Add protogetter linter

.gitignore

@@ -9,4 +9,5 @@ coverage*.txt
 .claude/
 e2e/newenemy/spicedb
 e2e/newenemy/cockroach
-e2e/newenemy/chaosd
+e2e/newenemy/chaosd
+__pycache__/

.golangci.yaml

@@ -31,6 +31,7 @@ linters:
     - "perfsprint"
     - "prealloc"
     - "predeclared"
+    - "protogetter"
     - "promlinter"
     - "revive"
     - "rowserrcheck"

cmd/spicedb/servetesting_integration_test.go

@@ -113,12 +113,12 @@ func TestTestServer(t *testing.T) {
 
 	v1Resp, err := v1client.CheckPermission(context.Background(), checkReq)
 	require.NoError(err)
-	require.Equal(v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, v1Resp.Permissionship)
+	require.Equal(v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, v1Resp.GetPermissionship())
 
 	// Ensure check against readonly works as well.
 	v1Resp, err = rov1client.CheckPermission(context.Background(), checkReq)
 	require.NoError(err)
-	require.Equal(v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, v1Resp.Permissionship)
+	require.Equal(v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, v1Resp.GetPermissionship())
 
 	// Try a call with a different auth header and ensure it fails.
 	authedConn, err := grpc.NewClient(fmt.Sprintf("localhost:%s", tester.readonlyPort),

cmd/spicedb/servetesting_race_test.go

@@ -70,6 +70,6 @@ func TestCheckPermissionOnTesterNoFlakes(t *testing.T) {
 		conn.Close()
 
 		assert.NoError(t, err)
-		assert.Equal(t, v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, result.Permissionship, "Error on attempt #%d", i)
+		assert.Equal(t, v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, result.GetPermissionship(), "Error on attempt #%d", i)
 	}
 }

internal/caveats/builder_test.go

@@ -223,10 +223,10 @@ func TestMustCaveatExprForTestingWithContext(t *testing.T) {
 	result := MustCaveatExprForTestingWithContext("test_caveat", context)
 	require.NotNil(t, result)
 	require.NotNil(t, result.GetCaveat())
-	require.Equal(t, "test_caveat", result.GetCaveat().CaveatName)
-	require.NotNil(t, result.GetCaveat().Context)
+	require.Equal(t, "test_caveat", result.GetCaveat().GetCaveatName())
+	require.NotNil(t, result.GetCaveat().GetContext())
 
-	contextMap := result.GetCaveat().Context.AsMap()
+	contextMap := result.GetCaveat().GetContext().AsMap()
 	require.Equal(t, "value1", contextMap["key1"])
 	require.Equal(t, float64(42), contextMap["key2"]) //nolint:testifyrequire these are known/static values
 }

internal/caveats/errors.go

@@ -24,13 +24,13 @@
 
 // MarshalZerologObject implements zerolog.LogObjectMarshaler
 func (err EvaluationError) MarshalZerologObject(e *zerolog.Event) {
-	e.Err(err.error).Str("caveat_name", err.caveatExpr.GetCaveat().CaveatName).Interface("context", err.caveatExpr.GetCaveat().Context)
+	e.Err(err.error).Str("caveat_name", err.caveatExpr.GetCaveat().GetCaveatName()).Interface("context", err.caveatExpr.GetCaveat().GetContext())
 }
 
 // DetailsMetadata returns the metadata for details for this error.
 func (err EvaluationError) DetailsMetadata() map[string]string {
 	return spiceerrors.CombineMetadata(err.evalErr, map[string]string{
-		"caveat_name": err.caveatExpr.GetCaveat().CaveatName,
+		"caveat_name": err.caveatExpr.GetCaveat().GetCaveatName(),
 	})
 }
 
@@ -47,7 +47,7 @@
 
 func NewEvaluationError(caveatExpr *core.CaveatExpression, err caveats.EvaluationError) EvaluationError {
 	return EvaluationError{
-		fmt.Errorf("evaluation error for caveat %s: %w", caveatExpr.GetCaveat().CaveatName, err), caveatExpr, err,
+		fmt.Errorf("evaluation error for caveat %s: %w", caveatExpr.GetCaveat().GetCaveatName(), err), caveatExpr, err,
 	}
 }
 
@@ -61,8 +61,8 @@
 // MarshalZerologObject implements zerolog.LogObjectMarshaler
 func (err ParameterTypeError) MarshalZerologObject(e *zerolog.Event) {
 	evt := e.Err(err.error).
-		Str("caveat_name", err.caveatExpr.GetCaveat().CaveatName).
-		Interface("context", err.caveatExpr.GetCaveat().Context)
+		Str("caveat_name", err.caveatExpr.GetCaveat().GetCaveatName()).
+		Interface("context", err.caveatExpr.GetCaveat().GetContext())
 
 	if err.conversionError != nil {
 		evt.Str("parameter_name", err.conversionError.ParameterName())
@@ -73,12 +73,12 @@
 func (err ParameterTypeError) DetailsMetadata() map[string]string {
 	if err.conversionError != nil {
 		return spiceerrors.CombineMetadata(err.conversionError, map[string]string{
-			"caveat_name": err.caveatExpr.GetCaveat().CaveatName,
+			"caveat_name": err.caveatExpr.GetCaveat().GetCaveatName(),
 		})
 	}
 
 	return map[string]string{
-		"caveat_name": err.caveatExpr.GetCaveat().CaveatName,
+		"caveat_name": err.caveatExpr.GetCaveat().GetCaveatName(),
 	}
 }
 
@@ -100,7 +100,7 @@
 	}
 
 	return ParameterTypeError{
-		fmt.Errorf("type error for parameters for caveat `%s`: %w", caveatExpr.GetCaveat().CaveatName, err),
+		fmt.Errorf("type error for parameters for caveat `%s`: %w", caveatExpr.GetCaveat().GetCaveatName(), err),
 		caveatExpr,
 		conversionError,
 	}

internal/caveats/run.go

@@ -133,12 +133,12 @@
 		return caveat, deserialized, nil
 	}
 
-	parameterTypes, err := caveattypes.DecodeParameterTypes(cr.caveatTypeSet, caveat.ParameterTypes)
+	parameterTypes, err := caveattypes.DecodeParameterTypes(cr.caveatTypeSet, caveat.GetParameterTypes())
 	if err != nil {
 		return nil, nil, err
 	}
 
-	justDeserialized, err := caveats.DeserializeCaveatWithTypeSet(cr.caveatTypeSet, caveat.SerializedExpression, parameterTypes)
+	justDeserialized, err := caveats.DeserializeCaveatWithTypeSet(cr.caveatTypeSet, caveat.GetSerializedExpression(), parameterTypes)
 	if err != nil {
 		return caveat, nil, err
 	}
@@ -149,12 +149,12 @@
 
 func collectCaveatNames(expr *core.CaveatExpression, caveatNames *mapz.Set[string]) {
 	if expr.GetCaveat() != nil {
-		caveatNames.Add(expr.GetCaveat().CaveatName)
+		caveatNames.Add(expr.GetCaveat().GetCaveatName())
 		return
 	}
 
 	cop := expr.GetOperation()
-	for _, child := range cop.Children {
+	for _, child := range cop.GetChildren() {
 		collectCaveatNames(child, caveatNames)
 	}
 }
@@ -170,9 +170,9 @@
 	defer span.End()
 
 	if expr.GetCaveat() != nil {
-		span.SetAttributes(attribute.StringSlice(otelconv.AttrCaveatsNames, []string{expr.GetCaveat().CaveatName}))
+		span.SetAttributes(attribute.StringSlice(otelconv.AttrCaveatsNames, []string{expr.GetCaveat().GetCaveatName()}))
 
-		caveat, compiled, err := cr.get(expr.GetCaveat().CaveatName)
+		caveat, compiled, err := cr.get(expr.GetCaveat().GetCaveatName())
 		if err != nil {
 			return nil, err
 		}
@@ -190,7 +190,7 @@
 		typedParameters, err := caveats.ConvertContextToParameters(
 			cr.caveatTypeSet,
 			untypedFullContext,
-			caveat.ParameterTypes,
+			caveat.GetParameterTypes(),
 			caveats.SkipUnknownParameters,
 		)
 		if err != nil {
@@ -211,16 +211,16 @@
 	}
 
 	cop := expr.GetOperation()
-	span.SetAttributes(attribute.StringSlice(otelconv.AttrCaveatsOperations, []string{cop.Op.String()}))
+	span.SetAttributes(attribute.StringSlice(otelconv.AttrCaveatsOperations, []string{cop.GetOp().String()}))
 
 	var currentResult ExpressionResult = syntheticResult{
-		value:           cop.Op == core.CaveatOperation_AND,
+		value:           cop.GetOp() == core.CaveatOperation_AND,
 		isPartialResult: false,
 	}
 
 	var exprResultsForDebug []ExpressionResult
 	if debugOption == RunCaveatExpressionWithDebugInformation {
-		exprResultsForDebug = make([]ExpressionResult, 0, len(cop.Children))
+		exprResultsForDebug = make([]ExpressionResult, 0, len(cop.GetChildren()))
 	}
 
 	var missingVarNames *mapz.Set[string]
@@ -313,7 +313,7 @@
 		}, nil
 	}
 
-	for _, child := range cop.Children {
+	for _, child := range cop.GetChildren() {
 		childResult, err := cr.runExpressionWithCaveats(ctx, env, child, context, debugOption)
 		if err != nil {
 			return nil, err
@@ -330,7 +330,7 @@
 			missingVarNames.Extend(missingVars)
 		}
 
-		switch cop.Op {
+		switch cop.GetOp() {
 		case core.CaveatOperation_AND:
 			cr, err := and(currentResult, childResult)
 			if err != nil {
@@ -357,7 +357,7 @@
 			return invert(childResult)
 
 		default:
-			return nil, spiceerrors.MustBugf("unknown caveat operation: %v", cop.Op)
+			return nil, spiceerrors.MustBugf("unknown caveat operation: %v", cop.GetOp())
 		}
 	}
 

internal/datasets/subjectset_test.go

@@ -1420,27 +1420,27 @@ func TestSubjectSetGet(t *testing.T) {
 
 	found, ok := ss.Get("first")
 	require.True(t, ok)
-	require.Equal(t, "first", found.SubjectId)
-	require.Nil(t, found.CaveatExpression)
+	require.Equal(t, "first", found.GetSubjectId())
+	require.Nil(t, found.GetCaveatExpression())
 
 	found, ok = ss.Get("second")
 	require.True(t, ok)
-	require.Equal(t, "second", found.SubjectId)
-	require.Nil(t, found.CaveatExpression)
+	require.Equal(t, "second", found.GetSubjectId())
+	require.Nil(t, found.GetCaveatExpression())
 
 	found, ok = ss.Get("third")
 	require.True(t, ok)
-	require.Equal(t, "third", found.SubjectId)
-	require.NotNil(t, found.CaveatExpression)
+	require.Equal(t, "third", found.GetSubjectId())
+	require.NotNil(t, found.GetCaveatExpression())
 
 	_, ok = ss.Get("fourth")
 	require.False(t, ok)
 
 	found, ok = ss.Get("*")
 	require.True(t, ok)
-	require.Equal(t, "*", found.SubjectId)
-	require.Nil(t, found.CaveatExpression)
-	require.Len(t, found.ExcludedSubjects, 2)
+	require.Equal(t, "*", found.GetSubjectId())
+	require.Nil(t, found.GetCaveatExpression())
+	require.Len(t, found.GetExcludedSubjects(), 2)
 }
 
 var testSets = [][]*v1.FoundSubject{

internal/datasets/subjectsetbyresourceid.go

@@ -49,7 +49,7 @@
 			return fmt.Errorf("received nil FoundSubjects in other map of SubjectSetByResourceID's UnionWith for key %s", resourceID)
 		}
 
-		for _, subject := range subjects.FoundSubjects {
+		for _, subject := range subjects.GetFoundSubjects() {
 			if err := ssr.add(resourceID, subject); err != nil {
 				return err
 			}

internal/datasets/subjectsetbyresourceid_test.go

@@ -36,11 +36,11 @@ func TestSubjectSetByResourceIDBasicOperations(t *testing.T) {
 	}
 	asMap := ssr.AsMap()
 
-	slices.SortFunc(expected["firstdoc"].FoundSubjects, testutil.CmpSubjects)
-	slices.SortFunc(expected["seconddoc"].FoundSubjects, testutil.CmpSubjects)
+	slices.SortFunc(expected["firstdoc"].GetFoundSubjects(), testutil.CmpSubjects)
+	slices.SortFunc(expected["seconddoc"].GetFoundSubjects(), testutil.CmpSubjects)
 
-	slices.SortFunc(asMap["firstdoc"].FoundSubjects, testutil.CmpSubjects)
-	slices.SortFunc(asMap["seconddoc"].FoundSubjects, testutil.CmpSubjects)
+	slices.SortFunc(asMap["firstdoc"].GetFoundSubjects(), testutil.CmpSubjects)
+	slices.SortFunc(asMap["seconddoc"].GetFoundSubjects(), testutil.CmpSubjects)
 
 	require.Equal(t, expected, asMap)
 }
@@ -67,7 +67,7 @@ func TestSubjectSetByResourceIDUnionWith(t *testing.T) {
 	require.NoError(t, err)
 
 	found := ssr.AsMap()
-	slices.SortFunc(found["firstdoc"].FoundSubjects, testutil.CmpSubjects)
+	slices.SortFunc(found["firstdoc"].GetFoundSubjects(), testutil.CmpSubjects)
 
 	require.Equal(t, map[string]*v1.FoundSubjects{
 		"firstdoc": {
@@ -216,8 +216,8 @@ func TestSubjectSetByResourceIDBasicCaveatedOperations(t *testing.T) {
 	}
 	asMap := ssr.AsMap()
 
-	slices.SortFunc(expected["firstdoc"].FoundSubjects, testutil.CmpSubjects)
-	slices.SortFunc(asMap["firstdoc"].FoundSubjects, testutil.CmpSubjects)
+	slices.SortFunc(expected["firstdoc"].GetFoundSubjects(), testutil.CmpSubjects)
+	slices.SortFunc(asMap["firstdoc"].GetFoundSubjects(), testutil.CmpSubjects)
 
 	require.Equal(t, expected, asMap)
 }

internal/datasets/subjectsetbytype.go

@@ -70,7 +70,7 @@
 			continue
 		}
 
-		key := tuple.JoinRelRef(updatedType.Namespace, updatedType.Relation)
+		key := tuple.JoinRelRef(updatedType.GetNamespace(), updatedType.GetRelation())
 		if existing, ok := mapped.byType[key]; ok {
 			cloned := subjectset.Clone()
 			if err := cloned.UnionWithSet(existing); err != nil {
@@ -96,7 +96,7 @@
 
 // SubjectSetForType returns the subject set associated with the given subject type, if any.
 func (s *SubjectByTypeSet) SubjectSetForType(rr *core.RelationReference) (SubjectSet, bool) {
-	found, ok := s.byType[tuple.JoinRelRef(rr.Namespace, rr.Relation)]
+	found, ok := s.byType[tuple.JoinRelRef(rr.GetNamespace(), rr.GetRelation())]
 	return found, ok
 }
 

internal/datasets/subjectsetbytype_test.go

@@ -25,10 +25,10 @@ func TestSubjectByTypeSet(t *testing.T) {
 			objectIds := make([]string, 0, len(subjects.AsSlice()))
 			for _, subject := range subjects.AsSlice() {
 				require.Empty(t, subject.GetExcludedSubjects())
-				objectIds = append(objectIds, subject.SubjectId)
+				objectIds = append(objectIds, subject.GetSubjectId())
 			}
 
-			if rr.Namespace == foundRR.Namespace && rr.Relation == foundRR.Relation {
+			if rr.GetNamespace() == foundRR.GetNamespace() && rr.GetRelation() == foundRR.GetRelation() {
 				sort.Strings(objectIds)
 				require.Equal(t, expected, objectIds)
 				wasFound = true
@@ -70,8 +70,8 @@ func TestSubjectByTypeSet(t *testing.T) {
 
 	// Map
 	mapped, err := set.Map(func(rr *core.RelationReference) (*core.RelationReference, error) {
-		if rr.Namespace == "document" {
-			return RR("doc", rr.Relation), nil
+		if rr.GetNamespace() == "document" {
+			return RR("doc", rr.GetRelation()), nil
 		}
 
 		return rr, nil
@@ -118,15 +118,15 @@ func TestSubjectSetMapOverSameSubjectDifferentRelation(t *testing.T) {
 
 	mapped, err := set.Map(func(rr *core.RelationReference) (*core.RelationReference, error) {
 		return &core.RelationReference{
-			Namespace: rr.Namespace,
+			Namespace: rr.GetNamespace(),
 			Relation:  "shared",
 		}, nil
 	})
 	require.NoError(t, err)
 
 	foundSubjectIDs := mapz.NewSet[string]()
 	for _, sub := range mapped.byType["folder#shared"].AsSlice() {
-		foundSubjectIDs.Add(sub.SubjectId)
+		foundSubjectIDs.Add(sub.GetSubjectId())
 	}
 
 	require.ElementsMatch(t, []string{"folder1", "folder2"}, foundSubjectIDs.AsSlice())