{"record":{"id":"4eaec0619008cee6","repo":"SigNoz/signoz","slug":"errcodeauthzunavailable","errorCode":"ErrCodeAuthZUnavailable","errorMessage":"failed to read tuples from authorization server","messagePattern":"failed to read tuples from authorization server","errorType":"error_code","errorClass":null,"httpStatus":500,"severity":"critical","filePath":"pkg/authz/openfgaserver/server.go","lineNumber":299,"sourceCode":"\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (server *Server) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {\n\tstoreID, _ := server.getStoreIDandModelID()\n\tvar tuples []*openfgav1.TupleKey\n\tcontinuationToken := \"\"\n\n\tfor {\n\t\tresponse, err := server.openfgaServer.Read(ctx, &openfgav1.ReadRequest{\n\t\t\tStoreId:           storeID,\n\t\t\tTupleKey:          tupleKey,\n\t\t\tContinuationToken: continuationToken,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, errors.TypeInternal, authtypes.ErrCodeAuthZUnavailable, \"failed to read tuples from authorization server\")\n\t\t}\n\n\t\tfor _, tuple := range response.Tuples {\n\t\t\ttuples = append(tuples, tuple.Key)\n\t\t}\n\n\t\tif response.ContinuationToken == \"\" {\n\t\t\tbreak\n\t\t}\n\t\tcontinuationToken = response.ContinuationToken\n\t}\n\n\treturn tuples, nil\n}\n\nfunc (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType coretypes.Type) ([]*coretypes.Object, error) {\n\tstoreID, modelID := server.getStoreIDandModelID()\n\tresponse, err := server.openfgaServer.ListObjects(ctx, &openfgav1.ListObjectsRequest{","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/authz/openfgaserver/server.go#L281-L317","documentation":"Thrown by SigNoz's OpenFGA authorization server wrapper when the embedded openfgaServer.Read RPC (listing relationship tuples, with pagination via continuation tokens) fails. It wraps the gRPC error with ErrCodeAuthZUnavailable, signaling the authorization backend is not usable right now.","triggerScenarios":"Calling ReadTuples while iterating pages with a continuation token and the OpenFGA storage (Postgres/MySQL) is down, the store ID is invalid, the request context times out, or the authorization model/tuple keys are malformed.","commonSituations":"OpenFGA datastore misconfiguration (bad DSN, wrong store ID); OpenFGA container crash-looping in the SigNoz deployment; large tuple sets exceeding request deadlines; version mismatch between the embedded OpenFGA server and the client proto.","solutions":["Check OpenFGA server logs and its datastore connectivity (DB up, migrations applied)","Verify the store ID being passed corresponds to an existing OpenFGA store (getOrCreateStore succeeded)","Increase the context timeout/deadline for large tuple reads","Restart the OpenFGA component; if persistent, recreate the store and re-sync tuples"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"tuples, err := server.ReadTuples(ctx, storeID, tupleKey, token)\nif err != nil {\n\tif errors.Is(err, authtypes.ErrCodeAuthZUnavailable) { backoff.Retry(...) }\n}","preventionTips":["Health-check the OpenFGA datastore before serving auth traffic","Pin compatible OpenFGA client/server versions","Pass cancellable contexts with deadlines for paginated reads"],"tags":["authorization","openfga","grpc","availability","tuples"],"backgroundTag":"authorization-backend-unavailable","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}