BE-332: Add fail-closed request authentication to the Graph REST API

[TimDiekmann]

🌟 What is the purpose of this PR?

Makes authentication at the Graph REST API fail-closed and pluggable. Every route now rejects requests without credentials by default instead of each handler opting in, and credential verification is abstracted behind an AuthenticationProvider trait in the hash-graph-authentication crate so further providers (Kratos sessions, OAuth tokens) plug into the same pipeline in follow-up PRs.

🔗 Related links

• BE-332: Move authentication to the Graph (internal)
• BE-756: Set up hash-graph-authentication crate #9209 set up the hash-graph-authentication crate this PR builds on

🚫 Blocked by

Nothing.

🔍 What does this change?

• hash-graph-authentication gains provider::AuthenticationProvider — a provider owns both the recognition of its credentials in the request headers and their verification, returning Authentication::{NotRecognized, Verified(ActorId), Rejected} — plus request::resolve_request_actor, which resolves a request to the acting principal: provider credential first, the X-Authenticated-User-Actor-Id header second, and a recognized-but-rejected credential never falls back to the header
• StaticAuthenticationProvider serves as the wired provider (NotRecognized, so all traffic authenticates via the actor-ID header exactly as before) and as the test double
• the REST API applies an authentication middleware to all routes: missing or invalid credentials are rejected before any handler runs, so an endpoint can no longer be unauthenticated by omission; the resolved actor is stored as a private request extension and consumed through the AuthenticatedActorId extractor (renamed from AuthenticatedUserHeader)
• POST /hashql previously enforced no authentication and now requires it; the HTTP test suite pins this with a 401 test
• two bootstrap routes (/policies/seed, /actors/machine/identifier/system/{identifier}) stay reachable without credentials — they run before any actor exists
• the admin server resolves the actor through its own header middleware, which also records actor_entity_uuid on the request span for admin requests
• authentication rejections log at debug level; the HTTP span carries the status for observability

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• affected the execution graph, and the turbo.json's have been updated to reflect this
  • the new @rust/hash-graph-api → @rust/hash-graph-authentication edge is carried by the generated package.json dependencies (sync:turborepo); no turbo.json changes are needed

⚠️ Known issues

• The X-Authenticated-User-Actor-Id header remains the transitional authentication path for internal services; its hardening is tracked in BE-714 (internal). Until then the Graph must not be exposed beyond the internal network, which matches the current deployment.
• The two bootstrap routes accept requests without credentials for the Node API's startup sequence; they move behind service credentials with BE-714 (internal).
• Verified credentials are not cached yet; caching is tracked in BE-755 (internal) and becomes relevant once a remote-verifying provider lands.
• The generated TypeScript client cannot call POST /hashql anymore (its spec declares no credential parameter). No caller exists today; the session provider follow-up supersedes this, so the client is left as is.
• Requests to unmatched paths keep returning 404 — the fallback is deliberately outside the authentication middleware (route_layer).

🐾 Next steps

• Kratos session provider (whoami-backed AuthenticationProvider implementation, prepared as a follow-up to keep this diff reviewable)
• service credentials for internal services (BE-714) (internal)
• Cloudflare Access JWT as a provider in the same pipeline, replacing the admin server's bespoke actor resolution

🛡 What tests cover this?

• hash-graph-authentication unit tests: credential precedence, no-fallback on rejected credentials, header parsing
• hash-graph-api middleware tests (tower::oneshot harness): fail-closed rejection, bootstrap allowlist, extractor behavior with and without middleware, admin header middleware
• the Graph HTTP test suite runs entirely against the authenticated surface; hashql.http adds an explicit 401 test for credential-less requests

❓ How to test this?

1. Start the stack and the Graph (yarn start:graph or cargo run --bin hash-graph --all-features -- server)
2. curl -i http://127.0.0.1:4000/actors/machine/identifier/system/h → 200 (bootstrap route)
3. curl -i http://127.0.0.1:4000/actors/machine/identifier/h → 401 (no credentials)
4. Repeat 3 with -H "X-Authenticated-User-Actor-Id: <id from step 2>" → 200
5. cd tests/graph/http && sh test.sh for the full suite

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 14, 2026 11:36am
petrinaut	Ready	Preview	Aug 14, 2026 11:36am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 14, 2026 11:36am

[codecov]

Codecov Report

❌ Patch coverage is 75.50505% with 97 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.73%. Comparing base (27d9fc0) to head (0466c8f).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
libs/@local/graph/authentication/src/request.rs	83.20%	19 Missing and 2 partials ⚠️
libs/@local/graph/api/src/rest/principal.rs	0.00%	15 Missing ⚠️
libs/@local/graph/api/src/rest/entity_type.rs	0.00%	12 Missing ⚠️
libs/@local/graph/api/src/rest/data_type.rs	0.00%	11 Missing ⚠️
libs/@local/graph/api/src/rest/property_type.rs	0.00%	10 Missing ⚠️
libs/@local/graph/api/src/rest/entity/mod.rs	0.00%	9 Missing ⚠️
libs/@local/graph/api/src/rest/permissions.rs	0.00%	7 Missing ⚠️
libs/@local/graph/api/src/rest/mod.rs	0.00%	5 Missing ⚠️
libs/@local/graph/api/src/rest/entity/query/mod.rs	0.00%	4 Missing ⚠️
libs/@local/graph/api/src/rest/admin.rs	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9218      +/-   ##
==========================================
+ Coverage   59.63%   59.73%   +0.09%     
==========================================
  Files        1420     1423       +3     
  Lines      138767   139067     +300     
  Branches     6555     6561       +6     
==========================================
+ Hits        82753    83067     +314     
+ Misses      54950    54934      -16     
- Partials     1064     1066       +2     

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.99% <ø> (ø)
apps.hash-api	14.00% <ø> (ø)
local.hash-backend-utils	3.27% <ø> (ø)
local.hash-graph-sdk	10.02% <ø> (ø)
local.hash-isomorphic-utils	12.22% <ø> (ø)
rust.hash-graph-api	11.01% <71.32%> (+3.64%)	⬆️
rust.hash-graph-authentication	83.96% <83.96%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will degrade performance by 15.38%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 2 regressed benchmarks
✅ 96 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	bit_matrix/dense/iter_row[64]	140.8 ns	170 ns	-17.16%
❌	bit_matrix/dense/iter_row[200]	185.8 ns	215 ns	-13.57%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing t/be-332-move-authentication-to-the-graph (0466c8f) with main (e28fe6f)¹}

Footnotes

1. No successful run was found on main (dd43281) during the generation of this report, so e28fe6f was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit a766c47. Configure here.}

[Copilot]

Pull request overview

Adds centralized, fail-closed authentication to the Graph REST API through a pluggable provider abstraction.

Changes:

• Adds authentication providers, credential resolution, middleware, and actor extraction.
• Protects REST and HashQL routes while exempting bootstrap endpoints.
• Updates tests, dependency wiring, and dependency diagrams.

Reviewed changes

Copilot reviewed 34 out of 36 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
yarn.lock	Updates workspace dependency resolution.
tests/graph/test-data/rust/docs/dependency-diagram.mmd	Updates dependency fixture.
tests/graph/http/tests/hashql.http	Tests HashQL authentication.
libs/@local/temporal-client/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/status/rust/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/harpc/wire-protocol/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/harpc/types/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/graph/types/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/graph/temporal-versioning/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/graph/store/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/graph/authorization/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/graph/authentication/src/request.rs	Implements credential resolution and errors.
libs/@local/graph/authentication/src/provider.rs	Defines authentication provider interface.
libs/@local/graph/authentication/src/lib.rs	Exposes authentication modules.
libs/@local/graph/authentication/package.json	Adds workspace dependencies.
libs/@local/graph/authentication/docs/dependency-diagram.mmd	Documents crate dependencies.
libs/@local/graph/authentication/Cargo.toml	Adds Rust dependencies.
libs/@local/graph/api/src/rest/property_type.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/principal.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/permissions.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/mod.rs	Installs global authentication middleware.
libs/@local/graph/api/src/rest/http_tracing_layer.rs	Records middleware-resolved actors.
libs/@local/graph/api/src/rest/entity/query/mod.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/entity/mod.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/entity_type.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/data_type.rs	Uses resolved actor extraction.
libs/@local/graph/api/src/rest/auth.rs	Adds Axum authentication bindings.
libs/@local/graph/api/src/rest/admin.rs	Adds admin actor-header middleware.
libs/@local/graph/api/package.json	Adds authentication workspace dependency.
libs/@local/graph/api/docs/dependency-diagram.mmd	Updates API dependency diagram.
libs/@local/graph/api/Cargo.toml	Adds authentication and test dependencies.
libs/@local/codegen/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@local/codec/docs/dependency-diagram.mmd	Updates dependency diagram.
libs/@blockprotocol/type-system/rust/docs/dependency-diagram.mmd	Updates dependency diagram.
Cargo.lock	Updates Rust dependency lock data.
apps/hash-graph/docs/dependency-diagram.mmd	Updates application dependency diagram.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 34 out of 36 changed files in this pull request and generated no new comments.

Suppressed comments (1)

libs/@local/graph/api/src/rest/admin.rs:126

• In JWT mode this middleware does not know the authenticated admin actor: it records only the unverified actor-ID header. AdminActorId later resolves the real user at admin.rs:179-192 but never updates the span, so a normal JWT-only request has no actor_entity_uuid, while a JWT request with a spoofed header is attributed to that spoofed UUID. Record the resolved user_id in the JWT branch (overwriting any header-derived value), or move span recording to the point where AdminActorId is finalized.

        .layer(axum::middleware::from_fn(auth::actor_id_header_middleware))

[Copilot]

Pull request overview

Copilot reviewed 34 out of 36 changed files in this pull request and generated no new comments.

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$26.0 \mathrm{ms} \pm 164 \mathrm{μs}\left({\color{gray}0.057 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.43 \mathrm{ms} \pm 20.3 \mathrm{μs}\left({\color{gray}-0.587 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$12.2 \mathrm{ms} \pm 94.0 \mathrm{μs}\left({\color{gray}-1.884 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$42.6 \mathrm{ms} \pm 371 \mathrm{μs}\left({\color{gray}-2.101 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$14.7 \mathrm{ms} \pm 133 \mathrm{μs}\left({\color{gray}-2.321 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$23.8 \mathrm{ms} \pm 186 \mathrm{μs}\left({\color{lightgreen}-6.614 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$27.3 \mathrm{ms} \pm 249 \mathrm{μs}\left({\color{gray}2.15 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.76 \mathrm{ms} \pm 21.3 \mathrm{μs}\left({\color{gray}0.970 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$13.6 \mathrm{ms} \pm 106 \mathrm{μs}\left({\color{gray}2.55 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.67 \mathrm{ms} \pm 18.4 \mathrm{μs}\left({\color{gray}-4.276 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.98 \mathrm{ms} \pm 12.7 \mathrm{μs}\left({\color{gray}-1.667 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.36 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}-2.273 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.09 \mathrm{ms} \pm 31.3 \mathrm{μs}\left({\color{gray}-3.921 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.51 \mathrm{ms} \pm 20.4 \mathrm{μs}\left({\color{gray}-1.610 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.10 \mathrm{ms} \pm 26.7 \mathrm{μs}\left({\color{gray}-1.555 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.39 \mathrm{ms} \pm 38.8 \mathrm{μs}\left({\color{gray}-0.496 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.47 \mathrm{ms} \pm 26.4 \mathrm{μs}\left({\color{gray}-1.980 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.02 \mathrm{ms} \pm 21.2 \mathrm{μs}\left({\color{gray}-2.936 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.70 \mathrm{ms} \pm 20.7 \mathrm{μs}\left({\color{gray}-1.116 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.49 \mathrm{ms} \pm 12.0 \mathrm{μs}\left({\color{gray}-0.505 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.66 \mathrm{ms} \pm 14.3 \mathrm{μs}\left({\color{gray}-1.022 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.96 \mathrm{ms} \pm 16.1 \mathrm{μs}\left({\color{gray}-0.620 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.74 \mathrm{ms} \pm 13.1 \mathrm{μs}\left({\color{gray}-1.154 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.94 \mathrm{ms} \pm 20.9 \mathrm{μs}\left({\color{gray}0.107 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.03 \mathrm{ms} \pm 16.4 \mathrm{μs}\left({\color{gray}-1.465 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.72 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-4.248 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.96 \mathrm{ms} \pm 14.7 \mathrm{μs}\left({\color{gray}-1.900 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.40 \mathrm{ms} \pm 23.8 \mathrm{μs}\left({\color{gray}-1.317 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.97 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}-2.489 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.23 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-0.959 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.35 \mathrm{ms} \pm 25.4 \mathrm{μs}\left({\color{gray}-0.677 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.94 \mathrm{ms} \pm 14.4 \mathrm{μs}\left({\color{gray}-3.245 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.27 \mathrm{ms} \pm 21.6 \mathrm{μs}\left({\color{gray}-1.647 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$42.3 \mathrm{ms} \pm 291 \mathrm{μs}\left({\color{gray}-0.868 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$33.8 \mathrm{ms} \pm 211 \mathrm{μs}\left({\color{gray}1.90 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$35.9 \mathrm{ms} \pm 247 \mathrm{μs}\left({\color{gray}1.47 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$32.7 \mathrm{ms} \pm 214 \mathrm{μs}\left({\color{gray}1.19 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$42.4 \mathrm{ms} \pm 339 \mathrm{μs}\left({\color{lightgreen}-5.298 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.3 \mathrm{ms} \pm 392 \mathrm{μs}\left({\color{gray}3.88 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$40.7 \mathrm{ms} \pm 234 \mathrm{μs}\left({\color{gray}2.65 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$92.7 \mathrm{ms} \pm 671 \mathrm{μs}\left({\color{gray}2.46 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$34.7 \mathrm{ms} \pm 236 \mathrm{μs}\left({\color{gray}2.97 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$275 \mathrm{ms} \pm 1.10 \mathrm{ms}\left({\color{lightgreen}-9.702 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.0 \mathrm{ms} \pm 58.1 \mathrm{μs}\left({\color{gray}1.07 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.1 \mathrm{ms} \pm 59.0 \mathrm{μs}\left({\color{gray}1.00 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.2 \mathrm{ms} \pm 77.1 \mathrm{μs}\left({\color{gray}1.88 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.1 \mathrm{ms} \pm 79.4 \mathrm{μs}\left({\color{gray}2.33 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.2 \mathrm{ms} \pm 65.5 \mathrm{μs}\left({\color{gray}2.73 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.0 \mathrm{ms} \pm 87.2 \mathrm{μs}\left({\color{gray}1.35 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.2 \mathrm{ms} \pm 64.1 \mathrm{μs}\left({\color{gray}2.17 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.2 \mathrm{ms} \pm 80.9 \mathrm{μs}\left({\color{gray}1.26 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.4 \mathrm{ms} \pm 88.2 \mathrm{μs}\left({\color{gray}1.76 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$11.7 \mathrm{ms} \pm 97.5 \mathrm{μs}\left({\color{gray}1.60 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$11.8 \mathrm{ms} \pm 84.8 \mathrm{μs}\left({\color{gray}-0.011 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$11.8 \mathrm{ms} \pm 62.0 \mathrm{μs}\left({\color{gray}1.81 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$11.6 \mathrm{ms} \pm 67.2 \mathrm{μs}\left({\color{gray}0.123 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$11.6 \mathrm{ms} \pm 69.9 \mathrm{μs}\left({\color{gray}-0.002 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$11.5 \mathrm{ms} \pm 54.4 \mathrm{μs}\left({\color{gray}-1.536 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$11.4 \mathrm{ms} \pm 65.9 \mathrm{μs}\left({\color{gray}-2.837 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$11.5 \mathrm{ms} \pm 68.6 \mathrm{μs}\left({\color{gray}-0.463 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$11.4 \mathrm{ms} \pm 58.5 \mathrm{μs}\left({\color{gray}-3.113 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$11.8 \mathrm{ms} \pm 85.7 \mathrm{μs}\left({\color{gray}1.98 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$8.42 \mathrm{ms} \pm 57.4 \mathrm{μs}\left({\color{gray}-1.309 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$61.1 \mathrm{ms} \pm 495 \mathrm{μs}\left({\color{red}9.43 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$112 \mathrm{ms} \pm 611 \mathrm{μs}\left({\color{gray}3.94 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$68.1 \mathrm{ms} \pm 433 \mathrm{μs}\left({\color{red}5.99 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$78.0 \mathrm{ms} \pm 679 \mathrm{μs}\left({\color{red}6.40 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$86.7 \mathrm{ms} \pm 522 \mathrm{μs}\left({\color{gray}4.44 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$92.1 \mathrm{ms} \pm 627 \mathrm{μs}\left({\color{gray}4.29 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$45.0 \mathrm{ms} \pm 252 \mathrm{μs}\left({\color{gray}1.90 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$73.5 \mathrm{ms} \pm 497 \mathrm{μs}\left({\color{gray}-3.729 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$51.5 \mathrm{ms} \pm 301 \mathrm{μs}\left({\color{gray}1.51 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$60.8 \mathrm{ms} \pm 393 \mathrm{μs}\left({\color{gray}-0.720 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$62.3 \mathrm{ms} \pm 409 \mathrm{μs}\left({\color{gray}-0.668 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$62.3 \mathrm{ms} \pm 367 \mathrm{μs}\left({\color{gray}-3.489 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$122 \mathrm{ms} \pm 505 \mathrm{μs}\left({\color{gray}-4.876 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$135 \mathrm{ms} \pm 559 \mathrm{μs}\left({\color{gray}-1.994 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$19.5 \mathrm{ms} \pm 216 \mathrm{μs}\left({\color{gray}-1.278 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$560 \mathrm{ms} \pm 1.01 \mathrm{ms}\left({\color{gray}0.381 \mathrm{\%}}\right) $$	Flame Graph