modelgraph

Jun 5, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Jun 2, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Changes in this version

+ func CacheKey(storeID, modelID string) keys.Key

May 28, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 20, 2026 GO-2026-5322 +1 more

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

May 6, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 27, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 14, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 10, 2026 GO-2026-5239 +2 more

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Apr 3, 2026 GO-2026-5136 +3 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

Mar 24, 2026 GO-2026-5136 +5 more

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 23, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 19, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Mar 13, 2026 GO-2026-4857 +6 more

  GO-2026-4857: OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

  GO-2026-5136: OpenFGA has Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5170: OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

  GO-2026-5239: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

  GO-2026-5322: OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

  GO-2026-5423: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

  GO-2026-5483: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

Changes in this version

+ const CacheKeyPrefix

+ const DELIMITER

+ var ErrGraphError = errors.New("authorization model graph error")

+ var ErrInvalidModel = errors.New("invalid authorization model encountered")

+ var ErrModelNotFound = errors.New("authorization model not found")

+ func WildcardRelationReference(objectType string) *openfgav1.RelationReference

+ type AuthorizationModelGraph struct

+ func New(model *openfgav1.AuthorizationModel) (*AuthorizationModelGraph, error)

+ func (m *AuthorizationModelGraph) CanApplyRecursion(node *authzGraph.WeightedAuthorizationModelNode, userType string, ...) (*authzGraph.WeightedAuthorizationModelEdge, bool)

+ func (m *AuthorizationModelGraph) FlattenNode(node *authzGraph.WeightedAuthorizationModelNode, userType string, ...) ([]*authzGraph.WeightedAuthorizationModelEdge, error)

+ func (m *AuthorizationModelGraph) GetConditions() map[string]*condition.EvaluableCondition

+ func (m *AuthorizationModelGraph) GetDirectEdgeFromNodeForUserType(objectRelation string, userType string) (*authzGraph.WeightedAuthorizationModelEdge, error)

+ func (m *AuthorizationModelGraph) GetModelID() string

+ type AuthorizationModelGraphResolver struct

+ func NewResolver(datastore storage.AuthorizationModelReadBackend, ...) *AuthorizationModelGraphResolver

+ func (r *AuthorizationModelGraphResolver) Resolve(ctx context.Context, storeID, modelID string) (*AuthorizationModelGraph, error)