Skip to content

BE-489, H-6417, H-6418: Kratos session refresh, passwordless password setup, Playwright overhaul#8638

Open
TimDiekmann wants to merge 14 commits intomainfrom
t/be-489-allow-setting-a-password-when-none-exists
Open

BE-489, H-6417, H-6418: Kratos session refresh, passwordless password setup, Playwright overhaul#8638
TimDiekmann wants to merge 14 commits intomainfrom
t/be-489-allow-setting-a-password-when-none-exists

Conversation

@TimDiekmann
Copy link
Copy Markdown
Member

@TimDiekmann TimDiekmann commented Apr 16, 2026

🌟 What is the purpose of this PR?

Three related auth improvements plus a comprehensive Playwright test suite overhaul that grew out of the H-6219 TOTP restoration work:

  1. Kratos session refresh (H-6417) — security-sensitive settings changes (disable TOTP, change password) now rely on Kratos's privileged_session_max_age for re-authentication instead of a custom current-password prompt.
  2. Passwordless password setup (BE-489, H-6418) — SSO-only users who never set a password can now do so from the security settings page; the old flow required re-entering a current password they didn't have.
  3. Playwright test suite overhaul — reorganised into project groups, stabilised browser-extension tests, added browser matrix config, hardened error handling across frontend and plugin codebases.

🔗 Related links

🚫 Blocked by

Nothing.

🔍 What does this change?

Test suite reorganisation (ac943f87cd)

  • Split flat spec files into four project groups: account/ (signup, signin, password, MFA), features/ (pre-authenticated via storageState), guest/, and extension/.
  • globalSetup signs Alice in once and persists her session.
  • Dedicated test users per auth-mutating test via shared/test-users.ts + shared/delete-user.ts.
  • Browser matrix config: flows × browsers with chromium/firefox/webkit. test:integration defaults to *-chromium; firefox/webkit available via dedicated scripts.

Browser-extension test stabilisation (7f900e3c6f)

  • waitForPopupStateLoaded — 500 ms idle window on chrome.storage.onChanged so mount-time fetches settle before interaction.
  • resetOneOffState / resetAutomatedState — direct chrome.storage.local.set writes instead of per-chip UI clicks (avoids debounce races with late getUser writes).
  • openPopupTab — pins popupTab in storage before clicking tab to prevent late getUser from flipping it back.
  • selectEntityTypeOption — ArrowDown + Enter with chip-count assertion.
  • Plugin cookie guard: infer-entities.ts no longer opens a doomed WebSocket when no session cookies exist.

Apollo SSR fix (47d53ffa15)

  • Disable queryDeduplication on the server-side Apollo client singleton; the dedup key ignores context (auth cookies) so concurrent SSR requests for the same query would share one response.

TOTP disable consolidation (1bc1fdba6c)

  • Extract executeDisableTotp (unlink TOTP + clear backup codes). Drop currentPassword / isRecoveryFlow state — Kratos enforces privileged session age via privileged_session_max_age.

Review findings cleanup (fb72744484)

  • Delete dead helpers: loginUsingTempForm, loginUsingUi, getDerivedPayloadFromMostRecentEmail.
  • signOutclearSessionCookies.
  • submitSettingsUpdate catches all errors instead of re-rejecting.
  • gatherUiNodeValuesFromFlow / useKratosErrorHandler generics tightened.
  • flowMetadata.settingsWithPassword derived from settings.
  • callGraphQlApi checks HTTP status + GraphQL errors.
  • waitForConnection timeout + CLOSED/CLOSING check.
  • WebSocket JSON.parse wrapped, error handler logs event, getCookieString rejection caught.
  • decodeBase32 throws on invalid characters.
  • global-setup try/finally.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

  • does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

  • are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

  • do not affect the execution graph

⚠️ Known issues

  • Extension tests depend on a 500 ms storage-idle heuristic (waitForPopupStateLoaded) because the popup fires multiple uncoordinated async fetches on mount. Stable in 10/10 consecutive runs locally but the heuristic is not a guarantee under CI load.
  • Multi-browser matrix (firefox/webkit) is configured but account tests will race on shared user identities if run in parallel. Serial execution or per-browser identity suffixes needed for cross-browser CI.

🐾 Next steps

  • Add pdfjs-dist as explicit frontend dependency (FE-595)
  • Enable import/no-extraneous-dependencies globally in eslint base config (FE-596)
  • FE-598 — Consolidate security.page.tsx 14× useState into useReducer
  • Consider React Query / SWR for the browser plugin's mount-time state coordination

🛡 What tests cover this?

  • Full Playwright suite: 29 active tests across 4 projects, 5 skipped (pre-existing).
  • 10/10 consecutive green runs locally.

❓ How to test this?

  1. yarn start:test
  2. cd tests/hash-playwright && npx playwright test --project '*-chromium'
  3. Confirm all 29 tests pass.
  4. Optionally: npx playwright test --project '*-firefox' (requires npx playwright install firefox)

Splits specs across four projects: `account` (signup, signin, password,
MFA), `features` (feature regressions against a pre-seeded Alice via
`storageState`), `guest` (unauth flows), and `extension` (browser
plugin). `globalSetup` signs Alice in once and persists her session to
`tests/.auth/alice.json` so feature tests skip the login flow.

Supporting changes:
- `shared/test-users.ts` centralises per-test dedicated users; each
  auth-mutating test gets its own identity to avoid cross-test leakage.
- `shared/delete-user.ts` (new) idempotently removes leftover Kratos
  identities via the Graph admin endpoint before re-running signups.
- `shared/signin-utils.ts` (new) offers a lean sign-in helper.
- `shared/signup-utils.ts` now randomises shortnames and cleans up
  prior Kratos identities before registering.
- `shared/runtime.ts` captures a small set of expected 4xx responses
  (whoami 401, AAL2-upgrade 422, recovery 422, self-service 400) as
  console-noise suppressions correlated by status code.
- `shared/get-kratos-verification-code.ts` adds
  `getKratosRecoveryCode` and normalises Mailslurper timestamps to
  UTC.
- `.env.test` allowlist lists the new test identities.
- `.gitignore` excludes the per-test `.auth` storage-state directory.
- Root `package.json` gains `start:test:backend` / `start:test:frontend`
  helpers to spin up only the services a given suite needs.
- `docker-compose.yml` threads
  `SELFSERVICE_FLOWS_SETTINGS_PRIVILEGED_SESSION_MAX_AGE` through to
  Kratos with a 5-minute default so tests can tighten it via env var.
The popup runs several uncoordinated async loads on mount (`getUser`
fires multiple times plus `useEntityTypes`), each independently
writing a slice of state into `chrome.storage.local`. The previous
suite interacted with the popup before those writes settled, so the
backend-persisted `BrowserPluginSettings` entity leaked state between
runs and races produced spurious duplicate chips.

Rather than fight each race individually, this change:

- Adds `waitForPopupStateLoaded` — resolves once `chrome.storage.local`
  has been idle for 500 ms, which empirically covers the mount-time
  fetches under CI latency.
- Replaces UI-driven state clears (chip-by-chip delete button clicks)
  with direct `chrome.storage.local.set` writes in `resetOneOffState`
  / `resetAutomatedState`. `useStorageSync` picks up the change and
  re-renders the UI empty, and we sidestep the per-click debounced
  backend save that would otherwise collide with late `getUser`
  writes.
- Replaces magic-number `sleep()` calls with deterministic waits:
  `waitForSettingsSave` listens for the next debounced `updateEntity`
  mutation; `selectEntityTypeOption` waits for the resulting chip.
- Adds an `ADD ANOTHER` fallback for the Automated tab because
  `SelectScope`'s `showTable` / `draftRule` are `useState`-initialised
  from `anyTypesSelected` and therefore sticky across storage clears.
- Uses a native `input` event dispatch for the quick-note textarea;
  `page.fill` silently skipped MUI's `onChange` when the stored value
  matched the new one.

The plugin fixture now still clears local storage on start so the
popup hydrates via `getUser()` rather than stale cache. Backend state
cleanup moves into the per-test reset helpers.

Plugin-browser: `infer-entities` no longer opens a doomed WebSocket
when the user isn't logged in. A background-script `init` with no
session cookies defers until a user action triggers `getWebSocket()`,
and `reconnectWebSocket` short-circuits the same way, which prevents
the server from closing each connection after its 5-second
unauthenticated timeout.

Supporting: added `@types/chrome`, included `global-setup.ts` in
`tsconfig.json`, moved the extension fixture to
`shared/browser-plugin-fixtures/` to match the new `extension/`
project layout.
The singleton `apolloClient` exported from `create-apollo-client.ts`
is shared across SSR requests; Apollo's query deduplication uses
`(query, variables)` as the dedup key and ignores `context`, so
concurrent SSR requests for the same query share a response. Disable
dedup on the server-side client; browser clients keep it.

Also expands the `@todo` on the SSR `meQuery` prefetch in
`_app.page.tsx` so the interaction is visible to whoever addresses
the caching todo.
Extracts the two-step disable flow (unlink TOTP, then clear backup
codes) into `executeDisableTotp`. Kratos keeps enforcing AAL2 as long
as any second factor remains, so the follow-up `lookup_secret_disable`
is load-bearing — without it the user would still be prompted for an
authenticator code they no longer have at next sign-in.

Also drops `currentPassword`, `currentPasswordError`, and
`isRecoveryFlow` state: password changes no longer accept a current
password in the UI (Kratos enforces privileged-session age via
`privileged_session_max_age`), and the recovery-flow marker is unused.
- Delete `loginUsingTempForm`, `loginUsingUi`, and
  `getDerivedPayloadFromMostRecentEmail`; consolidate on
  `signInWithPassword`.
- Rename `signOut` → `clearSessionCookies`.
- Deduplicate `defaultPassword`; make `password` required in signup
  helpers.
- `callGraphQlApi` checks HTTP status and GraphQL errors.
- `global-setup` try/finally to avoid leaking Chromium.
- `decodeBase32` throws on invalid characters.
- `openPopupTab` helper pins `popupTab` in storage before clicking.
- Tighten chip assertions to cover linked types.
- `submitSettingsUpdate` surfaces errors instead of re-rejecting.
- Null-guard `extractBackupCodesFromFlow` textContent.
- Show error on empty backup code regeneration.
- Correlate `gatherUiNodeValuesFromFlow` / `useKratosErrorHandler`
  generics with flow type.
- Derive `flowMetadata.settingsWithPassword` from `settings`.
- Log malformed Kratos redirect URLs.
- `waitForConnection` timeout + CLOSED/CLOSING check.
- Wrap WebSocket `JSON.parse` in try/catch.
- Catch `getCookieString` rejection in setInterval.
- Log WebSocket error event.
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 16, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hash Ready Ready Preview, Comment Apr 17, 2026 11:30am
3 Skipped Deployments
Project Deployment Actions Updated (UTC)
hashdotdesign Ignored Ignored Preview Apr 17, 2026 11:30am
hashdotdesign-tokens Ignored Ignored Preview Apr 17, 2026 11:30am
petrinaut Skipped Skipped Comment Apr 17, 2026 11:30am

@github-actions github-actions Bot added area/deps Relates to third-party dependencies (area) area/apps > hash* Affects HASH (a `hash-*` app) area/infra Relates to version control, CI, CD or IaC (area) area/libs Relates to first-party libraries/crates/packages (area) type/eng > frontend Owned by the @frontend team type/eng > backend Owned by the @backend team area/tests New or updated tests area/tests > playwright New or updated Playwright tests area/apps labels Apr 16, 2026
Comment thread tests/hash-playwright/tests/shared/signup-utils.ts Dismissed
Comment thread apps/plugin-browser/src/scripts/background/infer-entities.ts Fixed
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 16, 2026

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 62.49%. Comparing base (efbcf7c) to head (c9d3fa1).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
.../hash-isomorphic-utils/src/create-apollo-client.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8638      +/-   ##
==========================================
- Coverage   62.49%   62.49%   -0.01%     
==========================================
  Files        1318     1318              
  Lines      134234   134235       +1     
  Branches     5520     5521       +1     
==========================================
  Hits        83893    83893              
- Misses      49426    49427       +1     
  Partials      915      915              
Flag Coverage Δ
local.harpc-client 51.24% <ø> (ø)
rust.harpc-tower 67.03% <ø> (ø)
rust.harpc-wire-protocol 92.23% <ø> (ø)
rust.hash-graph-types 0.00% <ø> (ø)
rust.hashql-ast 87.23% <ø> (ø)
rust.hashql-eval 69.13% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Apr 16, 2026

Merging this PR will not alter performance

✅ 80 untouched benchmarks


Comparing t/be-489-allow-setting-a-password-when-none-exists (dc4c82e) with main (d8d0ed3)

Open in CodSpeed

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 16, 2026 13:19 Inactive
Comment thread apps/plugin-browser/src/scripts/background/infer-entities.ts Fixed
- security.page.tsx: remove unnecessary optional chains flagged by
  @typescript-eslint/no-unnecessary-condition.
- infer-entities.ts: sanitize event.data with full control-char strip
  + 1 000-char cap (CodeQL log-injection finding).
- changeSidebarListDisplay: wait for the sidebar to reflect the new
  display mode after toggling (uppercase "ENTITIES" / "TYPES" header
  for list mode). Fixes a race in CI where the test clicked
  "Entities" before the sidebar had updated from link to list mode.
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 16, 2026 14:19 Inactive
The backend-integration test `user.test.ts` creates an incomplete
user with `charlie@example.com`. The allowlist was rewritten in the
test reorganisation commit but omitted this email, causing the
shortname-update test to fail with FORBIDDEN.
- Scope sidebar assertions to `page-sidebar` testid to avoid matching
  settings-page labels (e.g. "Entities as a")
- Use `getByText(section, { exact: true })` for list mode,
  `getByRole("link")` for link mode instead of case-insensitive `text=`
  locator
- Remove `sleep(5_000)` and unused import from entity-type-creation test
- Wait for create-entity-type button visibility before clicking
- Remove event.data from WebSocket error log (CodeQL log injection +
  ESLint no-control-regex
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 16, 2026 16:46 Inactive
- Wait for updateEntity GraphQL response after toggling sidebar
  preference to prevent concurrent-update errors (FE-600)
- Add expandSidebarSection helper that checks MuiCollapse state
  before clicking, avoiding double-toggle
- Sign in bob during globalSetup so entity-type-creation runs as
  bob while entities-page runs as alice — no shared entity conflicts
- Remove withTestUser wrapper, callers use createUserAndCompleteSignup
  directly
- Remove event.data from WebSocket error log (CodeQL + ESLint)
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 16, 2026 22:18 Inactive
@TimDiekmann TimDiekmann marked this pull request as ready for review April 17, 2026 00:04
@cursor
Copy link
Copy Markdown

cursor Bot commented Apr 17, 2026

PR Summary

High Risk
Touches security-sensitive authentication/settings flows (password change, TOTP disable) and Kratos session-refresh handling, plus an SSR data-isolation fix; mistakes here could cause account lockouts or cross-user data exposure.

Overview
Security settings now rely on Kratos’ privileged_session_max_age for re-authentication instead of a frontend “current password” step, enabling password setup/changes for SSO-only users and consolidating TOTP disable into a 2-step unlink + backup-code clear sequence with improved error surfacing.

Server-side Apollo is hardened by disabling query deduplication for SSR to prevent cross-request auth cookie leakage, and Kratos flow utilities/error handling are tightened (safer redirect parsing/logging, stronger TypeScript typing).

Playwright is restructured into flow-based projects with global auth state seeding, dedicated test users, expanded account coverage (signin/signout/password/recovery/MFA), and more robust extension tests; additional stability fixes land in the browser plugin WebSocket logic (cookie guarding, timeouts, parse/error handling).

Reviewed by Cursor Bugbot for commit dc4c82e. Bugbot is set up for automated code reviews on this repo. Configure here.

@graphite-app graphite-app Bot requested review from a team April 17, 2026 00:05
@augmentcode
Copy link
Copy Markdown

augmentcode Bot commented Apr 17, 2026

🤖 Augment PR Summary

Summary: This PR updates HASH’s authentication flows and test infrastructure to better rely on Ory Kratos for re-authentication and to improve integration test stability.

Changes:

  • Switch security-sensitive settings (password change, TOTP disable) to depend on Kratos privileged_session_max_age rather than a custom “current password” prompt.
  • Enable password setup/change flows for users who previously didn’t have a password (e.g. SSO-only users).
  • Consolidate TOTP disable into a two-step sequence that also disables backup codes to avoid orphaned AAL2 state.
  • Add SELFSERVICE_FLOWS_SETTINGS_PRIVILEGED_SESSION_MAX_AGE to local Kratos docker-compose config.
  • Prevent cross-user SSR data leakage by disabling Apollo query deduplication on the server-side singleton client.
  • Tighten Kratos flow typing/metadata helpers and improve redirect parsing diagnostics.
  • Harden browser extension WebSocket behavior (cookie guarding, connection timeouts, safer message parsing, less noisy polling).
  • Overhaul Playwright suite layout (flow-based projects, browser matrix config, global setup with stored auth state, dedicated per-test users, improved extension fixtures).

Technical Notes: Several new flows depend on Kratos returning session_refresh_required and the shared error handler performing a browser redirect to re-authenticate.

🤖 Was this summary useful? React with 👍 or 👎

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread tests/hash-playwright/global-setup.ts
Comment thread apps/plugin-browser/src/scripts/background/infer-entities.ts Outdated
Comment thread apps/hash-frontend/src/pages/settings/security.page.tsx
- Rename getSessionCookies/hasSessionCookies/getCookieString to
  getApiOriginUrl/isLoggedIn/buildWebsocketCookieString
- isLoggedIn only checks for ory_kratos_session cookie instead of
  requiring both CSRF and session (CSRF is only needed for websocket)
- Extract shared getApiOriginUrl helper
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 17, 2026 09:38 Inactive
Comment thread tests/hash-playwright/tests/shared/get-kratos-verification-code.ts Outdated
- Guard against non-SettingsFlow response body in security.page.tsx
  error handler with optional chaining
- Wrap recovery code polling in try/catch to survive transient fetch
  errors, matching the verification code helper
- Create tests/.auth/ directory in globalSetup for clean checkouts
Comment thread tests/hash-playwright/tests/shared/get-kratos-verification-code.ts Outdated
Both getKratosVerificationCode and getKratosRecoveryCode duplicated
the same mailslurper polling, timestamp filtering, and retry logic.
The recovery variant was missing the diagnostic summary on failure.

Extract a parameterized pollForKratosCode that takes subject filter,
code extractor, and email type label. Both callers are now thin
wrappers with equal diagnostics on timeout.
@vercel vercel Bot temporarily deployed to Preview – petrinaut April 17, 2026 10:29 Inactive
Comment thread apps/hash-frontend/src/pages/settings/security.page.tsx
mustGetCsrfTokenFromFlow was called inline as an argument to
submitSettingsUpdate. A synchronous throw would skip the Promise
chain and its .finally() cleanup, leaving updatingPassword stuck
at true. Extract the token before starting the async chain.
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit dc4c82e. Configure here.

Comment thread tests/hash-playwright/tests/shared/get-kratos-verification-code.ts
Comment thread tests/hash-playwright/playwright.config.ts
@github-actions
Copy link
Copy Markdown
Contributor

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2002 $$27.4 \mathrm{ms} \pm 144 \mathrm{μs}\left({\color{gray}-1.809 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$3.39 \mathrm{ms} \pm 19.7 \mathrm{μs}\left({\color{gray}0.882 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1001 $$12.4 \mathrm{ms} \pm 91.1 \mathrm{μs}\left({\color{gray}0.398 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 3314 $$42.1 \mathrm{ms} \pm 455 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$14.0 \mathrm{ms} \pm 118 \mathrm{μs}\left({\color{gray}1.36 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 1526 $$23.4 \mathrm{ms} \pm 194 \mathrm{μs}\left({\color{gray}-0.498 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 2078 $$28.6 \mathrm{ms} \pm 186 \mathrm{μs}\left({\color{gray}-0.370 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.70 \mathrm{ms} \pm 16.6 \mathrm{μs}\left({\color{gray}-2.052 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 1033 $$13.2 \mathrm{ms} \pm 90.8 \mathrm{μs}\left({\color{gray}-1.112 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_medium

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 102 $$3.71 \mathrm{ms} \pm 24.3 \mathrm{μs}\left({\color{gray}-0.772 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.92 \mathrm{ms} \pm 14.8 \mathrm{μs}\left({\color{gray}-0.324 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 51 $$3.30 \mathrm{ms} \pm 18.2 \mathrm{μs}\left({\color{gray}-0.395 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 269 $$5.13 \mathrm{ms} \pm 29.7 \mathrm{μs}\left({\color{gray}0.495 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$3.49 \mathrm{ms} \pm 19.0 \mathrm{μs}\left({\color{gray}-0.048 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 107 $$4.05 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}-0.745 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 133 $$4.34 \mathrm{ms} \pm 32.0 \mathrm{μs}\left({\color{gray}-0.968 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$3.40 \mathrm{ms} \pm 15.7 \mathrm{μs}\left({\color{gray}-1.757 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 63 $$4.10 \mathrm{ms} \pm 28.3 \mathrm{μs}\left({\color{gray}1.42 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_none

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 2 $$2.58 \mathrm{ms} \pm 13.6 \mathrm{μs}\left({\color{gray}-0.024 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.45 \mathrm{ms} \pm 11.9 \mathrm{μs}\left({\color{gray}0.099 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 1 $$2.53 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}0.079 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 8 $$2.79 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-0.129 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$2.59 \mathrm{ms} \pm 12.7 \mathrm{μs}\left({\color{gray}0.468 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 3 $$2.78 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}0.195 \mathrm{\%}}\right) $$ Flame Graph

policy_resolution_small

Function Value Mean Flame graphs
resolve_policies_for_actor user: empty, selectivity: high, policies: 52 $$2.99 \mathrm{ms} \pm 24.1 \mathrm{μs}\left({\color{gray}1.07 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: low, policies: 1 $$2.71 \mathrm{ms} \pm 14.4 \mathrm{μs}\left({\color{gray}1.10 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: empty, selectivity: medium, policies: 25 $$2.91 \mathrm{ms} \pm 17.5 \mathrm{μs}\left({\color{gray}-0.441 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: high, policies: 94 $$3.35 \mathrm{ms} \pm 22.5 \mathrm{μs}\left({\color{gray}-0.939 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: low, policies: 1 $$2.91 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}0.459 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: seeded, selectivity: medium, policies: 26 $$3.21 \mathrm{ms} \pm 18.7 \mathrm{μs}\left({\color{gray}-0.860 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: high, policies: 66 $$3.25 \mathrm{ms} \pm 16.0 \mathrm{μs}\left({\color{gray}-1.212 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: low, policies: 1 $$2.90 \mathrm{ms} \pm 15.6 \mathrm{μs}\left({\color{gray}-0.163 \mathrm{\%}}\right) $$ Flame Graph
resolve_policies_for_actor user: system, selectivity: medium, policies: 29 $$3.27 \mathrm{ms} \pm 16.2 \mathrm{μs}\left({\color{gray}-1.114 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_complete

Function Value Mean Flame graphs
entity_by_id;one_depth 1 entities $$53.6 \mathrm{ms} \pm 323 \mathrm{μs}\left({\color{gray}0.938 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 10 entities $$45.2 \mathrm{ms} \pm 233 \mathrm{μs}\left({\color{gray}-0.327 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 25 entities $$48.9 \mathrm{ms} \pm 233 \mathrm{μs}\left({\color{gray}-0.904 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 5 entities $$55.3 \mathrm{ms} \pm 1.42 \mathrm{ms}\left({\color{red}27.9 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;one_depth 50 entities $$61.8 \mathrm{ms} \pm 327 \mathrm{μs}\left({\color{gray}2.81 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 1 entities $$60.8 \mathrm{ms} \pm 324 \mathrm{μs}\left({\color{gray}-0.073 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 10 entities $$55.0 \mathrm{ms} \pm 490 \mathrm{μs}\left({\color{gray}-0.593 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 25 entities $$101 \mathrm{ms} \pm 527 \mathrm{μs}\left({\color{gray}-2.195 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 5 entities $$45.2 \mathrm{ms} \pm 349 \mathrm{μs}\left({\color{gray}-0.803 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;two_depth 50 entities $$290 \mathrm{ms} \pm 927 \mathrm{μs}\left({\color{lightgreen}-9.120 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 1 entities $$19.0 \mathrm{ms} \pm 102 \mathrm{μs}\left({\color{gray}-0.906 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 10 entities $$20.1 \mathrm{ms} \pm 115 \mathrm{μs}\left({\color{gray}3.59 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 25 entities $$20.4 \mathrm{ms} \pm 115 \mathrm{μs}\left({\color{gray}1.90 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 5 entities $$19.0 \mathrm{ms} \pm 99.2 \mathrm{μs}\left({\color{gray}1.34 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id;zero_depth 50 entities $$25.3 \mathrm{ms} \pm 132 \mathrm{μs}\left({\color{gray}0.979 \mathrm{\%}}\right) $$ Flame Graph

read_scaling_linkless

Function Value Mean Flame graphs
entity_by_id 1 entities $$18.8 \mathrm{ms} \pm 117 \mathrm{μs}\left({\color{gray}-0.463 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$19.0 \mathrm{ms} \pm 113 \mathrm{μs}\left({\color{gray}-0.091 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 100 entities $$19.1 \mathrm{ms} \pm 128 \mathrm{μs}\left({\color{gray}-2.000 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1000 entities $$19.7 \mathrm{ms} \pm 139 \mathrm{μs}\left({\color{gray}-1.078 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10000 entities $$26.8 \mathrm{ms} \pm 240 \mathrm{μs}\left({\color{gray}2.96 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity

Function Value Mean Flame graphs
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1 $$34.2 \mathrm{ms} \pm 304 \mathrm{μs}\left({\color{gray}0.264 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1 $$34.2 \mathrm{ms} \pm 269 \mathrm{μs}\left({\color{gray}2.64 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1 $$34.0 \mathrm{ms} \pm 255 \mathrm{μs}\left({\color{gray}0.950 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1 $$36.3 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{red}8.04 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2 $$34.7 \mathrm{ms} \pm 313 \mathrm{μs}\left({\color{gray}-0.946 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1 $$34.5 \mathrm{ms} \pm 308 \mathrm{μs}\left({\color{gray}-0.467 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1 $$34.7 \mathrm{ms} \pm 269 \mathrm{μs}\left({\color{gray}1.02 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1 $$35.8 \mathrm{ms} \pm 315 \mathrm{μs}\left({\color{gray}4.07 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1 $$34.7 \mathrm{ms} \pm 315 \mathrm{μs}\left({\color{gray}2.65 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity_type

Function Value Mean Flame graphs
get_entity_type_by_id Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba $$8.40 \mathrm{ms} \pm 42.8 \mathrm{μs}\left({\color{gray}-0.497 \mathrm{\%}}\right) $$ Flame Graph

representative_read_multiple_entities

Function Value Mean Flame graphs
entity_by_property traversal_paths=0 0 $$94.3 \mathrm{ms} \pm 662 \mathrm{μs}\left({\color{gray}1.17 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$150 \mathrm{ms} \pm 862 \mathrm{μs}\left({\color{gray}2.82 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$99.2 \mathrm{ms} \pm 483 \mathrm{μs}\left({\color{gray}-3.512 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$110 \mathrm{ms} \pm 459 \mathrm{μs}\left({\color{lightgreen}-5.515 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$118 \mathrm{ms} \pm 558 \mathrm{μs}\left({\color{gray}-1.229 \mathrm{\%}}\right) $$
entity_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$126 \mathrm{ms} \pm 584 \mathrm{μs}\left({\color{gray}-0.130 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=0 0 $$102 \mathrm{ms} \pm 472 \mathrm{μs}\left({\color{gray}-0.694 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=255 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true $$130 \mathrm{ms} \pm 470 \mathrm{μs}\left({\color{gray}-2.043 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false $$108 \mathrm{ms} \pm 540 \mathrm{μs}\left({\color{gray}-0.160 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true $$118 \mathrm{ms} \pm 598 \mathrm{μs}\left({\color{gray}-2.523 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true $$119 \mathrm{ms} \pm 586 \mathrm{μs}\left({\color{gray}-1.160 \mathrm{\%}}\right) $$
link_by_source_by_property traversal_paths=2 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true $$120 \mathrm{ms} \pm 495 \mathrm{μs}\left({\color{gray}-1.379 \mathrm{\%}}\right) $$

scenarios

Function Value Mean Flame graphs
full_test query-limited $$178 \mathrm{ms} \pm 740 \mathrm{μs}\left({\color{gray}0.131 \mathrm{\%}}\right) $$ Flame Graph
full_test query-unlimited $$168 \mathrm{ms} \pm 2.45 \mathrm{ms}\left({\color{red}11.0 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-limited $$39.9 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}1.26 \mathrm{\%}}\right) $$ Flame Graph
linked_queries query-unlimited $$552 \mathrm{ms} \pm 917 \mathrm{μs}\left({\color{gray}2.02 \mathrm{\%}}\right) $$ Flame Graph

@TimDiekmann TimDiekmann requested a review from CiaranMn April 24, 2026 08:26
@TimDiekmann TimDiekmann enabled auto-merge April 24, 2026 08:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/apps > hash* Affects HASH (a `hash-*` app) area/apps area/deps Relates to third-party dependencies (area) area/infra Relates to version control, CI, CD or IaC (area) area/libs Relates to first-party libraries/crates/packages (area) area/tests > playwright New or updated Playwright tests area/tests New or updated tests type/eng > backend Owned by the @backend team type/eng > frontend Owned by the @frontend team

Development

Successfully merging this pull request may close these issues.

2 participants