DOCKER_TAG'"' | sponge docker-compose-mysql.yml
 		cat docker-compose-postgres.yml | yq '.services.keto-migrate.image = "oryd/keto:'$$DOCKER_TAG'"' | sponge docker-compose-postgres.yml
+
+.PHONY: generate
+generate: tools/stringer
+		go generate ./...

cmd/serve_debug_test.go

@@ -45,12 +45,13 @@ func Test_DebugOnly(t *testing.T) {
 // This benchmark is intended for profiling specific operations
 //
 // Summary namespace manager reload:
-//   Memory manager:
-//     Mem: 4.35% of all while github.com/ory/x/configx.(*Provider).reload takes 93.56%
-//     CPU: 1.86% of all while github.com/ory/x/configx.(*Provider).reload takes 67.28%
-//   File manager:
-//     Mem: 0.83% of all while github.com/ory/x/configx.(*Provider).reload takes 96.34%
-//     CPU: 3.84% of all while github.com/ory/x/configx.(*Provider).reload takes 61.53%
+//
+//	Memory manager:
+//	  Mem: 4.35% of all while github.com/ory/x/configx.(*Provider).reload takes 93.56%
+//	  CPU: 1.86% of all while github.com/ory/x/configx.(*Provider).reload takes 67.28%
+//	File manager:
+//	  Mem: 0.83% of all while github.com/ory/x/configx.(*Provider).reload takes 96.34%
+//	  CPU: 3.84% of all while github.com/ory/x/configx.(*Provider).reload takes 61.53%
 func BenchmarkServe(b *testing.B) {
 	b.SkipNow()
 

cmd/status/root.go

@@ -30,7 +30,7 @@ func newStatusCmd() *cobra.Command {
 		Short: "Get the status of the upstream Keto instance",
 		Long:  "Get a status report about the upstream Keto instance. Can also block until the service is healthy.",
 		Args:  cobra.ExactArgs(0),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			var connect func(*cobra.Command) (*grpc.ClientConn, error)
 
 			switch endpoints := stringsx.SwitchExact(endpoint); {

doc.go

@@ -2,18 +2,18 @@
 //
 // Ory Keto is a cloud native access control server providing best-practice patterns (RBAC, ABAC, ACL, AWS IAM Policies, Kubernetes Roles, ...) via REST APIs.
 //
-//     Schemes: http, https
-//     Host:
-//     BasePath: /
-//     Version: Latest
-//     License: Apache 2.0 https://github.com/ory/keto/blob/master/LICENSE
-//     Contact: ORY <hi@ory.sh> https://www.ory.sh
-//
-//     Consumes:
-//     - application/json
-//
-//     Produces:
-//     - application/json
+//	Schemes: http, https
+//	Host:
+//	BasePath: /
+//	Version: Latest
+//	License: Apache 2.0 https://github.com/ory/keto/blob/master/LICENSE
+//	Contact: ORY <hi@ory.sh> https://www.ory.sh
+//
+//	Consumes:
+//	- application/json
+//
+//	Produces:
+//	- application/json
 //
 // swagger:meta
 package main

go.mod

@@ -45,6 +45,7 @@ require (
 	github.com/urfave/negroni v1.0.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.33.0
 	go.opentelemetry.io/otel v1.8.0
+	go.uber.org/goleak v1.1.12
 	golang.org/x/exp v0.0.0-20220518171630-0b5c67f07fdf
 	golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f
 	google.golang.org/grpc v1.48.0
@@ -63,6 +64,7 @@ require (
 	github.com/avast/retry-go/v4 v4.1.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bradleyjkemp/cupaloy/v2 v2.6.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/cockroachdb/cockroach-go/v2 v2.2.14 // indirect

go.sum

@@ -113,6 +113,7 @@ github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJm
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bradleyjkemp/cupaloy/v2 v2.6.0 h1:knToPYa2xtfg42U3I6punFEjaGFKWQRXJwj0JTv4mTs=
+github.com/bradleyjkemp/cupaloy/v2 v2.6.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
 github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
 github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
@@ -1005,6 +1006,8 @@ go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
+go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -1061,6 +1064,7 @@ golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRu
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=

internal/driver/registry_factory.go

@@ -62,23 +62,23 @@ func NewDefaultRegistry(ctx context.Context, flags *pflag.FlagSet, withoutNetwor
 	return r, nil
 }
 
-func NewSqliteTestRegistry(t *testing.T, debugOnDisk bool) *RegistryDefault {
+func NewSqliteTestRegistry(t testing.TB, debugOnDisk bool) *RegistryDefault {
 	mode := dbx.SQLiteMemory
 	if debugOnDisk {
 		mode = dbx.SQLiteDebug
 	}
 	return NewTestRegistry(t, dbx.GetSqlite(t, mode))
 }
 
-type newRegistryOption func(t *testing.T, r *RegistryDefault)
+type newRegistryOption func(t testing.TB, r *RegistryDefault)
 
 func WithNamespaces(namespaces []*namespace.Namespace) newRegistryOption {
-	return func(t *testing.T, r *RegistryDefault) {
+	return func(t testing.TB, r *RegistryDefault) {
 		require.NoError(t, r.c.Set(config.KeyNamespaces, namespaces))
 	}
 }
 
-func NewTestRegistry(t *testing.T, dsn *dbx.DsnT, opts ...newRegistryOption) *RegistryDefault {
+func NewTestRegistry(t testing.TB, dsn *dbx.DsnT, opts ...newRegistryOption) *RegistryDefault {
 	l := logrusx.New("Ory Keto", "testing")
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)

internal/e2e/helpers.go

@@ -27,13 +27,10 @@ type namespaceTestManager struct {
 	reg     driver.Registry
 	ctx     context.Context
 	nspaces []*namespace.Namespace
-	nextID  int32
 }
 
 func (m *namespaceTestManager) add(t *testing.T, nn ...*namespace.Namespace) {
-	for _, n := range nn {
-		m.nspaces = append(m.nspaces, n)
-	}
+	m.nspaces = append(m.nspaces, nn...)
 
 	require.NoError(t, m.reg.Config(m.ctx).Set(config.KeyNamespaces, m.nspaces))
 

internal/e2e/sdk_client_test.go

@@ -30,6 +30,8 @@ type sdkClient struct {
 
 var _ client = (*sdkClient)(nil)
 
+var requestTimeout = 5 * time.Second
+
 func (c *sdkClient) getReadClient() *httpclient.OryKeto {
 	if c.rc == nil {
 		c.rc = httpclient.NewHTTPClientWithConfig(nil, &httpclient.TransportConfig{
@@ -67,7 +69,7 @@ func (c *sdkClient) createTuple(t require.TestingT, r *ketoapi.RelationTuple) {
 	}
 
 	_, err := c.getWriteClient().Write.CreateRelationTuple(
-		write.NewCreateRelationTupleParamsWithTimeout(time.Second).
+		write.NewCreateRelationTupleParamsWithTimeout(requestTimeout).
 			WithPayload(payload),
 	)
 	require.NoError(t, err)
@@ -197,32 +199,36 @@ func (c *sdkClient) check(t require.TestingT, r *ketoapi.RelationTuple) bool {
 	return *resp.Payload.Allowed
 }
 
-func buildTree(t require.TestingT, mt *models.ExpandTree) *ketoapi.ExpandTree {
-	et := &ketoapi.ExpandTree{
-		Type: ketoapi.ExpandNodeType(*mt.Type),
-	}
-	if mt.SubjectSet != nil {
-		et.SubjectSet = &ketoapi.SubjectSet{
-			Namespace: *mt.SubjectSet.Namespace,
-			Object:    *mt.SubjectSet.Object,
-			Relation:  *mt.SubjectSet.Relation,
+func buildTree(t require.TestingT, mt *models.ExpandTree) *ketoapi.Tree[*ketoapi.RelationTuple] {
+	result := &ketoapi.Tree[*ketoapi.RelationTuple]{
+		Type: ketoapi.TreeNodeType(*mt.Type),
+	}
+	if mt.Tuple.SubjectSet != nil {
+		result.Tuple = &ketoapi.RelationTuple{
+			SubjectSet: &ketoapi.SubjectSet{
+				Namespace: *mt.Tuple.SubjectSet.Namespace,
+				Object:    *mt.Tuple.SubjectSet.Object,
+				Relation:  *mt.Tuple.SubjectSet.Relation,
+			},
 		}
 	} else {
-		et.SubjectID = &mt.SubjectID
+		result.Tuple = &ketoapi.RelationTuple{
+			SubjectID: &mt.Tuple.SubjectID,
+		}
 	}
 
-	if et.Type != ketoapi.ExpandNodeLeaf && len(mt.Children) != 0 {
-		et.Children = make([]*ketoapi.ExpandTree, len(mt.Children))
+	if result.Type != ketoapi.TreeNodeLeaf && len(mt.Children) != 0 {
+		result.Children = make([]*ketoapi.Tree[*ketoapi.RelationTuple], len(mt.Children))
 		for i, c := range mt.Children {
-			et.Children[i] = buildTree(t, c)
+			result.Children[i] = buildTree(t, c)
 		}
 	}
-	return et
+	return result
 }
 
-func (c *sdkClient) expand(t require.TestingT, r *ketoapi.SubjectSet, depth int) *ketoapi.ExpandTree {
+func (c *sdkClient) expand(t require.TestingT, r *ketoapi.SubjectSet, depth int) *ketoapi.Tree[*ketoapi.RelationTuple] {
 	resp, err := c.getReadClient().Read.GetExpand(
-		read.NewGetExpandParamsWithTimeout(time.Second).
+		read.NewGetExpandParamsWithTimeout(requestTimeout).
 			WithNamespace(r.Namespace).
 			WithObject(r.Object).
 			WithRelation(r.Relation).
@@ -233,15 +239,15 @@ func (c *sdkClient) expand(t require.TestingT, r *ketoapi.SubjectSet, depth int)
 }
 
 func (c *sdkClient) waitUntilLive(t require.TestingT) {
-	resp, err := c.getReadClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(time.Second))
+	resp, err := c.getReadClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(requestTimeout))
 	for err != nil {
-		resp, err = c.getReadClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(time.Second))
+		resp, err = c.getReadClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(requestTimeout))
 	}
 	require.Equal(t, "ok", resp.Payload.Status)
 
-	resp, err = c.getWriteClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(time.Second))
+	resp, err = c.getWriteClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(requestTimeout))
 	for err != nil {
-		resp, err = c.getWriteClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(time.Second))
+		resp, err = c.getWriteClient().Health.IsInstanceAlive(health.NewIsInstanceAliveParams().WithTimeout(requestTimeout))
 	}
 	require.Equal(t, "ok", resp.Payload.Status)
 }

internal/relationtuple/manager_isolation.go

@@ -113,5 +113,17 @@ func IsolationTest(t *testing.T, m0, m1 Manager) {
 				assert.Equal(t, rts[1:], r1)
 			})
 		})
+
+		t.Run("case=cancelled", func(t *testing.T) {
+			reset(t, m0, m1)
+			ctx, cancel := context.WithCancel(ctx)
+
+			require.NoError(t, m0.WriteRelationTuples(ctx, rts...))
+
+			cancel()
+
+			_, _, err := m0.GetRelationTuples(ctx, &RelationQuery{Namespace: &nspace})
+			assert.ErrorIs(t, err, context.Canceled)
+		})
 	})
 }

internal/relationtuple/manager_requirements.go

@@ -22,7 +22,7 @@ func ManagerTest(t *testing.T, m Manager) {
 
 	t.Run("method=Write", func(t *testing.T) {
 		t.Run("case=success", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			tuples := []*RelationTuple{
 				{
@@ -56,7 +56,7 @@ func ManagerTest(t *testing.T, m Manager) {
 
 	t.Run("method=Get", func(t *testing.T) {
 		t.Run("case=queries", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			tuples := make([]*RelationTuple, 10)
 			ids := x.UUIDs(len(tuples))
@@ -169,7 +169,7 @@ func ManagerTest(t *testing.T, m Manager) {
 		})
 
 		t.Run("case=pagination", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			tuples := make([]*RelationTuple, 20)
 			oID := uuid.Must(uuid.NewV4())
@@ -241,7 +241,7 @@ func ManagerTest(t *testing.T, m Manager) {
 
 	t.Run("method=Delete", func(t *testing.T) {
 		t.Run("case=deletes tuple", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 			oID := uuid.Must(uuid.NewV4())
 			sID := uuid.Must(uuid.NewV4())
 
@@ -284,7 +284,7 @@ func ManagerTest(t *testing.T, m Manager) {
 		})
 
 		t.Run("case=deletes only one tuple", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			rs := make([]*RelationTuple, 4)
 			oIDs, sIDs := make([]uuid.UUID, len(rs)), make([]uuid.UUID, len(rs))
@@ -352,7 +352,7 @@ func ManagerTest(t *testing.T, m Manager) {
 
 	t.Run("method=Transact", func(t *testing.T) {
 		t.Run("case=success", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			rs := make([]*RelationTuple, 4)
 			oIDs, sIDs := make([]uuid.UUID, len(rs)), make([]uuid.UUID, len(rs))
@@ -390,7 +390,7 @@ func ManagerTest(t *testing.T, m Manager) {
 		})
 
 		t.Run("case=err rolls back all", func(t *testing.T) {
-			nspace := strconv.Itoa(rand.Int())
+			nspace := strconv.Itoa(rand.Int()) // nolint
 
 			rs := make([]*RelationTuple, 2)
 			oIDs, sIDs := make([]uuid.UUID, len(rs)), make([]uuid.UUID, len(rs))

main.go

@@ -1,4 +1,3 @@
-//go:generate .bin/swagger generate spec
 // Copyright © 2017 Aeneas Rekkas <aeneas+oss@aeneas.io>
 //
 // Licensed under the Apache License, Version 2.0 (the "License");