Auth: Generate entitlement definitions #13256
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
markylaing
force-pushed
the
generate-entitlements
branch
from
4ac66db
to
47efe2c
Compare
Signed-off-by: Mark Laing <mark.laing@canonical.com>
markylaing
force-pushed
the
generate-entitlements
branch
from
47efe2c
to
89aa6e5
Compare
|
@tomponline ready for review when you have time. Thanks |
tomponline
reviewed
Apr 4, 2024
tomponline
reviewed
Apr 4, 2024
tomponline
reviewed
Apr 4, 2024
tomponline
reviewed
Apr 4, 2024
tomponline
reviewed
Apr 4, 2024
tomponline
reviewed
Apr 4, 2024
|
@markylaing should this be linked to any outstanding issue such that its closed when merged? |
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
…tor`. EntitlementProjectOperator was the string "operator". This was to differentiate it from the server level operator but there is no benefit to this now that we are generating the entitlements. Signed-off-by: Mark Laing <mark.laing@canonical.com>
Signed-off-by: Mark Laing <mark.laing@canonical.com>
Granting a `can_delete` permission on an identity to a group was possible via the API but this would have had no effect because the relation was not present in the model. Signed-off-by: Mark Laing <mark.laing@canonical.com>
Granting `can_view`, `can_edit`, or `can_delete` on a group was possible via the API but this would have had no effect because members of a group (group#member) could not be directly related to the group type in the model via these relations. Signed-off-by: Mark Laing <mark.laing@canonical.com>
Re-generate the entitlements map to reflect changes. Signed-off-by: Mark Laing <mark.laing@canonical.com>
…tificate. This restriction was artificial and also incorrect. We should allow granting permissions against certificates because this is used by the certificates API. Since identities and certificates are different entity types, a permission granted on an identity is not identical to a permission granted on a certificate, so we need to allow this. Signed-off-by: Mark Laing <mark.laing@canonical.com>
This adds entitlements for identity provider groups that we previously omitted incorrectly. Additionally, the `can_view` entitlement on server cannot be granted because this is the type-bound public access that allows all authenticated clients to call GET /1.0. Signed-off-by: Mark Laing <mark.laing@canonical.com>
markylaing
force-pushed
the
generate-entitlements
branch
from
89aa6e5
to
ad09afa
Compare
|
All comments addressed I think. I've linked a couple of relevant issues but there is no specific issue for this. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a small go program to read the OpenFGA model file and generate a go file containing entitlement definitions and a mapping of entity type to entitlement slice. This is used to validate entitlements when add a permission to a group, and when using the permissions API.
This can be taken further to generate documentation from the comments that are in the OpenFGA model file.
Generating entitlements directly from the model revealed a few discrepancies between the model and the entitlement to entity type map that was previously defined. These would have led to some quite obfuscated bugs. I've fixed them in this PR and generating entitlements from the model should prevent this happening in the future.
Partially addresses #12999
Prepares for #12928