feat(client): add OpenFGA policy store client support - #944
Open
robertswork23-crypto wants to merge 3 commits into
Open
feat(client): add OpenFGA policy store client support#944robertswork23-crypto wants to merge 3 commits into
robertswork23-crypto wants to merge 3 commits into
Conversation
Caught via real integration testing against a containerized OpenFGA
instance: full_export wrote /read's raw {"key": {...}, "timestamp": ...}
tuple shape into the export file, which full_import then fed unmodified
to set_policy_data. /write rejected it ("the 'user' field is malformed")
since it isn't the flat {user, relation, object} shape /write expects.
Shared the reshape logic with delete_policy_data, which already did this
correctly, via a new _to_write_tuple_keys() helper.
✅ Deploy Preview for opal-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Author
|
awaiting review |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds OpenFGA support per #661.
Design
OpenFGA's data model doesn't map onto OPA/Cedar's "named policy files" shape — OpenFGA has one immutable, versioned authorization model per store rather than independently-addressable policy files. So
set_policies(bundle)compiles every module in the bundle into a single authorization model and writes it once, instead of looping a per-moduleset_policy()call.set_policy/get_policy/delete_policy/get_policy_module_idsare left unimplemented (inheritingNotImplementedError), same as Cedar leaves several methods unimplemented — there's no per-file operation to perform.set_policy_data/delete_policy_data/get_datamap onto OpenFGA relationship tuples via the real/writeand/readendpoints.Endpoint paths and payload shapes were verified against OpenFGA's own OpenAPI spec (
github.com/openfga/api), not guessed.Testing
openfga_client_liveness_test.py, mirroring the existing Cedar suite. Fullopal-clientsuite passes (37/37; two unrelated pre-existing test files don't collect on Windows due to a POSIX-onlyfcntlimport inopal_common, confirmed viagit stashto predate this change).docker run openfga/openfga run) — not mocked:set_policies(real model write),set_policy_data/get_data(real tuple write/read round-trip),delete_policy_data, the liveness probe againstGET /stores, the transaction-context path (is_ready/is_healthyvia reallog_transactioncalls), andfull_export/full_importround-trip. This caught and fixed a real bug:full_exportwas writing/read's raw response shape into the export instead of the flat shape/writeexpects.Known scope limits (flagged, not hidden)
store_idis read fromPOLICY_STORE_OPENFGA_STORE_IDdirectly rather than wired intoconfig.py'sconfisystem — a pragmatic MVP choice, real config wiring is a natural follow-up.type_definitions.authorization_model_idpinning on writes isn't implemented; writes target the latest model implicitly.