Skip to content

Commit c7d7aa4

Browse files
alkalescentalkalescent
authored
feat(policy): add obligation tables (#2532)
### Proposed Changes * ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions
1 parent c1ae924 commit c7d7aa4

File tree

3 files changed

+192
-0
lines changed

3 files changed

+192
-0
lines changed

‎service/policy/db/migrations/20250703000000_obligations.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
[ADR for Obligations](https://github.com/opentdf/platform/issues/1933)
2+
3+
This migration adds the obligation tables for definitions, values, triggers, and fulfillers.
4+
5+
```mermaid
6+
erDiagram
7+
attribute_namespaces ||--o{ obligation_definitions : "belongs_to"
8+
obligation_definitions ||--o{ obligation_values_standard : "has_many"
9+
obligation_values_standard ||--o{ obligation_triggers : "has_many"
10+
obligation_values_standard ||--o{ obligation_fulfillers : "has_many"
11+
attribute_values ||--o{ obligation_triggers : "triggers"
12+
actions ||--o{ obligation_triggers : "triggers"
13+
14+
attribute_namespaces {
15+
UUID id PK
16+
string name
17+
}
18+
19+
obligation_definitions {
20+
UUID id PK
21+
UUID namespace_id FK
22+
string name
23+
jsonb metadata
24+
timestamp created_at
25+
timestamp updated_at
26+
}
27+
28+
obligation_values_standard {
29+
UUID id PK
30+
UUID obligation_definition_id FK
31+
string value
32+
jsonb metadata
33+
timestamp created_at
34+
timestamp updated_at
35+
}
36+
37+
obligation_triggers {
38+
UUID id PK
39+
UUID attribute_value_id FK
40+
UUID obligation_value_id FK
41+
UUID action_id FK
42+
jsonb metadata
43+
timestamp created_at
44+
timestamp updated_at
45+
}
46+
47+
obligation_fulfillers {
48+
UUID id PK
49+
UUID obligation_value_id FK
50+
jsonb conditionals
51+
jsonb metadata
52+
timestamp created_at
53+
timestamp updated_at
54+
}
55+
56+
attribute_values {
57+
UUID id PK
58+
string value
59+
}
60+
61+
actions {
62+
UUID id PK
63+
string name
64+
}
65+
```

‎service/policy/db/migrations/20250703000000_obligations.sql‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
-- +goose Up
2+
-- +goose StatementBegin
3+
4+
CREATE TABLE IF NOT EXISTS obligation_definitions
5+
(
6+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
7+
namespace_id UUID NOT NULL REFERENCES attribute_namespaces(id) ON DELETE CASCADE,
8+
-- name is a unique identifier for the obligation definition within the namespace
9+
name VARCHAR NOT NULL,
10+
metadata JSONB,
11+
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
12+
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
13+
-- implicit index on unique (namespace_id, name) combo
14+
-- index name: obligation_definitions_namespace_id_name_key
15+
UNIQUE (namespace_id, name)
16+
);
17+
18+
CREATE TABLE IF NOT EXISTS obligation_values_standard
19+
(
20+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
21+
obligation_definition_id UUID NOT NULL REFERENCES obligation_definitions(id) ON DELETE CASCADE,
22+
-- value is a unique identifier for the obligation value within the definition
23+
value VARCHAR NOT NULL,
24+
metadata JSONB,
25+
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
26+
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
27+
-- implicit index on unique (obligation_definition_id, value) combo
28+
-- index name: obligation_values_standard_obligation_definition_id_value_key
29+
UNIQUE (obligation_definition_id, value)
30+
);
31+
32+
CREATE TABLE IF NOT EXISTS obligation_triggers
33+
(
34+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
35+
obligation_value_id UUID NOT NULL REFERENCES obligation_values_standard(id) ON DELETE CASCADE,
36+
action_id UUID NOT NULL REFERENCES actions(id) ON DELETE CASCADE,
37+
attribute_value_id UUID NOT NULL REFERENCES attribute_values(id) ON DELETE CASCADE,
38+
metadata JSONB,
39+
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
40+
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
41+
UNIQUE(obligation_value_id, action_id, attribute_value_id)
42+
);
43+
44+
CREATE TABLE IF NOT EXISTS obligation_fulfillers
45+
(
46+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
47+
obligation_value_id UUID NOT NULL REFERENCES obligation_values_standard(id) ON DELETE CASCADE,
48+
conditionals JSONB,
49+
metadata JSONB,
50+
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP,
51+
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT CURRENT_TIMESTAMP
52+
);
53+
54+
CREATE TRIGGER obligation_definitions_updated_at
55+
BEFORE UPDATE ON obligation_definitions
56+
FOR EACH ROW
57+
EXECUTE FUNCTION update_updated_at();
58+
59+
CREATE TRIGGER obligation_values_standard_updated_at
60+
BEFORE UPDATE ON obligation_values_standard
61+
FOR EACH ROW
62+
EXECUTE FUNCTION update_updated_at();
63+
64+
CREATE TRIGGER obligation_triggers_updated_at
65+
BEFORE UPDATE ON obligation_triggers
66+
FOR EACH ROW
67+
EXECUTE FUNCTION update_updated_at();
68+
69+
CREATE TRIGGER obligation_fulfillers_updated_at
70+
BEFORE UPDATE ON obligation_fulfillers
71+
FOR EACH ROW
72+
EXECUTE FUNCTION update_updated_at();
73+
74+
-- +goose StatementEnd
75+
76+
-- +goose Down
77+
-- +goose StatementBegin
78+
79+
DROP TABLE IF EXISTS obligation_fulfillers;
80+
DROP TABLE IF EXISTS obligation_triggers;
81+
DROP TABLE IF EXISTS obligation_values_standard;
82+
DROP TABLE IF EXISTS obligation_definitions;
83+
84+
-- +goose StatementEnd

‎service/policy/db/schema_erd.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,43 @@ erDiagram
132132
character_varying uri UK "URI of the KAS"
133133
}
134134
135+
obligation_definitions {
136+
timestamp_with_time_zone created_at
137+
uuid id PK
138+
jsonb metadata
139+
character_varying name UK
140+
uuid namespace_id FK,UK
141+
timestamp_with_time_zone updated_at
142+
}
143+
144+
obligation_fulfillers {
145+
jsonb conditionals
146+
timestamp_with_time_zone created_at
147+
uuid id PK
148+
jsonb metadata
149+
uuid obligation_value_id FK
150+
timestamp_with_time_zone updated_at
151+
}
152+
153+
obligation_triggers {
154+
uuid action_id FK,UK
155+
uuid attribute_value_id FK,UK
156+
timestamp_with_time_zone created_at
157+
uuid id PK
158+
jsonb metadata
159+
uuid obligation_value_id FK,UK
160+
timestamp_with_time_zone updated_at
161+
}
162+
163+
obligation_values_standard {
164+
timestamp_with_time_zone created_at
165+
uuid id PK
166+
jsonb metadata
167+
uuid obligation_definition_id FK,UK
168+
timestamp_with_time_zone updated_at
169+
character_varying value UK
170+
}
171+
135172
provider_config {
136173
jsonb config "Configuration details for the key provider"
137174
timestamp_with_time_zone created_at "Timestamp when the provider configuration was created"
@@ -223,6 +260,7 @@ erDiagram
223260
timestamp_with_time_zone updated_at "Timestamp when the key was last updated"
224261
}
225262
263+
obligation_triggers }o--|| actions : "action_id"
226264
registered_resource_action_attribute_values }o--|| actions : "action_id"
227265
subject_mapping_actions }o--|| actions : "action_id"
228266
asym_key }o--|| provider_config : "provider_config_id"
@@ -239,17 +277,22 @@ erDiagram
239277
attribute_namespace_key_access_grants }o--|| key_access_servers : "key_access_server_id"
240278
attribute_namespace_public_key_map }o--|| attribute_namespaces : "namespace_id"
241279
attribute_namespace_public_key_map }o--|| key_access_server_keys : "key_access_server_key_id"
280+
obligation_definitions }o--|| attribute_namespaces : "namespace_id"
242281
resource_mapping_groups }o--|| attribute_namespaces : "namespace_id"
243282
attribute_value_key_access_grants }o--|| attribute_values : "attribute_value_id"
244283
attribute_value_key_access_grants }o--|| key_access_servers : "key_access_server_id"
245284
attribute_value_public_key_map }o--|| attribute_values : "value_id"
246285
attribute_value_public_key_map }o--|| key_access_server_keys : "key_access_server_key_id"
286+
obligation_triggers }o--|| attribute_values : "attribute_value_id"
247287
registered_resource_action_attribute_values }o--|| attribute_values : "attribute_value_id"
248288
resource_mappings }o--|| attribute_values : "attribute_value_id"
249289
subject_mappings }o--|| attribute_values : "attribute_value_id"
250290
base_keys }o--|| key_access_server_keys : "key_access_server_key_id"
251291
key_access_server_keys }o--|| key_access_servers : "key_access_server_id"
252292
key_access_server_keys }o--|| provider_config : "provider_config_id"
293+
obligation_values_standard }o--|| obligation_definitions : "obligation_definition_id"
294+
obligation_fulfillers }o--|| obligation_values_standard : "obligation_value_id"
295+
obligation_triggers }o--|| obligation_values_standard : "obligation_value_id"
253296
sym_key }o--|| provider_config : "provider_config_id"
254297
registered_resource_action_attribute_values }o--|| registered_resource_values : "registered_resource_value_id"
255298
registered_resource_values }o--|| registered_resources : "registered_resource_id"

0 commit comments

Comments
 (0)