query

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

Changes in this version

type AliasIterator

+ func NewAliasIteratorWithChain(definitionName, relation string, aliasedAs []string, subIt Iterator) *AliasIterator

+ func (a *AliasIterator) DefinitionName() string

+ func (a *AliasIterator) Relation() string

type Context

+ BatchedArrows bool

+ func NewQueryContext(stdContext context.Context, executor Executor, opts ...ContextOption) *Context

+ func (ctx *Context) CheckManyResources(it Iterator, resources []Object, subject ObjectAndRelation) ([]*Path, error)

+ func (ctx *Context) CheckManySubjects(it Iterator, resource Object, subjects []ObjectAndRelation) ([]*Path, error)

+ func (ctx *Context) MarkAsOperation(it Iterator, op Operation) (isTopLevel bool)

type ContextOption

+ func WithBatchedArrows(enabled bool) ContextOption

type Executor

+ CheckManyResources func(ctx *Context, it Iterator, resources []Object, subject ObjectAndRelation) ([]*Path, error)

+ CheckManySubjects func(ctx *Context, it Iterator, resource Object, subjects []ObjectAndRelation) ([]*Path, error)

type IteratorArgs

+ AliasedAs []string

type LocalExecutor

+ func (l LocalExecutor) CheckManyResources(ctx *Context, it Iterator, resources []Object, subject ObjectAndRelation) ([]*Path, error)

+ func (l LocalExecutor) CheckManySubjects(ctx *Context, it Iterator, resource Object, subjects []ObjectAndRelation) ([]*Path, error)

+ type QueryPlanMetadata struct

+ func NewQueryPlanMetadata() *QueryPlanMetadata

+ func (m *QueryPlanMetadata) ApplyAdvisor(co CanonicalOutline) (CanonicalOutline, error)

+ func (m *QueryPlanMetadata) GetStats() map[CanonicalKey]CountStats

+ func (m *QueryPlanMetadata) MergeCountStats(counts map[CanonicalKey]CountStats)

type RecursiveIterator

+ func (r *RecursiveIterator) DefinitionName() string

+ func (r *RecursiveIterator) RelationName() string

v1.52.0

Apr 29, 2026 GO-2026-5133

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

Changes in this version

type Context

+ TopLevelOperation Operation

+ type Operation int

+ const OperationCheck

+ const OperationIterResources

+ const OperationIterSubjects

+ const OperationUnset

type Path

+ ExcludedSubjects []*Path

+ func PathFromProto(rp *dispatchv1.ResultPath) (*Path, error)

+ func (p *Path) ToProto() (*dispatchv1.ResultPath, error)

v1.51.1

Apr 14, 2026 GO-2026-5133 +1 more

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

v1.51.0

Mar 23, 2026 GO-2026-5133 +2 more

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5465: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

v1.50.0

Mar 18, 2026 GO-2026-5133 +2 more

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5465: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ const WildcardObjectID

+ func WalkOutlinePreOrder(outline Outline, fn func(Outline) error) error

+ type CanonicalKeySource interface

+ GetCanonicalKey func(id OutlineNodeID) CanonicalKey

type CanonicalOutline

+ Hints map[OutlineNodeID][]Hint

+ func ApplyAdvisor(co CanonicalOutline, advisor PlanAdvisor) (CanonicalOutline, error)

+ func (co CanonicalOutline) GetCanonicalKey(id OutlineNodeID) CanonicalKey

type Context

+ func NewTestContext(t testing.TB) *Context

type ContextOption

+ func WithRevisionedReader(reader datalayer.RevisionedReader) ContextOption

+ type CountAdvisor struct

+ func NewCountAdvisor(stats map[CanonicalKey]CountStats) *CountAdvisor

+ func (a *CountAdvisor) GetHints(outline Outline, keySource CanonicalKeySource) ([]Hint, error)

+ func (a *CountAdvisor) GetMutations(outline Outline, keySource CanonicalKeySource) ([]OutlineMutation, error)

+ type CountObserver struct

+ func NewCountObserver() *CountObserver

+ func (c *CountObserver) GetStats() map[CanonicalKey]CountStats

+ func (c *CountObserver) ObserveEnterIterator(op ObserverOperation, key CanonicalKey)

+ func (c *CountObserver) ObservePath(op ObserverOperation, key CanonicalKey, _ Path)

+ func (c *CountObserver) ObserveReturnIterator(_ ObserverOperation, _ CanonicalKey)

+ type CountStats struct

+ CheckCalls int

+ CheckResults int

+ IterResourcesCalls int

+ IterResourcesResults int

+ IterSubjectsCalls int

+ IterSubjectsResults int

+ func AggregateCountStats(counts map[CanonicalKey]CountStats) CountStats

+ type Hint func(it Iterator) error

+ func ArrowDirectionHint(direction arrowDirection) Hint

type Outline

+ func FillMissingNodeIDs(outline Outline, keys map[OutlineNodeID]CanonicalKey) Outline

+ func NullPropagation(outline Outline) Outline

+ func WalkOutlineBottomUp(outline Outline, fn func(Outline) (Outline, error)) (Outline, error)

type OutlineMutation

+ func ReorderMutation(order []int) OutlineMutation

+ func RotateArrowMutation(rotateLeft bool) OutlineMutation

+ type PlanAdvisor interface

+ GetHints func(outline Outline, keySource CanonicalKeySource) ([]Hint, error)

+ GetMutations func(outline Outline, keySource CanonicalKeySource) ([]OutlineMutation, error)

+ func CombinePlanAdvisors(advisors ...PlanAdvisor) PlanAdvisor

+ type QueryDatastoreReader interface

+ CheckRelationships func(ctx context.Context, resourceType ObjectType, resourceIDs []string, ...) (PathSeq, error)

+ LookupCaveatDefinition func(ctx context.Context, name string) (datastore.CaveatDefinition, error)

+ QueryResources func(ctx context.Context, resourceType string, resourceRelation string, ...) (PathSeq, error)

+ QuerySubjects func(ctx context.Context, resource Object, resourceRelation string, ...) (PathSeq, error)

+ SubjectExistsAsRelationship func(ctx context.Context, subject Object, nonEllipsisRelation string) (bool, error)

+ func NewDelayReader(delay time.Duration, inner QueryDatastoreReader) QueryDatastoreReader

+ func NewQueryDatastoreReader(r datalayer.RevisionedReader) QueryDatastoreReader

+ type QueryPage struct

+ Cursor *tuple.Relationship

+ Limit *uint64

+ type StaticAdvisor struct

+ CheckSelectivity float64

+ Fanout int

+ NumberOfTuplesInRelation int

+ func DefaultStaticAdvisor() StaticAdvisor

+ func (s StaticAdvisor) GetHints(outline Outline, keySource CanonicalKeySource) ([]Hint, error)

+ func (s StaticAdvisor) GetMutations(outline Outline, keySource CanonicalKeySource) ([]OutlineMutation, error)

v1.49.2

Feb 27, 2026 GO-2026-5133 +2 more

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5465: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ func OutlineCompare(a, b Outline) int

+ func PathOrder(a, b Path) int

+ type AliasIterator struct

+ func NewAliasIterator(relation string, subIt Iterator) *AliasIterator

+ func (a *AliasIterator) CanonicalKey() CanonicalKey

+ func (a *AliasIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (a *AliasIterator) Clone() Iterator

+ func (a *AliasIterator) Explain() Explain

+ func (a *AliasIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (a *AliasIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (a *AliasIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *AliasIterator) ResourceType() ([]ObjectType, error)

+ func (a *AliasIterator) Subiterators() []Iterator

+ func (a *AliasIterator) SubjectTypes() ([]ObjectType, error)

+ type AnalyzeObserver struct

+ func NewAnalyzeObserver() *AnalyzeObserver

+ func (a *AnalyzeObserver) GetStats() map[CanonicalKey]AnalyzeStats

+ func (a *AnalyzeObserver) ObserveEnterIterator(op ObserverOperation, key CanonicalKey)

+ func (a *AnalyzeObserver) ObservePath(op ObserverOperation, key CanonicalKey, _ Path)

+ func (a *AnalyzeObserver) ObserveReturnIterator(op ObserverOperation, key CanonicalKey)

+ type ArrowIterator struct

+ func NewArrowIterator(left, right Iterator) *ArrowIterator

+ func (a *ArrowIterator) CanonicalKey() CanonicalKey

+ func (a *ArrowIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (a *ArrowIterator) Clone() Iterator

+ func (a *ArrowIterator) Explain() Explain

+ func (a *ArrowIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (a *ArrowIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (a *ArrowIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *ArrowIterator) ResourceType() ([]ObjectType, error)

+ func (a *ArrowIterator) Subiterators() []Iterator

+ func (a *ArrowIterator) SubjectTypes() ([]ObjectType, error)

+ type CanonicalKey string

+ func (k CanonicalKey) Hash() uint64

+ func (k CanonicalKey) IsEmpty() bool

+ func (k CanonicalKey) String() string

+ type CanonicalOutline struct

+ CanonicalKeys map[OutlineNodeID]CanonicalKey

+ Root Outline

+ func BuildOutlineFromSchema(fullSchema *schema.Schema, definitionName string, relationName string) (CanonicalOutline, error)

+ func CanonicalizeOutline(outline Outline) (CanonicalOutline, error)

+ func (co CanonicalOutline) Compile() (Iterator, error)

type CaveatIterator

+ func (c *CaveatIterator) CanonicalKey() CanonicalKey

type Context

+ PaginationCursors map[string]*tuple.Relationship

+ PaginationLimit *uint64

+ PaginationSort options.SortOrder

+ func (ctx *Context) CollectFrontierObject(iteratorID uint64, obj Object)

+ func (ctx *Context) EnableFrontierCollection(iteratorID uint64)

+ func (ctx *Context) ExtractFrontierCollection(iteratorID uint64) []Object

+ func (ctx *Context) GetPaginationCursor(iteratorID string) *tuple.Relationship

+ func (ctx *Context) IsCollectingFrontier(iteratorID uint64) bool

+ func (ctx *Context) SetPaginationCursor(iteratorID string, cursor *tuple.Relationship)

type ContextOption

+ func WithObserver(o Observer) ContextOption

+ func WithPaginationLimit(limit uint64) ContextOption

+ func WithPaginationSort(sort options.SortOrder) ContextOption

+ type DatastoreIterator struct

+ func NewDatastoreIterator(base *schema.BaseRelation) *DatastoreIterator

+ func (r *DatastoreIterator) CanonicalKey() CanonicalKey

+ func (r *DatastoreIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *DatastoreIterator) Clone() Iterator

+ func (r *DatastoreIterator) Explain() Explain

+ func (r *DatastoreIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (r *DatastoreIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (r *DatastoreIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *DatastoreIterator) ResourceType() ([]ObjectType, error)

+ func (r *DatastoreIterator) Subiterators() []Iterator

+ func (r *DatastoreIterator) SubjectTypes() ([]ObjectType, error)

+ type ExclusionIterator struct

+ func NewExclusionIterator(mainSet, excluded Iterator) *ExclusionIterator

+ func (e *ExclusionIterator) CanonicalKey() CanonicalKey

+ func (e *ExclusionIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (e *ExclusionIterator) Clone() Iterator

+ func (e *ExclusionIterator) Explain() Explain

+ func (e *ExclusionIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (e *ExclusionIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (e *ExclusionIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (e *ExclusionIterator) ResourceType() ([]ObjectType, error)

+ func (e *ExclusionIterator) Subiterators() []Iterator

+ func (e *ExclusionIterator) SubjectTypes() ([]ObjectType, error)

type FaultyIterator

+ func (f *FaultyIterator) CanonicalKey() CanonicalKey

type FixedIterator

+ func (f *FixedIterator) CanonicalKey() CanonicalKey

+ type IntersectionArrowIterator struct

+ func NewIntersectionArrowIterator(left, right Iterator) *IntersectionArrowIterator

+ func (ia *IntersectionArrowIterator) CanonicalKey() CanonicalKey

+ func (ia *IntersectionArrowIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (ia *IntersectionArrowIterator) Clone() Iterator

+ func (ia *IntersectionArrowIterator) Explain() Explain

+ func (ia *IntersectionArrowIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (ia *IntersectionArrowIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (ia *IntersectionArrowIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (ia *IntersectionArrowIterator) ResourceType() ([]ObjectType, error)

+ func (ia *IntersectionArrowIterator) Subiterators() []Iterator

+ func (ia *IntersectionArrowIterator) SubjectTypes() ([]ObjectType, error)

+ type IntersectionIterator struct

+ func (i *IntersectionIterator) CanonicalKey() CanonicalKey

+ func (i *IntersectionIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (i *IntersectionIterator) Clone() Iterator

+ func (i *IntersectionIterator) Explain() Explain

+ func (i *IntersectionIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (i *IntersectionIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (i *IntersectionIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (i *IntersectionIterator) ResourceType() ([]ObjectType, error)

+ func (i *IntersectionIterator) Subiterators() []Iterator

+ func (i *IntersectionIterator) SubjectTypes() ([]ObjectType, error)

type Iterator

+ func NewIntersectionIterator(subiterators ...Iterator) Iterator

+ func NewUnionIterator(subiterators ...Iterator) Iterator

+ CanonicalKey func() CanonicalKey

+ type IteratorArgs struct

+ Caveat *core.ContextualizedCaveat

+ DefinitionName string

+ FixedPaths []Path

+ Relation *schema.BaseRelation

+ RelationName string

+ type IteratorType byte

+ const AliasIteratorType

+ const ArrowIteratorType

+ const CaveatIteratorType

+ const DatastoreIteratorType

+ const ExclusionIteratorType

+ const FixedIteratorType

+ const IntersectionArrowIteratorType

+ const IntersectionIteratorType

+ const NullIteratorType

+ const RecursiveIteratorType

+ const RecursiveSentinelIteratorType

+ const SelfIteratorType

+ const UnionIteratorType

+ type Observer interface

+ ObserveEnterIterator func(op ObserverOperation, key CanonicalKey)

+ ObservePath func(op ObserverOperation, key CanonicalKey, path Path)

+ ObserveReturnIterator func(op ObserverOperation, key CanonicalKey)

+ type ObserverOperation int

+ const CheckOperation

+ const IterResourcesOperation

+ const IterSubjectsOperation

+ type Outline struct

+ Args *IteratorArgs

+ ID OutlineNodeID

+ SubOutlines []Outline

+ Type IteratorType

+ func Decompile(it Iterator) (Outline, error)

+ func MutateOutline(outline Outline, fns []OutlineMutation) Outline

+ func (outline Outline) Equals(other Outline) bool

+ func (outline Outline) Serialize() CanonicalKey

+ type OutlineMutation func(Outline) Outline

+ type OutlineNodeID uint64

type PathSeq

+ func PathSeqFromSlice(paths []Path) PathSeq

type RecursiveIterator

+ func (r *RecursiveIterator) CanonicalKey() CanonicalKey

+ type RecursiveSentinelIterator struct

+ func NewRecursiveSentinelIterator(definitionName, relationName string, withSubRelations bool) *RecursiveSentinelIterator

+ func (r *RecursiveSentinelIterator) CanonicalKey() CanonicalKey

+ func (r *RecursiveSentinelIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveSentinelIterator) Clone() Iterator

+ func (r *RecursiveSentinelIterator) DefinitionName() string

+ func (r *RecursiveSentinelIterator) Explain() Explain

+ func (r *RecursiveSentinelIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (r *RecursiveSentinelIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (r *RecursiveSentinelIterator) RelationName() string

+ func (r *RecursiveSentinelIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RecursiveSentinelIterator) ResourceType() ([]ObjectType, error)

+ func (r *RecursiveSentinelIterator) Subiterators() []Iterator

+ func (r *RecursiveSentinelIterator) SubjectTypes() ([]ObjectType, error)

+ func (r *RecursiveSentinelIterator) WithSubRelations() bool

+ type SelfIterator struct

+ func NewSelfIterator(relation string, typeName string) *SelfIterator

+ func (s *SelfIterator) CanonicalKey() CanonicalKey

+ func (s *SelfIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (s *SelfIterator) Clone() Iterator

+ func (s *SelfIterator) Explain() Explain

+ func (s *SelfIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (s *SelfIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (s *SelfIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (s *SelfIterator) ResourceType() ([]ObjectType, error)

+ func (s *SelfIterator) Subiterators() []Iterator

+ func (s *SelfIterator) SubjectTypes() ([]ObjectType, error)

type TraceLogger

+ func NewTraceLoggerWithWriter(w io.Writer) *TraceLogger

+ type UnionIterator struct

+ func (u *UnionIterator) CanonicalKey() CanonicalKey

+ func (u *UnionIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (u *UnionIterator) Clone() Iterator

+ func (u *UnionIterator) Explain() Explain

+ func (u *UnionIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (u *UnionIterator) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (u *UnionIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (u *UnionIterator) ResourceType() ([]ObjectType, error)

+ func (u *UnionIterator) Subiterators() []Iterator

+ func (u *UnionIterator) SubjectTypes() ([]ObjectType, error)

v1.49.1

Feb 6, 2026 GO-2026-5133 +2 more

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5465: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

type Arrow

+ func NewSchemaArrow(left, right Iterator) *Arrow

v1.49.0

Feb 3, 2026 GO-2026-4465 +3 more

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5465: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ func FormatAnalysis(tree Iterator, analyze map[string]AnalyzeStats) string

type Alias

+ func (a *Alias) ID() string

+ func (a *Alias) ResourceType() (ObjectType, error)

+ func (a *Alias) SubjectTypes() ([]ObjectType, error)

+ type AnalyzeCollector struct

+ func NewAnalyzeCollector() *AnalyzeCollector

+ func (ac *AnalyzeCollector) GetStats() map[string]AnalyzeStats

+ func (ac *AnalyzeCollector) IncrementCall(iterID, opType string)

+ func (ac *AnalyzeCollector) RecordResults(iterID, opType string, count int, elapsed time.Duration)

+ type AnalyzeStats struct

+ CheckCalls int

+ CheckResults int

+ CheckTime time.Duration

+ IterResourcesCalls int

+ IterResourcesResults int

+ IterResourcesTime time.Duration

+ IterSubjectsCalls int

+ IterSubjectsResults int

+ IterSubjectsTime time.Duration

+ func AggregateAnalyzeStats(analyze map[string]AnalyzeStats) AnalyzeStats

type Arrow

+ func (a *Arrow) ID() string

+ func (a *Arrow) ResourceType() (ObjectType, error)

+ func (a *Arrow) SubjectTypes() ([]ObjectType, error)

type CaveatIterator

+ func (c *CaveatIterator) ID() string

+ func (c *CaveatIterator) ResourceType() (ObjectType, error)

+ func (c *CaveatIterator) SubjectTypes() ([]ObjectType, error)

type Context

+ Analyze *AnalyzeCollector

+ func NewLocalContext(stdContext context.Context, opts ...ContextOption) *Context

+ type ContextOption func(*Context)

+ func WithAnalyze(analyze *AnalyzeCollector) ContextOption

+ func WithCaveatContext(caveatCtx map[string]any) ContextOption

+ func WithCaveatRunner(runner *caveats.CaveatRunner) ContextOption

+ func WithMaxRecursionDepth(depth int) ContextOption

+ func WithReader(reader datastore.Reader) ContextOption

+ func WithTraceLogger(logger *TraceLogger) ContextOption

type Exclusion

+ func (e *Exclusion) ID() string

+ func (e *Exclusion) ResourceType() (ObjectType, error)

+ func (e *Exclusion) SubjectTypes() ([]ObjectType, error)

type FaultyIterator

+ func (f *FaultyIterator) ID() string

+ func (f *FaultyIterator) ResourceType() (ObjectType, error)

+ func (f *FaultyIterator) SubjectTypes() ([]ObjectType, error)

type FixedIterator

+ func (f *FixedIterator) ID() string

+ func (f *FixedIterator) ResourceType() (ObjectType, error)

+ func (f *FixedIterator) SubjectTypes() ([]ObjectType, error)

type Intersection

+ func (i *Intersection) ID() string

+ func (i *Intersection) ResourceType() (ObjectType, error)

+ func (i *Intersection) SubjectTypes() ([]ObjectType, error)

type IntersectionArrow

+ func (ia *IntersectionArrow) ID() string

+ func (ia *IntersectionArrow) ResourceType() (ObjectType, error)

+ func (ia *IntersectionArrow) SubjectTypes() ([]ObjectType, error)

type Iterator

+ ID func() string

+ ResourceType func() (ObjectType, error)

+ SubjectTypes func() ([]ObjectType, error)

+ type ObjectType struct

+ Subrelation string

+ Type string

+ func NewType(typename string, subrelation ...string) ObjectType

+ func NoObjectFilter() ObjectType

+ func (t ObjectType) String() string

type PathSeq

+ func FilterResourcesByType(seq PathSeq, filter ObjectType) PathSeq

+ func FilterSubjectsByType(seq PathSeq, filter ObjectType) PathSeq

+ func FilterWildcardSubjects(seq PathSeq) PathSeq

+ func RewriteSubject(seq PathSeq, subject ObjectAndRelation) PathSeq

type RecursiveIterator

+ func (r *RecursiveIterator) ID() string

+ func (r *RecursiveIterator) ResourceType() (ObjectType, error)

+ func (r *RecursiveIterator) SubjectTypes() ([]ObjectType, error)

type RecursiveSentinel

+ func (r *RecursiveSentinel) ResourceType() (ObjectType, error)

+ func (r *RecursiveSentinel) SubjectTypes() ([]ObjectType, error)

type RelationIterator

+ func (r *RelationIterator) ID() string

+ func (r *RelationIterator) ResourceType() (ObjectType, error)

+ func (r *RelationIterator) SubjectTypes() ([]ObjectType, error)

+ type Self struct

+ func NewSelf(relation string, typeName string) *Self

+ func (s *Self) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (s *Self) Clone() Iterator

+ func (s *Self) Explain() Explain

+ func (s *Self) ID() string

+ func (s *Self) IterResourcesImpl(ctx *Context, subject ObjectAndRelation, filterResourceType ObjectType) (PathSeq, error)

+ func (s *Self) IterSubjectsImpl(ctx *Context, resource Object, filterSubjectType ObjectType) (PathSeq, error)

+ func (s *Self) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (s *Self) ResourceType() (ObjectType, error)

+ func (s *Self) Subiterators() []Iterator

+ func (s *Self) SubjectTypes() ([]ObjectType, error)

type Union

+ func (u *Union) ID() string

+ func (u *Union) ResourceType() (ObjectType, error)

+ func (u *Union) SubjectTypes() ([]ObjectType, error)

v1.48.0

Dec 9, 2025 GO-2026-4465 +2 more

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ type Estimate struct

+ Cardinality int

+ CheckCost int

+ CheckSelectivity float64

+ IterResourcesCost int

+ IterSubjectsCost int

+ type StaticStatistics struct

+ CheckSelectivity float64

+ Fanout int

+ NumberOfTuplesInRelation int

+ func DefaultStaticStatistics() StaticStatistics

+ func (s StaticStatistics) Cost(iterator Iterator) (Estimate, error)

+ type StatisticsOptimizer struct

+ Source StatisticsSource

+ func (s StatisticsOptimizer) Optimize(it Iterator) (Iterator, bool, error)

+ type StatisticsSource interface

+ Cost func(it Iterator) (Estimate, error)

v1.47.1

Nov 21, 2025 GO-2026-4465 +2 more

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ var StaticOptimizations = []OptimizerFunc

type Context

+ Reader datastore.Reader

type Iterator

+ func ApplyOptimizations(it Iterator, fns []OptimizerFunc) (Iterator, bool, error)

+ func CollapseSingletonUnionAndIntersection(it Iterator) (Iterator, bool, error)

+ func PushdownCaveatEvaluation(c *CaveatIterator) (Iterator, bool, error)

+ func RemoveNullIterators(it Iterator) (Iterator, bool, error)

+ type OptimizerFunc func(it Iterator) (Iterator, bool, error)

+ func WrapOptimizer[T Iterator](fn TypedOptimizerFunc[T]) OptimizerFunc

type Path

+ func (p Path) EndpointsKey() string

type PathSeq

+ func DeduplicatePathSeq(seq PathSeq) PathSeq

+ type RelationNotFoundError struct

+ func (e RelationNotFoundError) Error() string

+ type TypedOptimizerFunc func(it T) (Iterator, bool, error)

v1.47.0

Oct 24, 2025 GO-2025-4151 +3 more

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

v1.46.2

Oct 24, 2025 GO-2025-4151 +3 more

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

v1.46.1

Oct 23, 2025 GO-2025-4151 +3 more

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ func ObjectAndRelationKey(oar ObjectAndRelation) string

+ func SimplifyCaveatExpression(ctx context.Context, runner *caveats.CaveatRunner, expr *core.CaveatExpression, ...) (*core.CaveatExpression, bool, error)

type Alias

+ func (a *Alias) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *Alias) Subiterators() []Iterator

type Arrow

+ func (a *Arrow) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (a *Arrow) Subiterators() []Iterator

+ type CaveatIterator struct

+ func NewCaveatIterator(subiterator Iterator, caveat *core.ContextualizedCaveat) *CaveatIterator

+ func (c *CaveatIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (c *CaveatIterator) Clone() Iterator

+ func (c *CaveatIterator) Explain() Explain

+ func (c *CaveatIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (c *CaveatIterator) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (c *CaveatIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (c *CaveatIterator) Subiterators() []Iterator

type Context

+ CaveatContext map[string]any

+ CaveatRunner *caveats.CaveatRunner

+ MaxRecursionDepth int

+ TraceLogger *TraceLogger

+ func (ctx *Context) TraceEnter(it Iterator, resources []Object, subject ObjectAndRelation)

+ func (ctx *Context) TraceExit(it Iterator, paths []Path)

+ func (ctx *Context) TraceStep(it Iterator, step string, data ...any)

type Exclusion

+ func (e *Exclusion) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (e *Exclusion) Subiterators() []Iterator

type Explain

+ Name string

type FaultyIterator

+ func (f *FaultyIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (f *FaultyIterator) Subiterators() []Iterator

type FixedIterator

+ func (f *FixedIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (f *FixedIterator) Subiterators() []Iterator

type Intersection

+ func (i *Intersection) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (i *Intersection) Subiterators() []Iterator

+ type IntersectionArrow struct

+ func NewIntersectionArrow(left, right Iterator) *IntersectionArrow

+ func (ia *IntersectionArrow) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (ia *IntersectionArrow) Clone() Iterator

+ func (ia *IntersectionArrow) Explain() Explain

+ func (ia *IntersectionArrow) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (ia *IntersectionArrow) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (ia *IntersectionArrow) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (ia *IntersectionArrow) Subiterators() []Iterator

type Iterator

+ func Walk(root Iterator, callback func(Iterator) (Iterator, error)) (Iterator, error)

+ ReplaceSubiterators func(newSubs []Iterator) (Iterator, error)

+ Subiterators func() []Iterator

type Object

+ func (o Object) Key() string

type Path

+ func (p Path) Equals(other Path) bool

+ func (p Path) EqualsEndpoints(other Path) bool

+ func (p Path) Key() string

+ type RecursiveIterator struct

+ func NewRecursiveIterator(templateTree Iterator) *RecursiveIterator

+ func (r *RecursiveIterator) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveIterator) Clone() Iterator

+ func (r *RecursiveIterator) Explain() Explain

+ func (r *RecursiveIterator) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveIterator) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (r *RecursiveIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RecursiveIterator) Subiterators() []Iterator

+ type RecursiveSentinel struct

+ func NewRecursiveSentinel(definitionName, relationName string, withSubRelations bool) *RecursiveSentinel

+ func (r *RecursiveSentinel) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveSentinel) Clone() Iterator

+ func (r *RecursiveSentinel) DefinitionName() string

+ func (r *RecursiveSentinel) Explain() Explain

+ func (r *RecursiveSentinel) ID() string

+ func (r *RecursiveSentinel) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error)

+ func (r *RecursiveSentinel) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq, error)

+ func (r *RecursiveSentinel) RelationName() string

+ func (r *RecursiveSentinel) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RecursiveSentinel) Subiterators() []Iterator

+ func (r *RecursiveSentinel) WithSubRelations() bool

type RelationIterator

+ func (r *RelationIterator) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (r *RelationIterator) Subiterators() []Iterator

+ type TraceLogger struct

+ func NewTraceLogger() *TraceLogger

+ func (t *TraceLogger) DumpTrace() string

+ func (t *TraceLogger) EnterIterator(it Iterator, resources []Object, subject ObjectAndRelation)

+ func (t *TraceLogger) ExitIterator(it Iterator, paths []Path)

+ func (t *TraceLogger) LogStep(it Iterator, step string, data ...any)

type Union

+ func (u *Union) ReplaceSubiterators(newSubs []Iterator) (Iterator, error)

+ func (u *Union) Subiterators() []Iterator

v1.46.0

Oct 6, 2025 GO-2025-4151 +3 more

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ type Path struct

+ Caveat *core.CaveatExpression

+ Expiration *time.Time

+ Integrity []*core.RelationshipIntegrity

+ Metadata map[string]any

+ Relation string

+ Resource Object

+ Subject ObjectAndRelation

+ func FromRelationship(rel tuple.Relationship) *Path

+ func MustPathFromString(relationshipStr string) *Path

+ func (p *Path) IsExpired() bool

+ func (p *Path) MergeAnd(other *Path) error

+ func (p *Path) MergeAndNot(other *Path) error

+ func (p *Path) MergeOr(other *Path) error

+ func (p *Path) ResourceOAR() ObjectAndRelation

+ func (p *Path) ToRelationship() (tuple.Relationship, error)

+ type PathSeq iter.Seq2[*Path, error]

+ func EmptyPathSeq() PathSeq

v1.45.4

Sep 12, 2025 GO-2025-4151 +3 more

GO-2025-4151: SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

GO-2026-4465: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

GO-2026-5133: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

GO-2026-5514: SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Changes in this version

+ type Alias struct

+ func NewAlias(relation string, subIt Iterator) *Alias

+ func (a *Alias) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (RelationSeq, error)

+ func (a *Alias) Clone() Iterator

+ func (a *Alias) Explain() Explain

+ func (a *Alias) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (RelationSeq, error)

+ func (a *Alias) IterSubjectsImpl(ctx *Context, resource Object) (RelationSeq, error)

+ type Arrow struct

+ func NewArrow(left, right Iterator) *Arrow

+ func (a *Arrow) CheckImpl(ctx *Context, resources []Object, subject ObjectAndRelation) (RelationSeq, error)