Building v0.47.0 fails - cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation

verkaufer commented 1 month ago

Preflight checklist

[X] I could not find a solution in the existing issues, docs, nor discussions.
[X] I agree to follow this project's Code of Conduct.
[X] I have read and am following this repository's Contribution Guidelines.
[ ] I have joined the Ory Community Slack.
[ ] I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

I'm building a local OIDC provider and using BadgerDB as my storage for users and registered applications.

After adding BadgerDB v4.3.0 , the go build command fails with output suggesting ristretto.Config is not instantiated corrected.

Reproducing the bug

Create a go.mod with these dependencies:

require (
    github.com/dgraph-io/badger/v4 v4.3.0
    github.com/ory/fosite v0.47.0
)

Create a main.go that instantiates BadgerDB and ory/fosite:

Click to expand...

```go package main import ( "crypto/rand" "crypto/rsa" "time" "github.com/dgraph-io/badger/v4" "github.com/ory/fosite" "github.com/ory/fosite/compose" "github.com/ory/fosite/handler/openid" "github.com/ory/fosite/storage" "github.com/ory/fosite/token/jwt" ) var ( // TODO: read from env secret = []byte("some-cool-secret-that-is-32bytes") config = &fosite.Config{ AccessTokenLifespan: time.Minute * 30, IDTokenIssuer: "https://foobar123456.com", EnforcePKCEForPublicClients: true, } // TODO replace with custom storage store = storage.NewExampleStore() privateKey, _ = rsa.GenerateKey(rand.Reader, 2048) ) // Build a fosite instance with all OAuth2 and OpenID Connect handlers enabled, plugging in our configurations as specified above. var oauth2 = compose.ComposeAllEnabled(config, store, privateKey) // A session is passed from the `/auth` to the `/token` endpoint. You probably want to store data like: "Who made the request", func newSession(user string) *openid.DefaultSession { return &openid.DefaultSession{ Claims: &jwt.IDTokenClaims{ Subject: user, Audience: []string{"https://my-client.my-application.com"}, ExpiresAt: time.Now().Add(time.Hour * 6), IssuedAt: time.Now(), RequestedAt: time.Now(), AuthTime: time.Now(), }, Headers: &jwt.Headers{ Extra: make(map[string]interface{}), }, } } func main() { db, err := badger.Open(badger.DefaultOptions("tmp/badger")) if err != nil { log.Fatal(err) } defer db.Close() session := newSession("foobar") fmt.Println(session.Subject) } ```

Run go build

Relevant log output

# github.com/ory/fosite
../../go/pkg/mod/github.com/ory/fosite@v0.47.0/client_authentication_jwks_strategy.go:33:20: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation
../../go/pkg/mod/github.com/ory/fosite@v0.47.0/client_authentication_jwks_strategy.go:40:33: cannot use generic type ristretto.Config[K z.Key, V any] without instantiation
../../go/pkg/mod/github.com/ory/fosite@v0.47.0/client_authentication_jwks_strategy.go:74:34: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation



### Relevant configuration

_No response_

### Version

v0.47.0

### On which operating system are you observing this issue?

macOS

### In which environment are you deploying?

Other

### Additional Context

I tried using the `replace` directive but BadgerDB is incompatible with a lower version of `dgraph-io/ristretto` . 

Using `v0.1.1` caused compiler issues with BadgerDB.

verkaufer commented 1 month ago

It looks like v0.12.0 uses generics more heavily and the maintainers are aware?

james-d-elliott commented 1 month ago

Yeah this compatibility was broken here: https://github.com/dgraph-io/badger/commit/8e08c43e18674528a820dbc5bb007201f87a1477 without a v5 bump, I'd suggest downgrading to 4.2.x until the fix this breaking change.

The change doesn't need to happen at ristretto, but needs to occur at the implementation end. As ristretto is v0 the guarantee doesn't effectively exist, but the implementer needs (badger) to bump in this instance since the bump to this untagged version causes the breakage.

aeneasr commented 1 month ago

Upgrade Go please

verkaufer commented 1 month ago

Upgrade Go please

I'm running go 1.22.5. Is there a version you had in mind @aeneasr ?

The change doesn't need to happen at ristretto, but needs to occur at the implementation end. As ristretto is v0 the guarantee doesn't effectively exist, but the implementer needs (badger) to bump in this instance since the bump to this untagged version causes the breakage.

Agreed, this is an unfortunate combination of factors. Will discuss in this issue in the ristretto repo :+1:

ptman commented 2 weeks ago

The API of ristretto changed from 0.1.1 -> 1.0.0. github.com/ory/x@0.663 seems to have bumped ristretto

ory / fosite