chore: merge main into develop by SoulPancake · Pull Request #672 · openfga/language

SoulPancake · 2026-08-31T19:53:53Z

Description

Updating develop branch from latest main

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

I have clicked on "allow edits by maintainers".
I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
The correct base branch is being used, if not main
I have added tests to validate that the change in functionality is working as expected

…dates (#650) Bumps the dependencies group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Anurag Bandyopadhyay <angbpy@gmail.com>

Bumps the dependencies group with 3 updates: [actions/setup-java](https://github.com/actions/setup-java), [gradle/actions/wrapper-validation](https://github.com/gradle/actions) and [gradle/actions/setup-gradle](https://github.com/gradle/actions). Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@03ad4de...b6effb0) Updates `gradle/actions/wrapper-validation` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@3f131e8...9c97196) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/wrapper-validation dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: gradle/actions/setup-gradle dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /pkg/js Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): resolve JavaScript audit vulnerabilities (#659) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com>

#664) * feat: support reserved condition name on type restrictions * fix build failure

…he dependencies group (#666) chore(deps): bump docker/setup-buildx-action in the dependencies group Bumps the dependencies group with 1 update: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@bb05f3f...37fe631) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(graph): prevent nil-pointer panic and corruption in parseThis Fix production panic when parseThis encounters degenerate RelationReference with oneof set but empty (relation:"" or wildcard:nil). Such references survive proto validation but fell through all branch conditions, leaving curNode nil. Boxed into graph.Node interface, typed-nil defeated guards and panicked on promoted ID() call. Changes: - Replace non-exclusive ifs with exhaustive switch in parseThis - Move curNode inside loop to prevent stale value leakage across iterations - Add isNilNode() helper to detect typed-nil *AuthorizationModelNode - Check type assertions in upsertEdge/hasEdge (were discarding ok value) - Validate GetType() for special chars that break node label format - Align weighted_graph_builder.go parseThis with same switch structure Tests added covering panic scenarios, stale curNode corruption, and typed-nil guards. Default case degrades empty relation to concrete type, matching transformer/jsontodsl.go parseTypeRestriction behavior. Fixes panic reported in production (trace: graph_builder.go:261 -> <autogenerated>:1). Also prevents silent graph corruption where degenerate entry in non-first position inherits previous iteration's node, merging conditions onto wrong edge. * test(graph): fix expectPanic flags and address review feedback Critical fix: Changed expectPanic from true to false in first two test cases. The flag being true meant graph topology assertions were never running - tests would pass even with completely wrong graphs. Now properly validates nodes, edges, and conditions. Additional improvements: - findEdge: Filter by edgeType and tuplesetRelation for multigraph correctness - DRY: Extract classifyRelationReference() helper to eliminate duplication across graph_builder.go and weighted_graph_builder.go parseThis - Comment brevity: Shorten 15-line comment to 3 lines - Test coverage: Add cases for special chars and nil wildcard All tests pass (14 new malformed-relation tests + 302 existing tests).

* ci: pin the Go version used by the lint job The lint job asked for >=1.25.0 with check-latest, so it moved to Go 1.27 as soon as that showed up in the manifest. golangci-lint v1.64.8 cannot read Go 1.27 export data and reports every antlr symbol in pkg/go/gen as undefined. The build matrix pins 1.25 and 1.26, which is why only lint went red. golangci-lint v2 does not help yet either, it fails parsing 1.27's own stdlib. So pin the toolchain to 1.26 and pin the linter version next to it so the two are raised together. * ci: keep check-latest on the pinned lint toolchain Bounded to 1.26 it cannot pull in 1.27, and it picks up patch releases instead of whatever the runner image happens to have cached.

) Bumps the dependencies group in /pkg/go with 2 updates: [github.com/stretchr/testify](https://github.com/stretchr/testify) and google.golang.org/protobuf. Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Siddhant Khare <siddhant.khare@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com>

…n /pkg/go in the dependencies group (#670) chore(deps): bump github.com/stretchr/testify Bumps the dependencies group in /pkg/go with 1 update: [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.12.0...v1.12.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dencies group (#671) chore(deps): bump actions/setup-java in the dependencies group Bumps the dependencies group with 1 update: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...dd06d9c) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

coderabbitai · 2026-08-31T19:54:02Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0e1ccc80-0a87-4749-b880-37f01d8480be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

linux-foundation-easycla · 2026-08-31T19:54:09Z

✅ login: SoulPancake / name: Anurag Bandyopadhyay (9444831, e28e7fa)
✅ login: adriantam / name: Adrian Tam (96eccfe, a03e3ed)
✅ login: dependabot[bot] / name: dependabot[bot] (1007517, 7a991c4, 806daba, a03e3ed, c3c89f7, db371bf, e28e7fa)
✅ login: yissellokta / name: yissellokta (0d2ad7f)
❌ The email address for the commit (7a991c4, a03e3ed) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

socket-security · 2026-08-31T19:54:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/google.golang.org/protobuf@v1.36.11 ⏵ v1.36.12	⁺¹
	golang/github.com/stretchr/testify@v1.11.1 ⏵ v1.12.1	^-6

View full report

Copilot

Pull request overview

This PR syncs changes from main into develop, bringing in new DSL support for the reserved $expression condition name (for inline expressions on type restrictions) across grammar + Go/JS/Java implementations, plus robustness fixes in the Go graph builders and assorted dependency/CI updates.

Changes:

Add lexer/parser support for with $expression in relation type restrictions, and propagate it through DSL→JSON transformers and validators (JS/Java) with shared corpus cases.
Harden Go graph building (regular + weighted) against malformed/degenerate RelationReference shapes; add targeted regression tests.
Update tooling/dependencies and pinned GitHub Actions versions (Go linter install/version pinning, Go/JS deps, workflow action SHAs).

Reviewed changes

Copilot reviewed 41 out of 43 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`OpenFGAParser.g4`	Allows `with (conditionName
`OpenFGALexer.g4`	Introduces `DOLLAR_EXPRESSION: '$expression'` token to support reserved inline expression marker.
`tests/data/dsl-semantic-validation-cases.yaml`	Adds corpus cases asserting `$expression` usage is semantically valid.
`pkg/js/validator/validate-dsl.ts`	Exempts `$expression` from “condition must be defined” validation in JS validator.
`pkg/js/transformer/dsltojson.ts`	Carries `$expression` into `RelationReference.condition` during DSL→JSON transform.
`pkg/js/gen/OpenFGAParser.tokens`	Regenerated parser token list reflecting new token.
`pkg/js/gen/OpenFGAParser.interp`	Regenerated parser interpreter data reflecting new token.
`pkg/js/gen/OpenFGALexer.tokens`	Regenerated lexer token list reflecting new token.
`pkg/js/package-lock.json`	Updates JS dependency lockfile (transitive bumps).
`pkg/java/src/main/java/dev/openfga/language/validation/ModelValidator.java`	Exempts `$expression` from undefined-condition validation in Java.
`pkg/java/src/main/java/dev/openfga/language/OpenFgaDslListener.java`	Carries `$expression` into `RelationReference.condition` during DSL→JSON transform (Java).
`pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.tokens`	Regenerated Java parser token list reflecting new token.
`pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.interp`	Regenerated Java parser interpreter data reflecting new token.
`pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGALexer.tokens`	Regenerated Java lexer token list reflecting new token.
`pkg/go/transformer/dsltojson.go`	Carries `$expression` into `RelationReference.condition` during DSL→JSON transform (Go).
`pkg/go/gen/OpenFGAParser.tokens`	Regenerated Go parser token list reflecting new token.
`pkg/go/gen/OpenFGAParser.interp`	Regenerated Go parser interpreter data reflecting new token.
`pkg/go/gen/OpenFGALexer.tokens`	Regenerated Go lexer token list reflecting new token.
`pkg/go/Makefile`	Pins `golangci-lint` install version via `GOLANGCI_LINT_VERSION`.
`pkg/go/go.mod`	Updates Go deps (e.g., testify/protobuf) and indirect requirements.
`pkg/go/go.sum`	Updates Go sums to match module changes.
`pkg/go/graph/graph.go`	Documents silent edge dropping behavior when reversing graphs with nil endpoints.
`pkg/go/graph/graph_builder.go`	Adds `classifyRelationReference` + `isNilNode`, fixes parseThis edge construction for degenerate protos, and hardens edge type assertions.
`pkg/go/graph/graph_builder_test.go`	Adds regression tests for malformed `RelationReference` handling and typed-nil node protection.
`pkg/go/graph/weighted_graph_builder.go`	Mirrors parseThis robustness improvements in weighted graph builder via shared classification helper.
`pkg/go/graph/weighted_graph_builder_test.go`	Adds weighted-graph regression tests for malformed `RelationReference` inputs.
`.github/workflows/test-release-scripts.yml`	Bumps `actions/checkout` pin.
`.github/workflows/scorecard.yml`	Bumps `actions/checkout` and `ossf/scorecard-action` pins.
`.github/workflows/reusable-release-please.yaml`	Bumps `actions/checkout` pin.
`.github/workflows/pkg-js-release.yaml`	Bumps `actions/checkout` pin.
`.github/workflows/pkg-js-build.yaml`	Bumps `actions/checkout` and `docker/setup-buildx-action` pins.
`.github/workflows/pkg-java-release.yaml`	Bumps `actions/checkout`, `actions/setup-java`, and Gradle action pins.
`.github/workflows/pkg-java-build.yaml`	Bumps `actions/checkout`, `actions/setup-java`, and `docker/setup-buildx-action` pins.
`.github/workflows/pkg-go-build.yaml`	Bumps `actions/checkout` and `docker/setup-buildx-action` pins; adjusts Go version for lint job.

Files not reviewed (1)

pkg/js/package-lock.json: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+			if testCase.expectPanic {
+				// Test verifies parseThis handles degenerate RelationReference without panic
+				require.NotPanics(t, func() {
+					graph, err := NewAuthorizationModelGraph(testCase.model)
+					require.NoError(t, err)
+					require.NotNil(t, graph)
+				})
+			} else {


+// Reserved condition name for inline expressions on a type restriction
+// (e.g. `define viewer: [user with $expression]`). It is intentionally placed
+// before IDENTIFIER so the literal wins, and `$` exists nowhere else in the
+// lexer, so this cannot collide with any existing token.
+DOLLAR_EXPRESSION: '$expression';


SoulPancake · 2026-08-31T20:01:55Z

Superseded by a replacement PR from chore/sync-develop-from-main which includes a fix for the $expression semantic validation failure.

dependabot Bot and others added 10 commits July 31, 2026 06:18

feat: support $expression reserved condition name on type restrictions (

0d2ad7f

#664) * feat: support reserved condition name on type restrictions * fix build failure

Copilot AI lite review requested due to automatic review settings August 31, 2026 19:53

SoulPancake requested review from a team as code owners August 31, 2026 19:53

Copilot started reviewing on behalf of SoulPancake August 31, 2026 19:54 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

SoulPancake closed this Aug 31, 2026

This was referenced Aug 31, 2026

chore: merge main into develop #673

Open

chore: sync develop from main #674

Closed

Navigation Menu

Uh oh!

chore: merge main into develop - #672

chore: merge main into develop#672
SoulPancake wants to merge 10 commits into
developfrom
main

SoulPancake commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026

Review skipped

Uh oh!

linux-foundation-easycla Bot commented Aug 31, 2026

Uh oh!

socket-security Bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

SoulPancake commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

SoulPancake commented Aug 31, 2026

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

Uh oh!

coderabbitai Bot commented Aug 31, 2026

Review skipped

Uh oh!

linux-foundation-easycla Bot commented Aug 31, 2026

Uh oh!

socket-security Bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

SoulPancake commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants