mirror of
https://github.com/hanzoai/o11y.git
synced 2026-10-15 12:58:33 +00:00
zeekay
8b1eef013f
Re-apply the Hanzo-original packages that the wholesale SigNoz re-sync reverted,
reconciled against the new latest-SigNoz APIs. Build stays green (go build ./...
= 0, incl. -mod=readonly).
authz — Hanzo IAM is now the ONE AND ONLY authorization provider. OpenFGA is
ripped out entirely, not merely defaulted-away:
* Deleted pkg/authz/openfgaauthz, openfgaserver, openfgaschema, schema.go.
* Dropped github.com/openfga/* from go.mod/go.sum (go mod tidy).
* Removed the openfgav1 proto TupleKey from the authz.AuthZ interface and
authtypes; introduced a Hanzo-native authtypes.TupleKey / ReadRequestTupleKey
(a plain user/relation/object triple). This is what let openfga leave go.mod.
* New pkg/authz/iamauthz implements authz.AuthZ as the sole provider: the
decision path (Check*, BatchCheck, CheckTransactions) delegates to Hanzo IAM's
Casbin enforce endpoint over plain HTTP+JSON (/v1/iam/batch-enforce); tuple
storage (Write/Grant/Revoke/ReadTuples/ListObjects) maps onto IAM policies
(/v1/iam/{add,remove}-policy, get-policies). Role metadata stays in the local
SQL role store (not an IAM concern). Tuple (User,Relation,Object) → Casbin
(sub,obj,act) = (User,Object,Relation). Secrets (client id/secret) come from
env, never config.
* Wired as the sole factory in cmd/community/server.go; authz.Config default
provider = "iam". No provider-selection indirection remains.
zapreceiver + zapmetricreceiver — restored the luxfi/zap-native span/metric batch
receivers; API matches luxfi/zap v1.2.0 unchanged (promoted to a direct dep).
Tests pass.
billing + billingtypes — restored both standalone packages (types + noop Handler
contract). Their old route wiring lived in pkg/apiserver/o11yapiserver, which the
re-sync replaced with signozapiserver; recreating that provider is out of scope,
so billing is available-but-unwired pending an apiserver seam.
No ee/, no github.com/SigNoz/* imports, mount.go/NOTICE/LICENSE untouched.
53 lines
1.7 KiB
Go
53 lines
1.7 KiB
Go
package authz
|
|
|
|
import (
|
|
"github.com/hanzoai/o11y/pkg/factory"
|
|
)
|
|
|
|
// Config configures o11y's authorization seam. Hanzo IAM is the sole
|
|
// authorization provider — every authz decision is delegated to the Hanzo IAM
|
|
// Casbin enforce endpoint (see pkg/authz/iamauthz). There is no pluggable
|
|
// provider selection: one way to do authz, and it is Hanzo IAM.
|
|
type Config struct {
|
|
// Provider names the authorization provider. Retained for telemetry and
|
|
// config-shape stability; the only supported value is "iam".
|
|
Provider string `mapstructure:"provider"`
|
|
|
|
// IAM configures the Hanzo IAM integration.
|
|
IAM IAMConfig `mapstructure:"iam"`
|
|
}
|
|
|
|
// IAMConfig configures the Hanzo IAM integration. The client credentials are
|
|
// secrets and are read from the environment (O11Y_IAM_CLIENT_ID and
|
|
// O11Y_IAM_CLIENT_SECRET) rather than from config files, per the house rule to
|
|
// keep secrets out of config and in KMS/env.
|
|
type IAMConfig struct {
|
|
// URL is the base URL of the Hanzo IAM API. The enforce endpoints live under
|
|
// {URL}/v1/iam/enforce and {URL}/v1/iam/batch-enforce; policy endpoints under
|
|
// {URL}/v1/iam/{add,remove,get}-poli{cy,cies}.
|
|
URL string `mapstructure:"url"`
|
|
|
|
// EnforcerID is the IAM enforcer id (in "owner/name" form) that holds o11y's
|
|
// authorization model. It scopes both enforce calls (as enforcerId) and
|
|
// policy calls (as id).
|
|
EnforcerID string `mapstructure:"enforcer_id"`
|
|
}
|
|
|
|
func NewConfigFactory() factory.ConfigFactory {
|
|
return factory.NewConfigFactory(factory.MustNewName("authz"), newConfig)
|
|
}
|
|
|
|
func newConfig() factory.Config {
|
|
return &Config{
|
|
Provider: "iam",
|
|
IAM: IAMConfig{
|
|
URL: "https://iam.hanzo.ai",
|
|
EnforcerID: "hanzo/o11y",
|
|
},
|
|
}
|
|
}
|
|
|
|
func (c Config) Validate() error {
|
|
return nil
|
|
}
|