-
Notifications
You must be signed in to change notification settings - Fork 0
openfga schema with tests #11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
swelborn
wants to merge
2
commits into
main
Choose a base branch
from
openfga-schema
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,254 @@ | ||
| name: coact-authorization-model | ||
|
|
||
| model: | | ||
| model | ||
| schema 1.1 | ||
|
|
||
| type user | ||
|
|
||
| type system | ||
| relations | ||
| define admin: [user] | ||
|
|
||
| type facility | ||
| relations | ||
| define parent_system: [system] | ||
| define czar: [user] | ||
| define member: [user] | ||
| define serviceaccount: [user] | ||
|
|
||
| # admin-only operations (czars cannot do these): | ||
| # 1. users (direct upsert, bypasses request flow — userUpsert) | ||
| # 2. repos (direct create/upsert, bypasses request flow — repoCreate, repoUpsert, repoAppendMember) | ||
| # 3. requests (raw creation, bypasses request flow — requestCreate) | ||
| # 4. features (add/remove/update repo features) | ||
| # 5. facility purchases (compute and storage budgets) | ||
| # 6. data imports (jobs, storage usage) | ||
| # 7. notifications (notificationSend) | ||
| # 8. admin queries (requestsExistingForEPPN/User/Repo, reportFacilityComputeOverall) | ||
| define admin: admin from parent_system | ||
|
|
||
| # this encompasses managing: | ||
| # 1. requests (approve, reject, complete, incomplete, refire, reopen, update facility) | ||
| # 2. repos (update, rename, change principal, change compute requirement, manage allocations) | ||
| # 3. users (user storage allocation upsert) | ||
| # 4. czars (assigning/removing czars within this facility) | ||
| # 5. facility metadata (description updates) | ||
| # 6. audit trail (auditTrailAdd) | ||
| define can_manage: czar or admin | ||
| define can_view: member or can_manage | ||
|
|
||
| type repo | ||
|
swelborn marked this conversation as resolved.
|
||
| relations | ||
| # roles | ||
| define facility: [facility] | ||
| define principal: [user] | ||
| define leader: [user] | ||
| define member: [user] | ||
| # this encompasses managing: | ||
| # 1. users (adding/removing members, approving RepoMembership requests) | ||
| # 2. roles (assigning/removing leaders) | ||
| # 3. access groups (managing repo access groups) | ||
| define can_manage: leader or principal or can_manage from facility | ||
| define can_view: member or can_manage | ||
|
|
||
| tuples: | ||
|
|
||
| # System level | ||
| - user: user:yee | ||
| relation: admin | ||
| object: system:coact | ||
|
|
||
| # facility:lcls — czar, member, serviceaccount | ||
| - user: system:coact | ||
| relation: parent_system | ||
| object: facility:lcls | ||
| - user: user:wilko | ||
| relation: czar | ||
| object: facility:lcls | ||
| - user: user:eve | ||
| relation: member | ||
| object: facility:lcls | ||
| - user: user:dave | ||
| relation: serviceaccount | ||
| object: facility:lcls | ||
|
|
||
| # facility:rubin — no czar assigned (used for isolation tests) | ||
| - user: system:coact | ||
| relation: parent_system | ||
| object: facility:rubin | ||
|
|
||
| # repo:lcls-project-1 — principal, leader, member | ||
| - user: facility:lcls | ||
| relation: facility | ||
| object: repo:lcls-project-1 | ||
| - user: user:bob | ||
| relation: principal | ||
| object: repo:lcls-project-1 | ||
| - user: user:carol | ||
| relation: leader | ||
| object: repo:lcls-project-1 | ||
| - user: user:alice | ||
| relation: member | ||
| object: repo:lcls-project-1 | ||
|
|
||
| # repo:lcls-project-2 — separate repo in the same facility (isolation tests) | ||
| - user: facility:lcls | ||
| relation: facility | ||
| object: repo:lcls-project-2 | ||
| - user: user:frank | ||
| relation: principal | ||
| object: repo:lcls-project-2 | ||
|
swelborn marked this conversation as resolved.
|
||
|
|
||
|
|
||
|
|
||
| tests: | ||
|
|
||
| - name: System admin (yee) can manage all facilities and repos | ||
| check: | ||
| - user: user:yee | ||
| object: facility:lcls | ||
| assertions: | ||
| admin: true # inherits via system:coact → parent_system | ||
| can_manage: true | ||
| can_view: true | ||
| - user: user:yee | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| principal: false | ||
| leader: false | ||
| member: false | ||
| can_manage: true # flows in via can_manage from facility | ||
| can_view: true | ||
| - user: user:yee | ||
| object: facility:rubin | ||
| assertions: | ||
| admin: true # system admin spans all facilities | ||
| can_manage: true | ||
|
|
||
| - name: Facility czar (wilko) can manage their facility and all repos in it | ||
| check: | ||
| - user: user:wilko | ||
| object: facility:lcls | ||
| assertions: | ||
| czar: true | ||
| admin: false | ||
| can_manage: true | ||
| can_view: true | ||
| - user: user:wilko | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| principal: false | ||
| leader: false | ||
| member: false | ||
| can_manage: true # flows in via can_manage from facility | ||
| can_view: true | ||
| - user: user:wilko | ||
| object: repo:lcls-project-2 | ||
| assertions: | ||
| can_manage: true # czar manages all repos in their facility | ||
|
|
||
| - name: Repo principal (bob) can manage their repo but not the facility | ||
| check: | ||
| - user: user:bob | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| principal: true | ||
| leader: false | ||
| member: false | ||
| can_manage: true | ||
| can_view: true | ||
| - user: user:bob | ||
| object: facility:lcls | ||
| assertions: | ||
| czar: false | ||
| can_manage: false # principal does not get facility authority | ||
| can_view: false | ||
| - user: user:bob # isolation: cannot manage a different repo | ||
| object: repo:lcls-project-2 | ||
| assertions: | ||
| principal: false | ||
| can_manage: false | ||
| can_view: false | ||
|
|
||
| - name: Repo leader (carol) can manage their repo but not the facility | ||
| check: | ||
| - user: user:carol | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| leader: true | ||
| principal: false | ||
| member: false | ||
| can_manage: true | ||
| can_view: true | ||
| - user: user:carol | ||
| object: facility:lcls | ||
| assertions: | ||
| czar: false | ||
| can_manage: false # leader does not get facility authority | ||
| can_view: false | ||
| - user: user:carol # isolation: cannot manage a different repo | ||
| object: repo:lcls-project-2 | ||
| assertions: | ||
| leader: false | ||
| can_manage: false | ||
| can_view: false | ||
|
|
||
| - name: Repo member (alice) can only view their repo | ||
| check: | ||
| - user: user:alice | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| member: true | ||
| principal: false | ||
| leader: false | ||
| can_manage: false | ||
| can_view: true | ||
| - user: user:alice | ||
| object: facility:lcls | ||
| assertions: | ||
| can_manage: false | ||
| can_view: false # repo membership does not grant facility view | ||
| - user: user:alice # isolation: no access to another repo | ||
| object: repo:lcls-project-2 | ||
| assertions: | ||
| member: false | ||
| can_view: false | ||
|
|
||
| - name: Facility member (eve) can view the facility but not manage it | ||
| check: | ||
| - user: user:eve | ||
| object: facility:lcls | ||
| assertions: | ||
| member: true | ||
| czar: false | ||
| can_manage: false | ||
| can_view: true | ||
| - user: user:eve # facility membership does not grant repo access | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| can_manage: false | ||
| can_view: false | ||
|
|
||
| - name: Service account (dave) has no implicit permissions | ||
| check: | ||
| - user: user:dave | ||
| object: facility:lcls | ||
| assertions: | ||
| serviceaccount: true | ||
| can_manage: false | ||
| can_view: false # serviceaccount is not wired into can_view | ||
| - user: user:dave | ||
| object: repo:lcls-project-1 | ||
| assertions: | ||
| can_manage: false | ||
| can_view: false | ||
|
|
||
| - name: Facility czar isolation (wilko has no access to facility:rubin) | ||
| check: | ||
| - user: user:wilko | ||
| object: facility:rubin | ||
| assertions: | ||
| czar: false | ||
| can_manage: false | ||
| can_view: false | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
note, i developed the models and then asked an agent to check if this fits. It does, with our current mostly role-based access control in coact.
I also asked to generate these comments on what this entails for
admin/czar/principal/leader, so if any of these seem off, we can double check. I asked agent to triple check a few times :)