spicedb timeout

Author: geropl

components/server/src/authorization/spicedb-authorizer.ts

@@ -43,7 +43,7 @@ export class SpiceDBAuthorizer {
         const timer = spicedbClientLatency.startTimer();
         let error: Error | undefined;
         try {
-            const response = await this.client.checkPermission(req);
+            const response = await timeout(this.client.checkPermission(req), 5000);
             const permitted = response.permissionship === v1.CheckPermissionResponse_Permissionship.HAS_PERMISSION;
 
             return permitted;
@@ -68,10 +68,13 @@ export class SpiceDBAuthorizer {
         const timer = spicedbClientLatency.startTimer();
         let error: Error | undefined;
         try {
-            const response = await this.client.writeRelationships(
-                v1.WriteRelationshipsRequest.create({
-                    updates,
-                }),
+            const response = await timeout(
+                this.client.writeRelationships(
+                    v1.WriteRelationshipsRequest.create({
+                        updates,
+                    }),
+                ),
+                5000,
             );
             log.info("[spicedb] Successfully wrote relationships.", { response, updates });
 
@@ -86,28 +89,34 @@ export class SpiceDBAuthorizer {
     }
 
     async deleteRelationships(req: v1.DeleteRelationshipsRequest): Promise<v1.ReadRelationshipsResponse[]> {
-        if (!this.client) {
+        const client = this.client;
+        if (!client) {
             return [];
         }
         const timing = startTimer();
 
         const timer = spicedbClientLatency.startTimer();
         let error: Error | undefined;
         try {
-            const existing = await this.client.readRelationships(v1.ReadRelationshipsRequest.create(req));
-            if (existing.length > 0) {
-                const response = await this.client.deleteRelationships(req);
-                const after = await this.client.readRelationships(v1.ReadRelationshipsRequest.create(req));
-                if (after.length > 0) {
-                    log.error("[spicedb] Failed to delete relationships.", { existing, after, request: req });
-                }
-                log.info(`[spicedb] Successfully deleted ${existing.length} relationships.`, {
-                    response,
-                    request: req,
-                    existing,
-                });
-            }
-            return existing;
+            return await timeout(
+                (async () => {
+                    const existing = await client.readRelationships(v1.ReadRelationshipsRequest.create(req));
+                    if (existing.length > 0) {
+                        const response = await client.deleteRelationships(req);
+                        const after = await client.readRelationships(v1.ReadRelationshipsRequest.create(req));
+                        if (after.length > 0) {
+                            log.error("[spicedb] Failed to delete relationships.", { existing, after, request: req });
+                        }
+                        log.info(`[spicedb] Successfully deleted ${existing.length} relationships.`, {
+                            response,
+                            request: req,
+                            existing,
+                        });
+                    }
+                    return existing;
+                })(),
+                5000,
+            );
         } catch (err) {
             error = err;
             // While in we're running two authorization systems in parallel, we do not hard fail on writes.
@@ -132,6 +141,25 @@ function startTimer() {
 }
 
 function stopTimer(method: string, hrtime: [number, number]) {
-    const seconds = (hrtime[0] + hrtime[1] / 1e6).toFixed(3);
-    log.info(`[SPICEDB] ${method} (${seconds} ms)`);
+    const endTime = process.hrtime(hrtime);
+    const ms = (endTime[0] * 1000 + endTime[1] / 1e6).toFixed(3);
+    log.info(`[SPICEDB] ${method} (${ms} ms)`);
+}
+
+async function timeout<T>(code: Promise<T>, ms: number): Promise<T> {
+    return new Promise<T>((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`[spicedb] timed out after ${ms}ms`));
+        }, ms);
+        code.then(
+            (res) => {
+                clearTimeout(timer);
+                resolve(res);
+            },
+            (err) => {
+                clearTimeout(timer);
+                reject(err);
+            },
+        );
+    });
 }