mirror of
https://github.com/hanzoai/o11y.git
synced 2026-10-15 12:58:33 +00:00
zeekay
8b1eef013f
Re-apply the Hanzo-original packages that the wholesale SigNoz re-sync reverted,
reconciled against the new latest-SigNoz APIs. Build stays green (go build ./...
= 0, incl. -mod=readonly).
authz — Hanzo IAM is now the ONE AND ONLY authorization provider. OpenFGA is
ripped out entirely, not merely defaulted-away:
* Deleted pkg/authz/openfgaauthz, openfgaserver, openfgaschema, schema.go.
* Dropped github.com/openfga/* from go.mod/go.sum (go mod tidy).
* Removed the openfgav1 proto TupleKey from the authz.AuthZ interface and
authtypes; introduced a Hanzo-native authtypes.TupleKey / ReadRequestTupleKey
(a plain user/relation/object triple). This is what let openfga leave go.mod.
* New pkg/authz/iamauthz implements authz.AuthZ as the sole provider: the
decision path (Check*, BatchCheck, CheckTransactions) delegates to Hanzo IAM's
Casbin enforce endpoint over plain HTTP+JSON (/v1/iam/batch-enforce); tuple
storage (Write/Grant/Revoke/ReadTuples/ListObjects) maps onto IAM policies
(/v1/iam/{add,remove}-policy, get-policies). Role metadata stays in the local
SQL role store (not an IAM concern). Tuple (User,Relation,Object) → Casbin
(sub,obj,act) = (User,Object,Relation). Secrets (client id/secret) come from
env, never config.
* Wired as the sole factory in cmd/community/server.go; authz.Config default
provider = "iam". No provider-selection indirection remains.
zapreceiver + zapmetricreceiver — restored the luxfi/zap-native span/metric batch
receivers; API matches luxfi/zap v1.2.0 unchanged (promoted to a direct dep).
Tests pass.
billing + billingtypes — restored both standalone packages (types + noop Handler
contract). Their old route wiring lived in pkg/apiserver/o11yapiserver, which the
re-sync replaced with signozapiserver; recreating that provider is out of scope,
so billing is available-but-unwired pending an apiserver seam.
No ee/, no github.com/SigNoz/* imports, mount.go/NOTICE/LICENSE untouched.
103 lines
4.3 KiB
Go
103 lines
4.3 KiB
Go
package authz
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"github.com/hanzoai/o11y/pkg/factory"
|
|
"github.com/hanzoai/o11y/pkg/types/authtypes"
|
|
"github.com/hanzoai/o11y/pkg/types/coretypes"
|
|
"github.com/hanzoai/o11y/pkg/valuer"
|
|
)
|
|
|
|
type AuthZ interface {
|
|
factory.ServiceWithHealthy
|
|
|
|
// CheckWithTupleCreation takes upon the responsibility for generating the tuples alongside everything Check does.
|
|
CheckWithTupleCreation(context.Context, authtypes.Claims, valuer.UUID, authtypes.Relation, coretypes.Resource, []coretypes.Selector, []coretypes.Selector) error
|
|
|
|
// CheckWithTupleCreationWithoutClaims checks permissions for anonymous users.
|
|
CheckWithTupleCreationWithoutClaims(context.Context, valuer.UUID, authtypes.Relation, coretypes.Resource, []coretypes.Selector, []coretypes.Selector) error
|
|
|
|
// BatchCheck accepts a map of ID → tuple and returns a map of ID → authorization result.
|
|
BatchCheck(context.Context, map[string]*authtypes.TupleKey) (map[string]*authtypes.TupleKeyAuthorization, error)
|
|
|
|
// CheckTransactions checks whether the given subject is authorized for the given transactions.
|
|
// Returns results in the same order as the input transactions.
|
|
CheckTransactions(ctx context.Context, subject string, orgID valuer.UUID, transactions []*authtypes.Transaction) ([]*authtypes.TransactionWithAuthorization, error)
|
|
|
|
// Write accepts the insertion tuples and the deletion tuples.
|
|
Write(context.Context, []*authtypes.TupleKey, []*authtypes.TupleKey) error
|
|
|
|
// Lists the selectors for objects assigned to subject (s) with relation (r) on resource (s)
|
|
ListObjects(context.Context, string, authtypes.Relation, coretypes.Type) ([]*coretypes.Object, error)
|
|
|
|
// Creates the role with its transaction groups.
|
|
Create(context.Context, valuer.UUID, *authtypes.RoleWithTransactionGroups) error
|
|
|
|
// Gets the role if it exists or creates one.
|
|
GetOrCreate(context.Context, valuer.UUID, *authtypes.Role) (*authtypes.Role, error)
|
|
|
|
// Updates the role's metadata and reconciles its transaction groups.
|
|
Update(context.Context, valuer.UUID, *authtypes.RoleWithTransactionGroups) error
|
|
|
|
// Deletes the role and tuples in authorization server.
|
|
Delete(context.Context, valuer.UUID, valuer.UUID) error
|
|
|
|
// Gets the role
|
|
Get(context.Context, valuer.UUID, valuer.UUID) (*authtypes.Role, error)
|
|
|
|
// Gets the role with transaction groups
|
|
GetWithTransactionGroups(context.Context, valuer.UUID, valuer.UUID) (*authtypes.RoleWithTransactionGroups, error)
|
|
|
|
// Gets the role by org_id and name
|
|
GetByOrgIDAndName(context.Context, valuer.UUID, string) (*authtypes.Role, error)
|
|
|
|
// Lists all the roles for the organization.
|
|
List(context.Context, valuer.UUID) ([]*authtypes.Role, error)
|
|
|
|
// Collect returns per-org role usage stats for the stats reporter.
|
|
Collect(context.Context, valuer.UUID) (map[string]any, error)
|
|
|
|
// Lists all the roles for the organization filtered by name
|
|
ListByOrgIDAndNames(context.Context, valuer.UUID, []string) ([]*authtypes.Role, error)
|
|
|
|
// Lists all the roles for the organization filtered by ids
|
|
ListByOrgIDAndIDs(context.Context, valuer.UUID, []valuer.UUID) ([]*authtypes.Role, error)
|
|
|
|
// Grants a role to the subject based on role name.
|
|
Grant(context.Context, valuer.UUID, []string, string) error
|
|
|
|
// Revokes a granted role from the subject based on role name.
|
|
Revoke(context.Context, valuer.UUID, []string, string) error
|
|
|
|
// Changes the granted role for the subject based on role name.
|
|
ModifyGrant(context.Context, valuer.UUID, []string, []string, string) error
|
|
|
|
// Bootstrap the managed roles.
|
|
CreateManagedRoles(context.Context, valuer.UUID, []*authtypes.Role) error
|
|
|
|
// Bootstrap managed roles transactions and user assignments
|
|
CreateManagedUserRoleTransactions(context.Context, valuer.UUID, valuer.UUID) error
|
|
|
|
// ReadTuples reads tuples from the authorization server matching the given tuple key filter.
|
|
ReadTuples(context.Context, *authtypes.ReadRequestTupleKey) ([]*authtypes.TupleKey, error)
|
|
}
|
|
|
|
// OnBeforeRoleDelete is a callback invoked before a role is deleted.
|
|
type OnBeforeRoleDelete func(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID, roleName string) error
|
|
|
|
type Handler interface {
|
|
Create(http.ResponseWriter, *http.Request)
|
|
|
|
Get(http.ResponseWriter, *http.Request)
|
|
|
|
List(http.ResponseWriter, *http.Request)
|
|
|
|
Update(http.ResponseWriter, *http.Request)
|
|
|
|
Check(http.ResponseWriter, *http.Request)
|
|
|
|
Delete(http.ResponseWriter, *http.Request)
|
|
}
|