chore: sync develop from main - #674
Closed
SoulPancake wants to merge 2 commits into
Closed
Conversation
Squash-merge of all commits from main that were not yet in develop: - feat: support $expression reserved condition name on type restrictions (#664) - fix(graph): prevent nil-pointer panic and corruption in parseThis (#661) - chore(ci): pin the Go version used by the lint job (#669) - chore(deps): various dependency bumps (#650, #655, #658, #665, #666, #670, #671)
$expression is a reserved inline-expression condition name introduced in #664. It never appears in the model's conditions block so the semantic validation added in #616 incorrectly reports it as undefined. Skip the check when the condition name equals $expression, mirroring the exemption already present in the Java validator (ModelValidator.java).
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Syncs develop from main, including language-layer support for the reserved inline condition name $expression (grammar + transformers) and validator exemptions so it isn’t incorrectly rejected as “undefined”, plus a set of Go graph-builder robustness fixes and CI/tooling dependency updates.
Changes:
- Add
$expressionas a dedicated lexer token and allow it in type restrictions (... with $expression) while keeping it illegal as a condition declaration. - Exempt
$expressionfrom “condition must be defined” checks (Go/JS/Java) and add shared semantic validation corpus cases for it. - Harden Go graph builders against degenerate
RelationReferenceshapes and typed-nil nodes; add targeted tests; update CI/tooling pins and dependency locks.
Reviewed changes
Copilot reviewed 42 out of 44 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/data/dsl-semantic-validation-cases.yaml | Adds shared corpus cases asserting $expression usage is semantically valid in restrictions. |
| pkg/js/validator/validate-dsl.ts | Exempts $expression from “condition must be defined” validation in the JS DSL validator. |
| pkg/js/transformer/dsltojson.ts | Maps DOLLAR_EXPRESSION to RelationReference.condition during DSL→JSON transformation. |
| pkg/js/package-lock.json | Updates JS dependency lockfile (transitive bumps). |
| pkg/js/gen/OpenFGAParser.tokens | Regenerated parser tokens to include DOLLAR_EXPRESSION. |
| pkg/js/gen/OpenFGAParser.interp | Regenerated parser interpreter data for $expression. |
| pkg/js/gen/OpenFGALexer.tokens | Regenerated lexer tokens to include DOLLAR_EXPRESSION. |
| pkg/java/src/main/java/dev/openfga/language/validation/ModelValidator.java | Exempts $expression from “condition must be defined” validation in Java. |
| pkg/java/src/main/java/dev/openfga/language/OpenFgaDslListener.java | Maps DOLLAR_EXPRESSION into RelationReference.condition for Java DSL listener. |
| pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.tokens | Regenerated Java parser tokens for DOLLAR_EXPRESSION. |
| pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.interp | Regenerated Java parser interpreter data for $expression. |
| pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGALexer.tokens | Regenerated Java lexer tokens for DOLLAR_EXPRESSION. |
| pkg/go/validation/condition_validation.go | Exempts $expression from Go semantic “condition must be defined” validation. |
| pkg/go/transformer/dsltojson.go | Maps DOLLAR_EXPRESSION into RelationReference.Condition in Go DSL→JSON transformer. |
| pkg/go/Makefile | Pins golangci-lint version via GOLANGCI_LINT_VERSION. |
| pkg/go/graph/weighted_graph_builder.go | Reuses shared classifyRelationReference logic to avoid malformed node labels / leakage across iterations. |
| pkg/go/graph/weighted_graph_builder_test.go | Adds regression tests for malformed RelationReference handling in weighted builder. |
| pkg/go/graph/graph.go | Documents AddEdge behavior when given nil/typed-nil endpoints during graph reversal. |
| pkg/go/graph/graph_builder.go | Adds classifyRelationReference, typed-nil guards, and safer edge casting in upsert/has-edge. |
| pkg/go/graph/graph_builder_test.go | Adds regression tests for malformed RelationReference + typed-nil handling (contains one inverted assertion flag). |
| pkg/go/go.sum | Updates Go dependency sums (incl. testify/protobuf bumps). |
| pkg/go/go.mod | Updates Go dependencies (testify/protobuf) and adds an indirect yaml module. |
| pkg/go/gen/OpenFGAParser.tokens | Regenerated Go parser tokens for DOLLAR_EXPRESSION. |
| pkg/go/gen/OpenFGAParser.interp | Regenerated Go parser interpreter data for $expression. |
| pkg/go/gen/OpenFGALexer.tokens | Regenerated Go lexer tokens for DOLLAR_EXPRESSION. |
| OpenFGAParser.g4 | Allows DOLLAR_EXPRESSION only in type restrictions after with. |
| OpenFGALexer.g4 | Adds DOLLAR_EXPRESSION: '$expression'; token before IDENTIFIER. |
| .github/workflows/test-release-scripts.yml | Bumps pinned actions/checkout digest. |
| .github/workflows/scorecard.yml | Bumps pinned actions/checkout and ossf/scorecard-action digests. |
| .github/workflows/reusable-release-please.yaml | Bumps pinned actions/checkout digest. |
| .github/workflows/pkg-js-release.yaml | Bumps pinned actions/checkout digest. |
| .github/workflows/pkg-js-build.yaml | Bumps pinned actions/checkout and docker/setup-buildx-action digests. |
| .github/workflows/pkg-java-release.yaml | Bumps pinned actions/checkout, actions/setup-java, and Gradle action digests. |
| .github/workflows/pkg-java-build.yaml | Bumps pinned actions/checkout, actions/setup-java, and docker/setup-buildx-action digests. |
| .github/workflows/pkg-go-build.yaml | Pins lint job Go version to 1.26 (golangci-lint v1 compatibility) and bumps pinned action digests. |
Files not reviewed (1)
- pkg/js/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+1360
to
+1367
| if testCase.expectPanic { | ||
| // Test verifies parseThis handles degenerate RelationReference without panic | ||
| require.NotPanics(t, func() { | ||
| graph, err := NewAuthorizationModelGraph(testCase.model) | ||
| require.NoError(t, err) | ||
| require.NotNil(t, graph) | ||
| }) | ||
| } else { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Squash-merge of main into develop.
Includes a fix for `$expression` being incorrectly rejected by the Go semantic validation (#616) — mirrors the exemption already in the Java validator (#664).
Supersedes #672, #673.