Add caveat support and E2E test infrastructure - #13
Merged
Conversation
- Add `e2e/docker-compose.yml` for SpiceDB + CockroachDB test infrastructure - Add `e2e/run-e2e.sh` convenience script for local E2E test execution - Add `e2e/schema-relationships.yaml` with caveat-based schema and test data - Add `SpiceDBE2ETest` validating time-gated access, inheritance, and lookups - Update `FgaSpiceDBQuery` to include caveat context when `at` timestamp is provided - Treat `PERMISSIONSHIP_CONDITIONAL_PERMISSION` as allowed in check results - Add `CaveatContextBuilder` tests for ISO-8601 timestamp serialization - Extend `SpiceDBSchemaWriter` with `writeCaveatRelationships()` for test fixtures - Add `at` parameter to `LookupResourcesRequest` and `LookupSubjectsRequest` - Add E2E job to GitHub Actions CI with SpiceDB readiness checks
Bumps [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) from 3.3.1 to 3.4.0. - [Release notes](https://github.com/apache/maven-source-plugin/releases) - [Commits](apache/maven-source-plugin@maven-source-plugin-3.3.1...maven-source-plugin-3.4.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-source-plugin dependency-version: 3.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps `mockito.version` from 5.14.2 to 5.22.0. Updates `org.mockito:mockito-core` from 5.14.2 to 5.22.0 - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v5.14.2...v5.22.0) Updates `org.mockito:mockito-junit-jupiter` from 5.14.2 to 5.22.0 - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v5.14.2...v5.22.0) --- updated-dependencies: - dependency-name: org.mockito:mockito-core dependency-version: 5.22.0 dependency-type: direct:development update-type: version-update:semver-minor - dependency-name: org.mockito:mockito-junit-jupiter dependency-version: 5.22.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [com.google.api.grpc:grpc-google-common-protos](https://github.com/googleapis/sdk-platform-java) from 2.37.1 to 2.66.0. - [Release notes](https://github.com/googleapis/sdk-platform-java/releases) - [Changelog](https://github.com/googleapis/sdk-platform-java/blob/main/CHANGELOG.md) - [Commits](googleapis/sdk-platform-java@api-common/v2.37.1...v2.66.0) --- updated-dependencies: - dependency-name: com.google.api.grpc:grpc-google-common-protos dependency-version: 2.66.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.13.0 to 3.15.0. - [Release notes](https://github.com/apache/maven-compiler-plugin/releases) - [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.13.0...maven-compiler-plugin-3.15.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-compiler-plugin dependency-version: 3.15.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps `slf4j.version` from 2.0.16 to 2.0.17. Updates `org.slf4j:slf4j-api` from 2.0.16 to 2.0.17 Updates `org.slf4j:slf4j-simple` from 2.0.16 to 2.0.17 --- updated-dependencies: - dependency-name: org.slf4j:slf4j-api dependency-version: 2.0.17 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.slf4j:slf4j-simple dependency-version: 2.0.17 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) from 3.1.8 to 3.2.3. - [Release notes](https://github.com/ben-manes/caffeine/releases) - [Commits](ben-manes/caffeine@v3.1.8...v3.2.3) --- updated-dependencies: - dependency-name: com.github.ben-manes.caffeine:caffeine dependency-version: 3.2.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) from 3.2.7 to 3.2.8. - [Release notes](https://github.com/apache/maven-gpg-plugin/releases) - [Commits](apache/maven-gpg-plugin@maven-gpg-plugin-3.2.7...maven-gpg-plugin-3.2.8) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-gpg-plugin dependency-version: 3.2.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) from 3.7.0 to 3.12.0. - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.7.0...maven-javadoc-plugin-3.12.0) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.2.5 to 3.5.5. - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.2.5...surefire-3.5.5) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.5.5 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps `spring-boot.version` from 3.2.0 to 4.0.3. Updates `org.springframework.boot:spring-boot-autoconfigure` from 3.2.0 to 4.0.3 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v3.2.0...v4.0.3) Updates `org.springframework.boot:spring-boot-configuration-processor` from 3.2.0 to 4.0.3 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v3.2.0...v4.0.3) Updates `org.springframework.boot:spring-boot-starter-test` from 3.2.0 to 4.0.3 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v3.2.0...v4.0.3) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-autoconfigure dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: org.springframework.boot:spring-boot-configuration-processor dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: org.springframework.boot:spring-boot-starter-test dependency-version: 4.0.3 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…lthcheck reliability - Treat `PERMISSIONSHIP_CONDITIONAL_PERMISSION` as allowed in all query types - Add conditional permission tests for FGA, Permission, Route, and Feature queries - Upgrade actions/checkout from v5 to v6 in CI - Replace `pgrep` with `grpc_health_probe` for more reliable SpiceDB readiness checks - Update SpiceDB healthcheck configuration with longer start period and more retries - Remove deprecated `version` field from docker-compose.yml - Upgrade maven-failsafe-plugin from 3.2.5 to 3.5.5
raz-shlomo-frontegg
enabled auto-merge (squash)
March 15, 2026 13:09
SpiceDB exits with code 78 (failed to create datastore) when CockroachDB isn't fully ready for connection pooling despite passing healthcheck. Adding restart: on-failure lets it retry. Also removes cpus/mem_limit constraints that can cause issues on GitHub Actions runners. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…rtup docker compose --wait fails when SpiceDB restarts after an initial connection failure to CockroachDB. Instead, start detached and let the grpc_health_probe readiness loop (up to 120s) handle waiting. Also dumps SpiceDB logs on timeout for easier debugging. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CockroachDB v26.1 restricts access to crdb_internal tables by default. SpiceDB v1.42.1 queries crdb_internal.active_version() on startup, causing persistent "Access to crdb_internal and system is restricted" errors. Pin to v24.2.6 which does not have this restriction. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SpiceDB with CockroachDB uses quantized revisions by default, which can cause queries immediately after schema writes to use a revision that predates the schema. Setting quantization to 0s ensures queries always see the latest schema. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CockroachDB-backed SpiceDB has revision quantization issues causing stale schema reads in CI. The E2E tests don't need persistent storage - they seed data in @BeforeAll. Using the memory engine eliminates CockroachDB complexity, speeds up startup, and avoids consistency issues. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove temporary debug traces from FgaSpiceDBQuery and SpiceDBE2ETest that were used to diagnose CI failures. Remove redirectTestOutputToFile from failsafe config. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add schema read-back verification and relationship dumping to @BeforeAll setup to diagnose why E2E tests fail in CI but pass locally. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Log the raw permissionship from CheckPermission responses and LookupResources results to understand why SpiceDB returns denied when relationships exist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Compare direct gRPC CheckPermission (with fully_consistent) against SDK's CheckPermission to identify if the issue is consistency, authentication, or something else. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Root cause: SpiceDB's default `minimize_latency` consistency can return stale results on the memory datastore when relationships are written and immediately queried. This caused all caveat-based E2E tests to fail in CI (CheckPermission returned NO_PERMISSION despite relationships existing). Set `Consistency.fully_consistent=true` on all CheckPermission, CheckBulkPermissions, LookupResources, and LookupSubjects requests. Also remove debug diagnostic logging from E2E tests and schema writer.
raz-shlomo-frontegg
disabled auto-merge
March 15, 2026 15:25
Introduce `ConsistencyPolicy` enum (MINIMIZE_LATENCY, FULLY_CONSISTENT) and wire it through ClientConfiguration. Use MINIMIZE_LATENCY by default for best performance; E2E tests override to FULLY_CONSISTENT. Treat CONDITIONAL_PERMISSION as denied (fail-closed) in FGA and bulk checks, with warning logs when encountered.
…SION SpiceDB returns CONDITIONAL_PERMISSION when caveat parameters are missing from the context. The activeUntil param was omitted when null, preventing SpiceDB from evaluating the `activeUntil == null` check in the caveat expression. Now explicitly sets null values so the caveat fully resolves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PERMISSIONSHIP_CONDITIONAL_PERMISSIONacross all query types (Feature, FGA, Permission, Route). Add optionalat(Instant) parameter toEntityRequestContext,LookupResourcesRequest, andLookupSubjectsRequestfor time-gated entitlement checks via SpiceDB caveats.e2eprofile with failsafe plugin, CI job, and conveniencerun-e2e.shscript.CaveatContextBuilder, conditional permission handling in all query classes, caveat context propagation in FGA/Lookup queries, integration tests with time-gated scenarios, and full E2E suite validating parity with the Node.js SDK.Test plan
atparameter are unaffected🤖 Generated with Claude Code