query

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

v1.46.2

Oct 24, 2025 GO-2025-4151

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

v1.46.1

Oct 23, 2025 GO-2025-4151

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

Changes in this version

+ func ObjectAndRelationKey(oar ObjectAndRelation) string

+ func SimplifyCaveatExpression(ctx context.Context, runner *caveats.CaveatRunner, expr *core.CaveatExpression, ...) (*core.CaveatExpression, bool, error)

type Alias

+ func (a *Alias) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *Alias) Subiterators() []Iterator

type Arrow

+ func (a *Arrow) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *Arrow) Subiterators() []Iterator

+ type CaveatIterator struct

+ func NewCaveatIterator(subiterator Iterator, caveat *core.ContextualizedCaveat) *CaveatIterator

+ func (c *CaveatIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (c *CaveatIterator) Clone() Iterator

+ func (c *CaveatIterator) Explain() Explain

+ func (c *CaveatIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (c *CaveatIterator) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (c *CaveatIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (c *CaveatIterator) Subiterators() []Iterator

type Context

+ CaveatContext map[string]any

+ CaveatRunner *caveats.CaveatRunner

+ MaxRecursionDepth int

+ TraceLogger *TraceLogger

+ func (ctx *Context) TraceEnter(it Iterator, resources []Object, subject ObjectAndRelation)

+ func (ctx *Context) TraceExit(it Iterator, paths []Path)

+ func (ctx *Context) TraceStep(it Iterator, step string, data ...any)

type Exclusion

+ func (e *Exclusion) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (e *Exclusion) Subiterators() []Iterator

type Explain

+ Name string

type FaultyIterator

+ func (f *FaultyIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (f *FaultyIterator) Subiterators() []Iterator

type FixedIterator

+ func (f *FixedIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (f *FixedIterator) Subiterators() []Iterator

type Intersection

+ func (i *Intersection) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (i *Intersection) Subiterators() []Iterator

+ type IntersectionArrow struct

+ func NewIntersectionArrow(left, right Iterator) *IntersectionArrow

+ func (ia *IntersectionArrow) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (ia *IntersectionArrow) Clone() Iterator

+ func (ia *IntersectionArrow) Explain() Explain

+ func (ia *IntersectionArrow) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (ia *IntersectionArrow) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (ia *IntersectionArrow) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (ia *IntersectionArrow) Subiterators() []Iterator

type Iterator

+ func Walk(root Iterator, callback func(Iterator) (Iterator, error)) (Iterator, error)

+ ReplaceSubiterators func(newSubs []Iterator) (Iterator, error)

+ Subiterators func() []Iterator

type Object

+ func (o Object) Key() string

type Path

+ func (p Path) Equals(other Path) bool

+ func (p Path) EqualsEndpoints(other Path) bool

+ func (p Path) Key() string

+ type RecursiveIterator struct

+ func NewRecursiveIterator(templateTree Iterator) *RecursiveIterator

+ func (r *RecursiveIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveIterator) Clone() Iterator

+ func (r *RecursiveIterator) Explain() Explain

+ func (r *RecursiveIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveIterator) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (r *RecursiveIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RecursiveIterator) Subiterators() []Iterator

+ type RecursiveSentinel struct

+ func NewRecursiveSentinel(definitionName, relationName string, withSubRelations bool) *RecursiveSentinel

+ func (r *RecursiveSentinel) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveSentinel) Clone() Iterator

+ func (r *RecursiveSentinel) DefinitionName() string

+ func (r *RecursiveSentinel) Explain() Explain

+ func (r *RecursiveSentinel) ID() string

+ func (r *RecursiveSentinel) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveSentinel) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (r *RecursiveSentinel) RelationName() string

+ func (r *RecursiveSentinel) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RecursiveSentinel) Subiterators() []Iterator

+ func (r *RecursiveSentinel) WithSubRelations() bool

type RelationIterator

+ func (r *RelationIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RelationIterator) Subiterators() []Iterator

+ type TraceLogger struct

+ func NewTraceLogger() *TraceLogger

+ func (t *TraceLogger) DumpTrace() string

+ func (t *TraceLogger) EnterIterator(it Iterator, resources []Object, subject ObjectAndRelation)

+ func (t *TraceLogger) ExitIterator(it Iterator, paths []Path)

+ func (t *TraceLogger) LogStep(it Iterator, step string, data ...any)

type Union

+ func (u *Union) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (u *Union) Subiterators() []Iterator

v1.46.0

Oct 6, 2025 GO-2025-4151

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

Changes in this version

+ type Path struct

+ Caveat *core.CaveatExpression

+ Expiration *time.Time

+ Integrity []*core.RelationshipIntegrity

+ Metadata map[string]any

+ Relation string

+ Resource Object

+ Subject ObjectAndRelation

+ func FromRelationship(rel tuple.Relationship) *Path

+ func MustPathFromString(relationshipStr string) *Path

+ func (p *Path) IsExpired() bool

+ func (p *Path) MergeAnd(other *Path) error

+ func (p *Path) MergeAndNot(other *Path) error

+ func (p *Path) MergeOr(other *Path) error

+ func (p *Path) ResourceOAR() ObjectAndRelation

+ func (p *Path) ToRelationship() (tuple.Relationship, error)

+ type PathSeq iter.Seq2[*Path, error]

+ func EmptyPathSeq() PathSeq

v1.45.4

Sep 12, 2025 GO-2025-4151

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

Changes in this version

+ type Alias struct

+ func NewAlias(relation string, subIt Iterator) *Alias

+ func (a *Alias) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (RelationSeq, error)

+ func (a *Alias) Clone() Iterator

+ func (a *Alias) Explain() Explain

+ func (a *Alias) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (RelationSeq, error)

+ func (a *Alias) IterSubjectsImpl(ctx *Context, resource Object) (RelationSeq, error)

+ type Arrow struct

+ func NewArrow(left, right Iterator) *Arrow

+ func (a *Arrow) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (RelationSeq, error)

+ func (a *Arrow) Clone() Iterator