Auth: Embedded OpenFGA authorization driver

lxd/auth/authorization.go

@@ -5,22 +5,31 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/openfga/openfga/pkg/storage"
+
 	"github.com/canonical/lxd/lxd/identity"
 	"github.com/canonical/lxd/shared/api"
 	"github.com/canonical/lxd/shared/entity"
 	"github.com/canonical/lxd/shared/logger"
 )
 
 const (
-	// DriverTLS is the default TLS authorization driver. It is not compatible with OIDC authentication.
+	// DriverTLS is used at start up to allow communication between cluster members and initialise the cluster database.
 	DriverTLS string = "tls"
+
+	// DriverEmbeddedOpenFGA is the default authorization driver. It currently falls back to DriverTLS for all TLS
+	// clients. It cannot be initialised until after the cluster database to be operational.
+	DriverEmbeddedOpenFGA string = "embedded-openfga"
 )
 
 // ErrUnknownDriver is the "Unknown driver" error.
 var ErrUnknownDriver = fmt.Errorf("Unknown driver")
 
 var authorizers = map[string]func() authorizer{
 	DriverTLS: func() authorizer { return &tls{} },
+	DriverEmbeddedOpenFGA: func() authorizer {
+		return &embeddedOpenFGA{}
+	},
 }
 
 type authorizer interface {
@@ -89,7 +98,8 @@ type Authorizer interface {
 // Opts is used as part of the LoadAuthorizer function so that only the relevant configuration fields are passed into a
 // particular driver.
 type Opts struct {
-	config map[string]any
+	config           map[string]any
+	openfgaDatastore storage.OpenFGADatastore
 }
 
 // WithConfig can be passed into LoadAuthorizer to pass in driver specific configuration.
@@ -99,6 +109,13 @@ func WithConfig(c map[string]any) func(*Opts) {
 	}
 }
 
+// WithOpenFGADatastore should be passed into LoadAuthorizer when using the embedded openfga driver.
+func WithOpenFGADatastore(store storage.OpenFGADatastore) func(*Opts) {
+	return func(o *Opts) {
+		o.openfgaDatastore = store
+	}
+}
+
 // LoadAuthorizer instantiates, configures, and initialises an Authorizer.
 func LoadAuthorizer(ctx context.Context, driver string, logger logger.Logger, certificateCache *identity.Cache, options ...func(opts *Opts)) (Authorizer, error) {
 	opts := &Opts{}