BE-765: Tighten the authentication provider types and split the Kratos module by TimDiekmann · Pull Request #9234 · hashintel/hash

TimDiekmann · 2026-08-18T09:06:01Z

🌟 What is the purpose of this PR?

The Graph's authentication providers carry types and a module layout from when there was only one provider. The next provider (Cloudflare Access, BE-761) touches the same places, so this lands the cleanup on its own to keep both changes reviewable apart.

No new capability, and no change to which credentials authenticate — with one deliberate exception noted under Known issues.

🔗 Related links

BE-765 (internal)

🚫 Blocked by

BE-714: Gate the actor-ID header behind a service credential #9233

🔍 What does this change?

AuthenticationProvider breaks with a Result rather than a dedicated two-variant enum. Continue still means "no credential of mine here"; both outcomes still stop the chain, so a rejected credential never falls through to another provider. Each provider's tail collapses from a match to a map.
resolve_user_actor returns the UserId it already checked for, instead of the wider ActorId, and moves to actor.rs — it holds no Kratos knowledge.
The Kratos module splits into mod and session. The HTTP status handling, previously written out inline, becomes read_response_body in mod.rs, which makes it testable without spawning a server. The session provider keeps its 401/403 check ahead of that call, so an expired session still reports as an invalid session rather than as a provider fault.
Near-identical negative tests merge into rstest cases, and the shared test helpers move next to the types they exercise.
StaticAuthenticationProvider sits behind a test-utils feature, so the fake provider can no longer be constructed in a production build.
The client-message tests now iterate every error variant through a helper whose exhaustive match refuses to compile when a variant is added — including the check that no client message leaks an identifier.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

The identity metadata deserializes graph_actor_id as a UserId, which validates the RFC 4122 version and variant. A value that fails that check now aborts the whoami parse and is reported as an invalid provider response, where it previously parsed and failed later at actor resolution as an unauthenticated request. The two differ in status code and log level.

Actor IDs are generated as version 4 UUIDs and the nil UUID is explicitly still accepted, so this only reaches records provisioned by hand. Keeping the stricter type is deliberate: the same struct is what the Graph will write once identity provisioning moves over. If the error class turns out to matter operationally, it is a one-line type change.

🐾 Next steps

BE-761 stacks on this branch and adds the Cloudflare Access provider, the Kratos identity lookup, and the unified admin API.
BE-764 (internal) covers what this PR deliberately leaves alone: the nil UUID as the public actor, and carrying the actor type through to the endpoints instead of collapsing it to a bare UUID.

🛡 What tests cover this?

Existing coverage is preserved; the suite grew rather than shrank.

The status ladder is now covered directly in kratos/mod.rs, one case per rung, without a fake server.
The session provider keeps its end-to-end cases, including a rate-limited provider — that one guards the ordering of the 401/403 check, since widening it to every client error would tell callers their session is bad while Kratos is merely throttling.
The chain tests still assert that a rejected credential never falls through, and that a valid session beats a delegated actor.
The new client-message tests cover every error variant and are wired so a future variant cannot silently skip them.

❓ How to test this?

cargo nextest run --package hash-graph-authentication --package hash-graph-api --all-features
cargo clippy --package hash-graph-authentication --package hash-graph-api --all-features --all-targets
To confirm the exhaustive guard: add a variant to AuthenticationError and observe that the crate stops compiling until it is handled and listed.

vercel · 2026-08-18T09:06:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 24, 2026 5:59pm
petrinaut	Ready	Preview	Aug 24, 2026 5:59pm
petrinaut-docs	Ready	Preview	Aug 24, 2026 5:59pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 24, 2026 5:59pm

codecov · 2026-08-18T09:09:37Z

Codecov Report

❌ Patch coverage is 95.57522% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.96%. Comparing base (f8d59a0) to head (7565604).

Files with missing lines	Patch %	Lines
libs/@local/graph/authentication/src/kratos/mod.rs	91.04%	4 Missing and 2 partials ⚠️
libs/@local/graph/authentication/src/provider.rs	82.35%	1 Missing and 2 partials ⚠️
libs/@local/graph/authentication/src/actor.rs	95.45%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9234      +/-   ##
==========================================
+ Coverage   59.94%   59.96%   +0.02%     
==========================================
  Files        1427     1428       +1     
  Lines      139949   139981      +32     
  Branches     6595     6597       +2     
==========================================
+ Hits        83898    83946      +48     
+ Misses      54977    54961      -16     
  Partials     1074     1074

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.66% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.hash-graph-api	`12.34% <ø> (ø)`
rust.hash-graph-authentication	`95.64% <95.57%> (+2.01%)`	⬆️
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-postgres-store	`29.33% <ø> (ø)`
rust.hash-graph-store	`46.78% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-08-18T09:14:55Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing t/be-765-tighten-the-authentication-provider-types-and-split-the (7565604) with main (f8d59a0)}

cursor · 2026-08-18T09:26:54Z

PR Summary

Medium Risk
Touches request authentication and Kratos session verification paths; behavior is mostly preserved except stricter metadata parsing and clearer HTTP error classification for edge statuses.

Overview
Refactors hash-graph-authentication so provider chains are easier to extend (e.g. Cloudflare Access) without changing which credentials succeed in normal cases.

AuthenticationProvider now breaks the chain with ControlFlow<Result<AuthenticatedActor, Report<AuthenticationError>>> instead of a separate Authentication enum. Continue still means “no credential here”; both Ok and Err still stop the chain. resolve_request_actor, delegation, and Kratos session providers are updated accordingly; shared test helper expect_rejection lives in provider.rs.

Actor resolution is centralized in resolve_user_actor in actor.rs (returns UserId after principal-store checks). Kratos verify_session only resolves the UUID from whoami; user validation runs in authenticate.

The Kratos code splits into kratos/mod.rs (shared read_response_body, MetadataPublic, unit tests for HTTP status handling) and kratos/session.rs. Session verification still maps 401/403 to InvalidSession before read_response_body, so rate limits and other client errors stay ProviderRejection, not “bad session”. graph_actor_id in identity metadata deserializes as UserId (stricter RFC 4122 validation; invalid values fail as InvalidProviderResponse instead of later NotAUser).

StaticAuthenticationProvider is gated behind a test-utils feature; hash-graph-api pulls it in dev-dependencies only. Tests add rstest parametrization, exhaustive AuthenticationError client-message coverage, and compile-time variant-count guards.

^{Reviewed by Cursor Bugbot for commit 7565604. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Refactors Graph authentication provider types and separates Kratos session handling without changing credential precedence or authentication behavior.

Changes:

Replaces the provider decision enum with ControlFlow<Result<…>>.
Moves user-actor resolution into actor.rs and splits Kratos response handling from session verification.
Gates the static test provider behind test-utils and expands consolidated error-path tests.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`libs/@local/graph/authentication/src/request.rs`	Adapts provider outcomes and adds client-message safety tests.
`libs/@local/graph/authentication/src/provider.rs`	Simplifies the provider contract and gates test utilities.
`libs/@local/graph/authentication/src/kratos/session.rs`	Focuses the provider on session verification and typed user resolution.
`libs/@local/graph/authentication/src/kratos/mod.rs`	Adds shared Kratos metadata and response handling.
`libs/@local/graph/authentication/src/delegation.rs`	Adopts the simplified provider result type.
`libs/@local/graph/authentication/src/actor.rs`	Adds reusable user-actor resolution.
`libs/@local/graph/authentication/Cargo.toml`	Adds `rstest` and the `test-utils` feature.
`libs/@local/graph/api/Cargo.toml`	Enables authentication test utilities for API tests.
`Cargo.lock`	Records the authentication crate’s `rstest` dependency.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

…s module The providers carried types and a module layout from when there was only one of them. This lands the cleanup separately from the Cloudflare Access provider so both stay reviewable. `AuthenticationProvider` now breaks with a `Result` instead of a dedicated two-variant enum, which turns each provider's tail into a `map`. `resolve_user_actor` returns the `UserId` it already checked for, and moves to `actor.rs` since it holds no Kratos knowledge. The Kratos module splits into `mod` and `session`, with the HTTP status handling extracted into `read_response_body`. The session provider keeps its 401/403 check ahead of that call, so an expired session still reports as an invalid session rather than as a provider fault. Note one behaviour change: the identity metadata deserializes `graph_actor_id` as a `UserId`, so a value that is not an RFC 4122 UUID now fails the whoami parse instead of failing later at actor resolution.

The `test-utils` dev-dependency adds an edge from the API crate to the authentication crate, which the committed diagrams did not carry.

Each diagram is generated with the root's dependencies *and* dependents, so the new dev-dependency edge shows up in every crate whose diagram contains both the API and the authentication crate — not just in the two at its ends.

github-actions · 2026-08-24T19:20:24Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.4 \mathrm{ms} \pm 239 \mathrm{μs}\left({\color{lightgreen}-6.146 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.49 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}-2.239 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$12.7 \mathrm{ms} \pm 141 \mathrm{μs}\left({\color{gray}-4.610 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$45.0 \mathrm{ms} \pm 529 \mathrm{μs}\left({\color{gray}0.431 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.5 \mathrm{ms} \pm 144 \mathrm{μs}\left({\color{gray}1.03 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$25.2 \mathrm{ms} \pm 215 \mathrm{μs}\left({\color{gray}-1.221 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$28.4 \mathrm{ms} \pm 255 \mathrm{μs}\left({\color{lightgreen}-6.679 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.83 \mathrm{ms} \pm 30.5 \mathrm{μs}\left({\color{gray}-1.210 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$13.9 \mathrm{ms} \pm 134 \mathrm{μs}\left({\color{gray}-3.869 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.81 \mathrm{ms} \pm 34.3 \mathrm{μs}\left({\color{gray}-0.417 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.03 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}1.44 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.34 \mathrm{ms} \pm 17.2 \mathrm{μs}\left({\color{gray}-1.268 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.20 \mathrm{ms} \pm 38.6 \mathrm{μs}\left({\color{gray}-0.830 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.52 \mathrm{ms} \pm 22.3 \mathrm{μs}\left({\color{gray}-1.017 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.17 \mathrm{ms} \pm 33.9 \mathrm{μs}\left({\color{gray}0.159 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.43 \mathrm{ms} \pm 30.7 \mathrm{μs}\left({\color{gray}-2.848 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.45 \mathrm{ms} \pm 23.4 \mathrm{μs}\left({\color{gray}-0.437 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.09 \mathrm{ms} \pm 36.2 \mathrm{μs}\left({\color{gray}-0.763 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.59 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}-2.746 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.48 \mathrm{ms} \pm 19.4 \mathrm{μs}\left({\color{gray}-2.699 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.57 \mathrm{ms} \pm 17.4 \mathrm{μs}\left({\color{gray}-3.656 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.83 \mathrm{ms} \pm 29.0 \mathrm{μs}\left({\color{gray}-2.937 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.64 \mathrm{ms} \pm 16.1 \mathrm{μs}\left({\color{gray}-2.248 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.83 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}-3.308 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.05 \mathrm{ms} \pm 20.5 \mathrm{μs}\left({\color{gray}0.132 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.72 \mathrm{ms} \pm 15.3 \mathrm{μs}\left({\color{gray}-0.561 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.01 \mathrm{ms} \pm 25.1 \mathrm{μs}\left({\color{gray}0.576 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.43 \mathrm{ms} \pm 24.9 \mathrm{μs}\left({\color{gray}-0.283 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.95 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-0.429 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.27 \mathrm{ms} \pm 20.4 \mathrm{μs}\left({\color{gray}0.006 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.37 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}-3.346 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.99 \mathrm{ms} \pm 22.2 \mathrm{μs}\left({\color{gray}1.98 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.42 \mathrm{ms} \pm 35.3 \mathrm{μs}\left({\color{gray}1.10 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$42.7 \mathrm{ms} \pm 383 \mathrm{μs}\left({\color{gray}0.573 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$33.2 \mathrm{ms} \pm 244 \mathrm{μs}\left({\color{gray}-3.891 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$36.8 \mathrm{ms} \pm 258 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$33.0 \mathrm{ms} \pm 298 \mathrm{μs}\left({\color{gray}3.61 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$44.7 \mathrm{ms} \pm 303 \mathrm{μs}\left({\color{red}5.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$49.4 \mathrm{ms} \pm 324 \mathrm{μs}\left({\color{gray}-1.345 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$40.3 \mathrm{ms} \pm 284 \mathrm{μs}\left({\color{gray}-0.533 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$93.6 \mathrm{ms} \pm 534 \mathrm{μs}\left({\color{red}7.44 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$35.2 \mathrm{ms} \pm 415 \mathrm{μs}\left({\color{gray}1.84 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$281 \mathrm{ms} \pm 1.07 \mathrm{ms}\left({\color{gray}-0.656 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.0 \mathrm{ms} \pm 69.7 \mathrm{μs}\left({\color{gray}0.727 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.2 \mathrm{ms} \pm 78.0 \mathrm{μs}\left({\color{gray}0.182 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.1 \mathrm{ms} \pm 83.2 \mathrm{μs}\left({\color{gray}0.568 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.0 \mathrm{ms} \pm 72.3 \mathrm{μs}\left({\color{gray}-0.676 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.1 \mathrm{ms} \pm 89.1 \mathrm{μs}\left({\color{gray}0.013 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.1 \mathrm{ms} \pm 73.7 \mathrm{μs}\left({\color{gray}1.70 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.1 \mathrm{ms} \pm 58.8 \mathrm{μs}\left({\color{gray}-0.746 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.0 \mathrm{ms} \pm 65.9 \mathrm{μs}\left({\color{gray}-0.957 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.1 \mathrm{ms} \pm 87.5 \mathrm{μs}\left({\color{gray}-0.867 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$11.5 \mathrm{ms} \pm 76.8 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$11.5 \mathrm{ms} \pm 93.4 \mathrm{μs}\left({\color{gray}-0.639 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$11.5 \mathrm{ms} \pm 73.3 \mathrm{μs}\left({\color{gray}0.620 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$11.5 \mathrm{ms} \pm 78.3 \mathrm{μs}\left({\color{gray}-0.056 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$11.8 \mathrm{ms} \pm 79.5 \mathrm{μs}\left({\color{gray}2.27 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$11.5 \mathrm{ms} \pm 80.6 \mathrm{μs}\left({\color{gray}-3.616 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$11.5 \mathrm{ms} \pm 76.9 \mathrm{μs}\left({\color{gray}-0.425 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$11.6 \mathrm{ms} \pm 85.0 \mathrm{μs}\left({\color{gray}0.262 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$11.7 \mathrm{ms} \pm 122 \mathrm{μs}\left({\color{gray}2.00 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$11.6 \mathrm{ms} \pm 79.2 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.48 \mathrm{ms} \pm 67.5 \mathrm{μs}\left({\color{gray}-1.665 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$56.7 \mathrm{ms} \pm 431 \mathrm{μs}\left({\color{gray}-2.513 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$110 \mathrm{ms} \pm 698 \mathrm{μs}\left({\color{gray}0.112 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$63.9 \mathrm{ms} \pm 584 \mathrm{μs}\left({\color{gray}-2.545 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$74.1 \mathrm{ms} \pm 552 \mathrm{μs}\left({\color{gray}-0.615 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$82.4 \mathrm{ms} \pm 648 \mathrm{μs}\left({\color{gray}-2.774 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$89.4 \mathrm{ms} \pm 774 \mathrm{μs}\left({\color{gray}-0.701 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$44.8 \mathrm{ms} \pm 275 \mathrm{μs}\left({\color{gray}-1.972 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$72.1 \mathrm{ms} \pm 559 \mathrm{μs}\left({\color{gray}-1.777 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$50.4 \mathrm{ms} \pm 420 \mathrm{μs}\left({\color{gray}-0.696 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$59.3 \mathrm{ms} \pm 424 \mathrm{μs}\left({\color{gray}-1.288 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$62.1 \mathrm{ms} \pm 402 \mathrm{μs}\left({\color{gray}-0.406 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$62.1 \mathrm{ms} \pm 559 \mathrm{μs}\left({\color{gray}-0.462 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$121 \mathrm{ms} \pm 672 \mathrm{μs}\left({\color{lightgreen}-5.618 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$132 \mathrm{ms} \pm 675 \mathrm{μs}\left({\color{gray}-4.551 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$20.1 \mathrm{ms} \pm 166 \mathrm{μs}\left({\color{red}5.75 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$529 \mathrm{ms} \pm 1.39 \mathrm{ms}\left({\color{gray}-3.450 \mathrm{\%}}\right) $$	Flame Graph

TimDiekmann self-assigned this Aug 18, 2026

github-actions Bot added area/deps Relates to third-party dependencies (area) area/libs Relates to first-party libraries/crates/packages (area) type/eng > backend Owned by the @backend team labels Aug 18, 2026

vercel Bot deployed to Preview – hashdotdesign-tokens August 18, 2026 09:06 View deployment

TimDiekmann temporarily deployed to pull-request August 18, 2026 09:06 — with GitHub Actions Inactive

vercel Bot deployed to Preview – petrinaut August 18, 2026 09:09 View deployment

vercel Bot deployed to Preview – hash August 18, 2026 09:22 View deployment

TimDiekmann mentioned this pull request Aug 18, 2026

BE-761: Authenticate Cloudflare Access JWTs in the Graph API #9235

Merged

4 tasks

TimDiekmann marked this pull request as ready for review August 18, 2026 09:26

Copilot AI balanced review requested due to automatic review settings August 18, 2026 09:26

Copilot started reviewing on behalf of TimDiekmann August 18, 2026 09:27 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 18, 2026 10:24

vercel Bot temporarily deployed to Preview – petrinaut August 18, 2026 10:24 Inactive

github-actions Bot added area/apps > hash* Affects HASH (a `hash-*` app) area/apps area/apps > hash-graph labels Aug 18, 2026

Copilot started reviewing on behalf of TimDiekmann August 18, 2026 10:24 View session

TimDiekmann temporarily deployed to pull-request August 18, 2026 10:24 — with GitHub Actions Inactive

Copilot AI reviewed Aug 18, 2026

View reviewed changes

vercel Bot deployed to Preview – hash August 18, 2026 10:33 View deployment

Copilot AI review requested due to automatic review settings August 18, 2026 10:36

vercel Bot temporarily deployed to Preview – petrinaut August 18, 2026 10:36 Inactive

TimDiekmann force-pushed the t/be-765-tighten-the-authentication-provider-types-and-split-the branch from a32f68f to 4b430c6 Compare August 21, 2026 13:05

TimDiekmann temporarily deployed to pull-request August 21, 2026 13:06 — with GitHub Actions Inactive

vercel Bot deployed to Preview – petrinaut-docs August 21, 2026 13:08 View deployment

vercel Bot deployed to Preview – petrinaut August 21, 2026 13:10 View deployment

vercel Bot deployed to Preview – hash August 21, 2026 13:19 View deployment

TimDiekmann force-pushed the t/be-765-tighten-the-authentication-provider-types-and-split-the branch from 4b430c6 to 97543a9 Compare August 21, 2026 14:08

TimDiekmann temporarily deployed to pull-request August 21, 2026 14:09 — with GitHub Actions Inactive

vercel Bot deployed to Preview – petrinaut-docs August 21, 2026 14:12 View deployment

vercel Bot deployed to Preview – petrinaut August 21, 2026 14:12 View deployment

vercel Bot deployed to Preview – hash August 21, 2026 14:17 View deployment

TimDiekmann force-pushed the t/be-765-tighten-the-authentication-provider-types-and-split-the branch from 97543a9 to 782bb1a Compare August 21, 2026 14:25

TimDiekmann temporarily deployed to pull-request August 21, 2026 14:26 — with GitHub Actions Inactive

vercel Bot deployed to Preview – petrinaut-docs August 21, 2026 14:28 View deployment

vercel Bot deployed to Preview – petrinaut August 21, 2026 14:28 View deployment

vercel Bot deployed to Preview – hash August 21, 2026 14:35 View deployment

TimDiekmann force-pushed the t/be-765-tighten-the-authentication-provider-types-and-split-the branch from 782bb1a to ffb6ef7 Compare August 21, 2026 15:05

TimDiekmann had a problem deploying to pull-request August 21, 2026 15:06 — with GitHub Actions Error

indietyp previously approved these changes Aug 24, 2026

View reviewed changes

Comment thread libs/@local/graph/authentication/src/request.rs Outdated

Comment thread libs/@local/graph/authentication/src/request.rs Outdated

TimDiekmann added 4 commits August 24, 2026 19:50

BE-765: Regenerate the dependency diagrams

c68b127

The `test-utils` dev-dependency adds an edge from the API crate to the authentication crate, which the committed diagrams did not carry.

BE-765: Regenerate the remaining dependency diagrams

3f5d1d3

Each diagram is generated with the root's dependencies *and* dependents, so the new dev-dependency edge shows up in every crate whose diagram contains both the API and the authentication crate — not just in the two at its ends.

BE-765: Close the review findings on the error enumeration

7565604

indietyp approved these changes Aug 25, 2026

View reviewed changes

Navigation Menu

Uh oh!

BE-765: Tighten the authentication provider types and split the Kratos module - #9234

BE-765: Tighten the authentication provider types and split the Kratos module#9234
TimDiekmann merged 4 commits into
mainfrom
t/be-765-tighten-the-authentication-provider-types-and-split-the

TimDiekmann commented Aug 18, 2026

Uh oh!

vercel Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

TimDiekmann commented Aug 18, 2026

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

cursor Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Aug 18, 2026 •

edited

Loading

codecov Bot commented Aug 18, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 18, 2026 •

edited

Loading

cursor Bot commented Aug 18, 2026 •

edited

Loading