Skip to content

fix: Correctly set authorization model id when calling batch checks#372

Merged
rhamzeh merged 1 commit into
openfga:mainfrom
kamilogorek:fix-authorization-model-bulk-checks
Apr 9, 2026
Merged

fix: Correctly set authorization model id when calling batch checks#372
rhamzeh merged 1 commit into
openfga:mainfrom
kamilogorek:fix-authorization-model-bulk-checks

Conversation

@kamilogorek

@kamilogorek kamilogorek commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

This change fixes a bug where batch checks were not picking up a default authorization model ID which is set on the client level. It causes a huge postgres load unless you manually specify the ID for every call, as it has to fetch the model from the DB on every check.

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

  • Bug Fixes

    • Improved authorization model ID resolution to use configured defaults and overrides instead of directly from user-provided options, ensuring consistent behavior across API operations.
  • Tests

    • Added test coverage for authorization model ID fallback behavior.

Copilot AI review requested due to automatic review settings April 9, 2026 12:17
@kamilogorek
kamilogorek requested a review from a team as a code owner April 9, 2026 12:17
@linux-foundation-easycla

linux-foundation-easycla Bot commented Apr 9, 2026

Copy link
Copy Markdown

CLA Signed

The committers listed above are authorized under a signed CLA.

  • ✅ login: kamilogorek / name: Kamil Ogórek (35322d1)

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes batchCheck so it correctly uses the client-level default authorizationModelId when the caller doesn’t explicitly provide one, avoiding repeated “latest model” lookups on the server.

Changes:

  • Update batchCheck to set authorization_model_id via getAuthorizationModelId(options) (so it falls back to the client’s configured model ID).
  • Add a regression test ensuring batchCheck falls back to the client’s authorization model ID when options.authorizationModelId is omitted.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
client.ts Ensures batch-check requests include the effective authorization model ID (option override or client default).
tests/client.test.ts Adds coverage for the client-default authorization model ID fallback behavior in batchCheck.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@coderabbitai

coderabbitai Bot commented Apr 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b00a445b-9b7c-46b1-a93e-0c694434eca7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

The changes modify how authorization model IDs are resolved in the OpenFGA client by replacing direct option values with calls to this.getAuthorizationModelId(options) in both the write and batchCheck methods. A new test verifies fallback behavior when the authorization model ID is unspecified in options.

Changes

Cohort / File(s) Summary
Authorization Model ID Resolution
client.ts
Refactored write and batchCheck methods to use this.getAuthorizationModelId(options) instead of directly accessing options.authorizationModelId, ensuring consistent resolution from overrides and configured defaults.
Test Coverage
tests/client.test.ts
Refactored existing batch-check test cases with expanded multi-line formatting and added new test case should fallback to client's authorization model when unspecified to verify fallback behavior when batchCheck options omit authorizationModelId.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly and accurately describes the main fix in the changeset: correcting how the authorization model ID is set for batch checks.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
tests/client.test.ts (1)

1638-1641: Make result assertions order-independent.

These assertions assume a stable response array order. Matching by correlationId will make the test less brittle.

♻️ Suggested test update
-        expect(response.result[0].allowed).toBe(true);
-        expect(response.result[1].allowed).toBe(false);
+        const cor1 = response.result.find((r) => r.correlationId === "cor-1");
+        const cor2 = response.result.find((r) => r.correlationId === "cor-2");
+        expect(cor1?.allowed).toBe(true);
+        expect(cor2?.allowed).toBe(false);
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/client.test.ts` around lines 1638 - 1641, The test currently asserts
response.result items by array index which is brittle; update the assertions to
be order-independent by locating items by their correlationId instead of array
positions. In the test block that checks scope.isDone() and response.result,
find the two result objects using response.result.find(r => r.correlationId ===
'<expected-id>') (or similar) and assert their allowed properties (e.g.,
foundA.allowed.toBe(true), foundB.allowed.toBe(false)); keep the existing
scope.isDone() assertion and replace indexed checks on response.result[0] and
response.result[1] with these correlationId-based lookups.
client.ts (1)

732-778: Resolve authorization model ID once before batching.

batchCheck currently resolves/validates the model ID inside each batch callback. Resolving it once up front is simpler and fails fast before scheduling batch work.

♻️ Suggested refactor
   const {
     headers = {},
     maxBatchSize = DEFAULT_MAX_BATCH_SIZE,
     maxParallelRequests = DEFAULT_MAX_METHOD_PARALLEL_REQS,
   } = options;
+  const authorizationModelId = this.getAuthorizationModelId(options);

   setHeaderIfNotSet(headers, CLIENT_BULK_REQUEST_ID_HEADER, generateRandomIdWithNonUniqueFallback());
@@
     const batchRequest: BatchCheckRequest = {
       checks: batch,
-      authorization_model_id: this.getAuthorizationModelId(options),
+      authorization_model_id: authorizationModelId,
       consistency: options.consistency,
     };
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@client.ts` around lines 732 - 778, In batchCheck, call
this.getAuthorizationModelId(options) once before creating batchedChecks and
store the result (e.g., authorizationModelId) so validation/resolution happens
up-front and can fail fast; then use that stored authorizationModelId inside the
batchResponses async callback when building batchRequest instead of calling
this.getAuthorizationModelId(options) per-batch. Ensure the variable is
validated/awaited before asyncPool is invoked and referenced in the batchRequest
object alongside options.consistency.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@client.ts`:
- Around line 732-778: In batchCheck, call this.getAuthorizationModelId(options)
once before creating batchedChecks and store the result (e.g.,
authorizationModelId) so validation/resolution happens up-front and can fail
fast; then use that stored authorizationModelId inside the batchResponses async
callback when building batchRequest instead of calling
this.getAuthorizationModelId(options) per-batch. Ensure the variable is
validated/awaited before asyncPool is invoked and referenced in the batchRequest
object alongside options.consistency.

In `@tests/client.test.ts`:
- Around line 1638-1641: The test currently asserts response.result items by
array index which is brittle; update the assertions to be order-independent by
locating items by their correlationId instead of array positions. In the test
block that checks scope.isDone() and response.result, find the two result
objects using response.result.find(r => r.correlationId === '<expected-id>') (or
similar) and assert their allowed properties (e.g., foundA.allowed.toBe(true),
foundB.allowed.toBe(false)); keep the existing scope.isDone() assertion and
replace indexed checks on response.result[0] and response.result[1] with these
correlationId-based lookups.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f5a0a993-86d0-4cac-a02b-5e5ce660e8ac

📥 Commits

Reviewing files that changed from the base of the PR and between d09bb3d and 6441df8.

📒 Files selected for processing (2)
  • client.ts
  • tests/client.test.ts

@kamilogorek
kamilogorek force-pushed the fix-authorization-model-bulk-checks branch from 6441df8 to 35322d1 Compare April 9, 2026 12:31
@kamilogorek kamilogorek closed this Apr 9, 2026
@kamilogorek kamilogorek reopened this Apr 9, 2026
@kamilogorek

Copy link
Copy Markdown
Contributor Author

(no clue why it auto-closed issue which was referenced in private repo 👀)

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.79%. Comparing base (d09bb3d) to head (35322d1).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #372      +/-   ##
==========================================
- Coverage   85.80%   85.79%   -0.02%     
==========================================
  Files          26       26              
  Lines        1268     1267       -1     
  Branches      225      249      +24     
==========================================
- Hits         1088     1087       -1     
  Misses        110      110              
  Partials       70       70              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@rhamzeh

rhamzeh commented Apr 9, 2026

Copy link
Copy Markdown
Member

Thanks for the PR @kamilogorek - expect it to go in a release soon, either tomorrow or next week

@rhamzeh
rhamzeh added this pull request to the merge queue Apr 9, 2026
Merged via the queue into openfga:main with commit bbc8bde Apr 9, 2026
15 checks passed
@kamilogorek
kamilogorek deleted the fix-authorization-model-bulk-checks branch April 10, 2026 06:24
@kamilogorek

Copy link
Copy Markdown
Contributor Author

Thanks @rhamzeh! btw. this is kind of load difference I referred to in my original description 😄

Screenshot 2026-04-09 at 14 53 33

This was referenced Apr 10, 2026
@openfga-releaser-bot openfga-releaser-bot Bot mentioned this pull request Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants