Language: Go
Label: vulnerable
CWE: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Code:
func (q *ExpandQuery) Execute(ctx context.Context, req *openfgapb.ExpandRequest) (*openfgapb.ExpandResponse, error) {
	store := req.GetStoreId()
	modelID := req.GetAuthorizationModelId()
	tupleKey := req.GetTupleKey()
	object := tupleKey.GetObject()
	relation := tupleKey.GetRelation()

	if object == "" || relation == "" {
		return nil, serverErrors.InvalidExpandInput
	}

	tk := tupleUtils.NewTupleKey(object, relation, "")

	model, err := q.datastore.ReadAuthorizationModel(ctx, store, modelID)
	if err != nil {
		if errors.Is(err, storage.ErrNotFound) {
			return nil, serverErrors.AuthorizationModelNotFound(modelID)
		}

		return nil, serverErrors.HandleError("", err)
	}

	if !typesystem.IsSchemaVersionSupported(model.GetSchemaVersion()) {
		return nil, serverErrors.ValidationError(typesystem.ErrInvalidSchemaVersion)
	}

	typesys := typesystem.New(model)

	if err = validation.ValidateObject(typesys, tk); err != nil {
		return nil, serverErrors.ValidationError(err)
	}

	err = validation.ValidateRelation(typesys, tk)
	if err != nil {
		return nil, serverErrors.ValidationError(err)
	}

	objectType := tupleUtils.GetType(object)
	rel, err := typesys.GetRelation(objectType, relation)
	if err != nil {
		if errors.Is(err, typesystem.ErrObjectTypeUndefined) {
			return nil, serverErrors.TypeNotFound(objectType)
		}

		if errors.Is(err, typesystem.ErrRelationUndefined) {
			return nil, serverErrors.RelationNotFound(relation, objectType, tk)
		}

		return nil, serverErrors.HandleError("", err)
	}

	userset := rel.GetRewrite()

	root, err := q.resolveUserset(ctx, store, userset, tk, typesys)
	if err != nil {
		return nil, err
	}

	return &openfgapb.ExpandResponse{
		Tree: &openfgapb.UsersetTree{
			Root: root,
		},
	}, nil
}