BE-760: Verify Kratos sessions in the Graph API by TimDiekmann · Pull Request #9219 · hashintel/hash

TimDiekmann · 2026-08-14T11:24:27Z

🌟 What is the purpose of this PR?

Sessions issued by Ory Kratos now authenticate requests at the Graph REST API. The Kratos-backed provider is the first real credential path through the authentication pipeline introduced in #9218: it verifies the session against the whoami endpoint, resolves the identity's provisioned Graph actor, and only accepts existing user actors.

🔗 Related links

BE-760: Verify Kratos sessions in the Graph API (internal)

🚫 Blocked by

BE-332: Add fail-closed request authentication to the Graph REST API #9218 — this PR is stacked on its branch

🔍 What does this change?

hash-graph-authentication gains kratos::KratosSessionProvider: recognizes the X-Session-Token header and the ory_kratos_session cookie, verifies the session against the Kratos whoami endpoint, requires an explicitly active session, reads the actor from the identity's metadata_public.graph_actor_id, and accepts only an existing user actor. Cookies are matched byte-level by name, so unrelated (including non-ASCII) cookies neither trigger verification nor mask the session cookie
actor::StorePoolActorResolver resolves actor IDs against the principal store behind the ResolveActor trait, keeping the provider independent of the concrete store types
the REST server wires the Kratos provider as its authentication provider; HASH_KRATOS_PUBLIC_URL is required to run the server. The flag is optional at parse time so server --healthcheck works without it — the same pattern the admin server uses for its external-service URLs
authentication failures now return client-safe messages; identifiers remain in the server-side logs (addresses the review comment on BE-332: Add fail-closed request authentication to the Graph REST API #9218 — the affected error variants only become reachable with this provider). Rejections caused by broken actor provisioning (missing, unknown, or non-user actor behind a verified session) log at warn level so they are visible in production logs
the whoami HTTP client never follows redirects (a redirect would forward the session token to the redirect target) and attaches the provider response body to all failure reports
the compose graph service sets HASH_KRATOS_PUBLIC_URL
new httpyac suite kratos-session.http runs the real wire flow against Kratos: provision an identity, log in, authenticate with the session, and verify the rejection paths

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

affected the execution graph, and the turbo.json's have been updated to reflect this
- the new hash-graph-authentication → hash-graph-authorization/hash-graph-store edges are carried by the generated package.json dependencies (sync:turborepo); no turbo.json changes are needed

⚠️ Known issues

Deployments outside compose must set HASH_KRATOS_PUBLIC_URL (with network reach to Kratos' public API) before this rolls out — the server refuses to start without it. server --healthcheck parses and probes without the variable.
Verified sessions are not cached yet — every request verifies against Kratos and the principal store. Tracked in BE-755 (internal); lands before the frontend switches to direct Graph sessions.
The httpyac suite covers the token flow; the cookie flow is covered by unit tests and was verified manually (the browser CSRF dance adds no verification value for the Graph side).
Kratos identities accumulate across local test runs because reset-database only wipes the Graph database; the suite uses unique e-mail addresses per run. Cleaning Kratos/Hydra in the reset command is tracked in BE-762 (internal).
The session's expires_at is not tracked by the Graph; Kratos' own per-request whoami validation is authoritative.

🐾 Next steps

service credentials for internal services (BE-714) (internal)
Cloudflare Access JWTs as a provider in the same pipeline (BE-761) (internal)
session verification cache (BE-755) (internal)

🛡 What tests cover this?

kratos.rs wire tests against an in-test fake Kratos that only serves sessions when the expected credential is forwarded: active-flag handling, provisioning, actor-type checks, status-code mapping (including redirects and timeouts), cookie parsing next to non-ASCII cookies
the middleware and orchestration tests from the parent PR run unchanged against the new provider surface
kratos-session.http end-to-end against a real Kratos (runs in CI via the compose dev profile): session token authenticates and is subject to user policies, invalid token is rejected as an invalid session, a rejected session never falls back to the actor-ID header, unprovisioned and unknown-actor identities are rejected with the client-safe messages

❓ How to test this?

Start the external services (docker compose --profile dev up in infra/compose) and the Graph (yarn start:graph or cargo run --bin hash-graph --all-features -- server)
cd tests/graph/http && yarn reset-database -o none && yarn httpyac send --all tests/kratos-session.http
Full suite: cd tests/graph/http && sh test.sh

🐒 Demo

N/A — backend authentication path; see the httpyac suite output for the wire-level flow.

vercel · 2026-08-14T11:24:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Building	Preview	Aug 14, 2026 12:00pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hash	Ignored	Preview	Aug 14, 2026 12:00pm
petrinaut	Skipped		Aug 14, 2026 12:00pm

cursor · 2026-08-14T11:34:22Z

PR Summary

^{Cursor Bugbot is generating a summary for commit 5a8fa52. Configure here.}

Copilot

Pull request overview

Adds Kratos-backed session authentication to the Graph REST API.

Changes:

Verifies session headers/cookies through Kratos and resolves provisioned user actors.
Wires authentication configuration into the Graph server and Compose.
Adds unit and end-to-end authentication coverage.

Reviewed changes

Copilot reviewed 25 out of 27 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`yarn.lock`	Updates generated dependency resolution.
`tests/graph/test-data/rust/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`tests/graph/http/tests/kratos-session.http`	Adds Kratos session integration scenarios.
`tests/graph/http/test.sh`	Runs the new integration suite.
`libs/@local/temporal-client/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/harpc/wire-protocol/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/harpc/types/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/graph/types/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/graph/temporal-versioning/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/graph/store/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/graph/authorization/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/graph/authentication/src/lib.rs`	Exports actor and Kratos modules.
`libs/@local/graph/authentication/src/kratos.rs`	Implements Kratos session verification.
`libs/@local/graph/authentication/src/actor.rs`	Adds principal-store actor resolution.
`libs/@local/graph/authentication/package.json`	Adds generated workspace dependencies.
`libs/@local/graph/authentication/docs/dependency-diagram.mmd`	Refreshes authentication dependencies.
`libs/@local/graph/authentication/Cargo.toml`	Adds provider implementation dependencies.
`libs/@local/graph/api/src/rest/mod.rs`	Installs the Kratos provider.
`libs/@local/graph/api/src/rest/auth.rs`	Re-exports provider integration types.
`libs/@local/graph/api/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/codegen/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@local/codec/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`libs/@blockprotocol/type-system/rust/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.
`infra/compose/compose.yml`	Configures the Graph’s Kratos URL.
`Cargo.lock`	Records new Rust dependencies.
`apps/hash-graph/src/subcommand/server.rs`	Adds session-authentication server configuration.
`apps/hash-graph/docs/dependency-diagram.mmd`	Refreshes generated dependency graph.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 25 out of 27 changed files in this pull request and generated 1 comment.

codecov · 2026-08-14T11:48:17Z

Codecov Report

❌ Patch coverage is 93.49776% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.83%. Comparing base (0466c8f) to head (f46c200).

Files with missing lines	Patch %	Lines
libs/@local/graph/authentication/src/actor.rs	0.00%	14 Missing ⚠️
libs/@local/graph/authentication/src/kratos.rs	97.20%	8 Missing and 4 partials ⚠️
libs/@local/graph/api/src/rest/mod.rs	0.00%	3 Missing ⚠️

Additional details and impacted files

@@                              Coverage Diff                              @@
##           t/be-332-move-authentication-to-the-graph    #9219      +/-   ##
=============================================================================
+ Coverage                                      59.73%   59.83%   +0.10%     
=============================================================================
  Files                                           1423     1425       +2     
  Lines                                         139067   139512     +445     
  Branches                                        6561     6570       +9     
=============================================================================
+ Hits                                           83067    83483     +416     
- Misses                                         54934    54959      +25     
- Partials                                        1066     1070       +4

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`14.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed-hq · 2026-08-14T11:52:31Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing t/be-760-verify-kratos-sessions-in-the-graph-api (f46c200) with t/be-332-move-authentication-to-the-graph (0466c8f)}

Copilot

Pull request overview

Copilot reviewed 25 out of 27 changed files in this pull request and generated 1 comment.

github-actions · 2026-08-14T13:24:03Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$29.9 \mathrm{ms} \pm 233 \mathrm{μs}\left({\color{red}8.15 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.51 \mathrm{ms} \pm 19.1 \mathrm{μs}\left({\color{gray}-1.718 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$14.5 \mathrm{ms} \pm 122 \mathrm{μs}\left({\color{red}12.2 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$45.0 \mathrm{ms} \pm 423 \mathrm{μs}\left({\color{gray}2.02 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.0 \mathrm{ms} \pm 153 \mathrm{μs}\left({\color{gray}-3.593 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$26.4 \mathrm{ms} \pm 272 \mathrm{μs}\left({\color{red}8.34 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$30.4 \mathrm{ms} \pm 202 \mathrm{μs}\left({\color{red}5.64 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.88 \mathrm{ms} \pm 29.5 \mathrm{μs}\left({\color{gray}-2.337 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.7 \mathrm{ms} \pm 129 \mathrm{μs}\left({\color{red}6.18 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$4.05 \mathrm{ms} \pm 34.3 \mathrm{μs}\left({\color{red}5.10 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.02 \mathrm{ms} \pm 18.8 \mathrm{μs}\left({\color{gray}-0.488 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.49 \mathrm{ms} \pm 31.8 \mathrm{μs}\left({\color{gray}2.63 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.30 \mathrm{ms} \pm 38.7 \mathrm{μs}\left({\color{gray}0.735 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.61 \mathrm{ms} \pm 33.1 \mathrm{μs}\left({\color{gray}0.046 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.33 \mathrm{ms} \pm 20.7 \mathrm{μs}\left({\color{gray}3.15 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.58 \mathrm{ms} \pm 39.0 \mathrm{μs}\left({\color{gray}2.81 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.62 \mathrm{ms} \pm 26.1 \mathrm{μs}\left({\color{gray}3.21 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.21 \mathrm{ms} \pm 26.6 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.78 \mathrm{ms} \pm 19.4 \mathrm{μs}\left({\color{gray}3.20 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.57 \mathrm{ms} \pm 14.9 \mathrm{μs}\left({\color{gray}1.35 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.74 \mathrm{ms} \pm 18.0 \mathrm{μs}\left({\color{gray}2.62 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.09 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}3.73 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.83 \mathrm{ms} \pm 16.6 \mathrm{μs}\left({\color{gray}2.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$3.10 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}3.11 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.24 \mathrm{ms} \pm 20.0 \mathrm{μs}\left({\color{gray}3.74 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.85 \mathrm{ms} \pm 20.7 \mathrm{μs}\left({\color{gray}1.15 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.06 \mathrm{ms} \pm 26.4 \mathrm{μs}\left({\color{gray}0.019 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.70 \mathrm{ms} \pm 40.7 \mathrm{μs}\left({\color{red}5.19 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.17 \mathrm{ms} \pm 22.6 \mathrm{μs}\left({\color{red}5.35 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.40 \mathrm{ms} \pm 25.7 \mathrm{μs}\left({\color{gray}1.66 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.72 \mathrm{ms} \pm 29.0 \mathrm{μs}\left({\color{red}7.63 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.13 \mathrm{ms} \pm 20.9 \mathrm{μs}\left({\color{gray}2.55 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.62 \mathrm{ms} \pm 26.4 \mathrm{μs}\left({\color{red}5.80 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$43.5 \mathrm{ms} \pm 225 \mathrm{μs}\left({\color{gray}-1.000 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$33.7 \mathrm{ms} \pm 197 \mathrm{μs}\left({\color{gray}-4.330 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$36.6 \mathrm{ms} \pm 219 \mathrm{μs}\left({\color{gray}-1.114 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$33.0 \mathrm{ms} \pm 223 \mathrm{μs}\left({\color{gray}-0.294 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$43.3 \mathrm{ms} \pm 313 \mathrm{μs}\left({\color{gray}-3.565 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.1 \mathrm{ms} \pm 440 \mathrm{μs}\left({\color{gray}-1.142 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$40.7 \mathrm{ms} \pm 261 \mathrm{μs}\left({\color{gray}-1.939 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$93.6 \mathrm{ms} \pm 635 \mathrm{μs}\left({\color{gray}-2.645 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$35.0 \mathrm{ms} \pm 326 \mathrm{μs}\left({\color{gray}-1.908 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$313 \mathrm{ms} \pm 1.26 \mathrm{ms}\left({\color{red}11.0 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.8 \mathrm{ms} \pm 91.1 \mathrm{μs}\left({\color{gray}4.34 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.7 \mathrm{ms} \pm 84.6 \mathrm{μs}\left({\color{gray}0.777 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.5 \mathrm{ms} \pm 67.3 \mathrm{μs}\left({\color{gray}0.436 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$12.0 \mathrm{ms} \pm 88.1 \mathrm{μs}\left({\color{red}6.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.5 \mathrm{ms} \pm 68.9 \mathrm{μs}\left({\color{gray}-0.754 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.6 \mathrm{ms} \pm 90.0 \mathrm{μs}\left({\color{gray}2.15 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.6 \mathrm{ms} \pm 61.2 \mathrm{μs}\left({\color{gray}-0.026 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.8 \mathrm{ms} \pm 65.3 \mathrm{μs}\left({\color{gray}3.36 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.7 \mathrm{ms} \pm 65.4 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.2 \mathrm{ms} \pm 85.5 \mathrm{μs}\left({\color{gray}-1.053 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$11.7 \mathrm{ms} \pm 59.0 \mathrm{μs}\left({\color{gray}-3.422 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$12.1 \mathrm{ms} \pm 85.9 \mathrm{μs}\left({\color{gray}-1.944 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$11.9 \mathrm{ms} \pm 103 \mathrm{μs}\left({\color{gray}-0.911 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$12.2 \mathrm{ms} \pm 103 \mathrm{μs}\left({\color{gray}2.94 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$12.1 \mathrm{ms} \pm 80.7 \mathrm{μs}\left({\color{gray}1.56 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$12.1 \mathrm{ms} \pm 69.1 \mathrm{μs}\left({\color{gray}0.107 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$12.0 \mathrm{ms} \pm 81.4 \mathrm{μs}\left({\color{gray}-0.420 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$11.9 \mathrm{ms} \pm 86.4 \mathrm{μs}\left({\color{gray}0.620 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$12.2 \mathrm{ms} \pm 93.7 \mathrm{μs}\left({\color{gray}1.42 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.83 \mathrm{ms} \pm 67.5 \mathrm{μs}\left({\color{gray}-2.409 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$65.5 \mathrm{ms} \pm 554 \mathrm{μs}\left({\color{gray}3.23 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$121 \mathrm{ms} \pm 778 \mathrm{μs}\left({\color{gray}-3.447 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$72.8 \mathrm{ms} \pm 487 \mathrm{μs}\left({\color{gray}2.91 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$81.5 \mathrm{ms} \pm 493 \mathrm{μs}\left({\color{gray}-2.301 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$92.0 \mathrm{ms} \pm 694 \mathrm{μs}\left({\color{lightgreen}-7.457 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$100 \mathrm{ms} \pm 685 \mathrm{μs}\left({\color{gray}-1.470 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$48.6 \mathrm{ms} \pm 344 \mathrm{μs}\left({\color{gray}2.74 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$77.5 \mathrm{ms} \pm 542 \mathrm{μs}\left({\color{gray}-0.642 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$54.6 \mathrm{ms} \pm 425 \mathrm{μs}\left({\color{gray}1.93 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$63.0 \mathrm{ms} \pm 387 \mathrm{μs}\left({\color{gray}0.337 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$66.3 \mathrm{ms} \pm 401 \mathrm{μs}\left({\color{gray}0.324 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$67.6 \mathrm{ms} \pm 479 \mathrm{μs}\left({\color{gray}1.06 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$119 \mathrm{ms} \pm 778 \mathrm{μs}\left({\color{lightgreen}-6.946 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$130 \mathrm{ms} \pm 689 \mathrm{μs}\left({\color{lightgreen}-6.229 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$23.8 \mathrm{ms} \pm 382 \mathrm{μs}\left({\color{red}18.7 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$541 \mathrm{ms} \pm 1.32 \mathrm{ms}\left({\color{gray}0.625 \mathrm{\%}}\right) $$	Flame Graph

BE-760: Verify Kratos sessions in the Graph API

5a8fa52

TimDiekmann self-assigned this Aug 14, 2026

vercel Bot deployed to Preview – hashdotdesign-tokens August 14, 2026 11:25 View deployment

vercel Bot deployed to Preview – petrinaut August 14, 2026 11:26 View deployment

TimDiekmann marked this pull request as ready for review August 14, 2026 11:34

Copilot AI balanced review requested due to automatic review settings August 14, 2026 11:34

Copilot started reviewing on behalf of TimDiekmann August 14, 2026 11:34 View session

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Comment thread libs/@local/graph/authentication/src/kratos.rs Outdated

vercel Bot deployed to Preview – hash August 14, 2026 11:40 View deployment

BE-760: Keep identity data out of provider failure reports

80bc72a

Copilot AI review requested due to automatic review settings August 14, 2026 11:43

vercel Bot temporarily deployed to Preview – petrinaut August 14, 2026 11:43 Inactive

Copilot started reviewing on behalf of TimDiekmann August 14, 2026 11:44 View session

TimDiekmann deployed to pull-request August 14, 2026 11:44 — with GitHub Actions Active

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/hash-graph/src/subcommand/server.rs

vercel Bot deployed to Preview – hash August 14, 2026 11:52 View deployment

BE-760: Reject non-HTTP Kratos URLs as a configuration error

f46c200

Copilot AI review requested due to automatic review settings August 14, 2026 12:00

vercel Bot temporarily deployed to Preview – petrinaut August 14, 2026 12:00 Inactive

Copilot started reviewing on behalf of TimDiekmann August 14, 2026 12:00 View session

TimDiekmann deployed to pull-request August 14, 2026 12:01 — with GitHub Actions Active

Copilot AI reviewed Aug 14, 2026

View reviewed changes

Comment thread libs/@local/graph/authentication/src/kratos.rs

TimDiekmann requested a review from a team August 14, 2026 13:47

Uh oh!

Conversation

TimDiekmann commented Aug 14, 2026

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

🐒 Demo

Uh oh!

vercel Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 14, 2026

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

codecov Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed-hq Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actions Bot commented Aug 14, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Aug 14, 2026 •

edited

Loading

codecov Bot commented Aug 14, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 14, 2026 •

edited

Loading