feat(backoff): implement secure jitter using crypto/rand

docs/api-reference/apidocs.swagger.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Permify API",
     "description": "Permify is an open source authorization service for creating fine-grained and scalable authorization systems.",
-    "version": "v1.2.4",
+    "version": "v1.2.5",
     "contact": {
       "name": "API Support",
       "url": "https://github.com/Permify/permify/issues",

docs/api-reference/openapiv2/apidocs.swagger.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Permify API",
     "description": "Permify is an open source authorization service for creating fine-grained and scalable authorization systems.",
-    "version": "v1.2.4",
+    "version": "v1.2.5",
     "contact": {
       "name": "API Support",
       "url": "https://github.com/Permify/permify/issues",

internal/info.go

@@ -23,7 +23,7 @@ var Identifier = ""
 */
 const (
 	// Version is the last release of the Permify (e.g. v0.1.0)
-	Version = "v1.2.4"
+	Version = "v1.2.5"
 )
 
 // Function to create a single line of the ASCII art with centered content and color

internal/storage/postgres/utils/common.go

@@ -2,11 +2,12 @@ package utils
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/binary"
 	"errors"
 	"fmt"
 	"log/slog"
 	"math"
-	"math/rand/v2"
 	"strings"
 	"time"
 
@@ -155,12 +156,30 @@ func IsSerializationRelatedError(err error) bool {
 // WaitWithBackoff implements an exponential backoff strategy with jitter for retries.
 // It waits for a calculated duration or until the context is cancelled, whichever comes first.
 func WaitWithBackoff(ctx context.Context, tenantID string, retries int) {
+	// Calculate the base backoff
 	backoff := time.Duration(math.Min(float64(20*time.Millisecond)*math.Pow(2, float64(retries)), float64(1*time.Second)))
-	jitter := time.Duration(rand.Float64() * float64(backoff) * 0.5)
+
+	// Generate jitter using crypto/rand
+	jitter := time.Duration(secureRandomFloat64() * float64(backoff) * 0.5)
 	nextBackoff := backoff + jitter
-	slog.WarnContext(ctx, "waiting before retry", slog.String("tenant_id", tenantID), slog.Int64("backoff_duration", nextBackoff.Milliseconds()))
+
+	// Log the retry wait
+	slog.WarnContext(ctx, "waiting before retry",
+		slog.String("tenant_id", tenantID),
+		slog.Int64("backoff_duration", nextBackoff.Milliseconds()))
+
+	// Wait or exit on context cancellation
 	select {
 	case <-time.After(nextBackoff):
 	case <-ctx.Done():
 	}
 }
+
+// secureRandomFloat64 generates a float64 value in the range [0, 1) using crypto/rand.
+func secureRandomFloat64() float64 {
+	var b [8]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return 0 // Default to 0 jitter on error
+	}
+	return float64(binary.BigEndian.Uint64(b[:])) / (1 << 64)
+}

proto/base/v1/openapi.proto

@@ -9,7 +9,7 @@ option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
   info: {
     title: "Permify API";
     description: "Permify is an open source authorization service for creating fine-grained and scalable authorization systems.";
-    version: "v1.2.4";
+    version: "v1.2.5";
     contact: {
       name: "API Support";
       url: "https://github.com/Permify/permify/issues";