Skip to content

Commit ce57117

Browse files
jakedoublevjakedoublev
authored
feat(authorization service): Gets the attributes from the in-memory service connection inside the GetDecisions request (#273)
1 parent f1bacab commit ce57117

File tree

8 files changed

+81
-86
lines changed

8 files changed

+81
-86
lines changed

‎cmd/start.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ func RegisterServices(_ config.Config, otdf *server.OpenTDFServer, dbClient *db.
142142
}
143143

144144
slog.Info("registering attributes server")
145-
err = attr.NewAttributesServer(dbClient, otdf.GrpcServer, otdf.Mux)
145+
err = attr.NewAttributesServer(dbClient, otdf.GrpcServer, otdf.GrpcInProcess.GetGrpcServer(), otdf.Mux)
146146
if err != nil {
147147
return fmt.Errorf("could not register attributes service: %w", err)
148148
}
@@ -166,7 +166,7 @@ func RegisterServices(_ config.Config, otdf *server.OpenTDFServer, dbClient *db.
166166
}
167167

168168
slog.Info("registering authorization server")
169-
err = authorization.NewAuthorizationServer(otdf.GrpcServer, otdf.Mux)
169+
err = authorization.NewAuthorizationServer(otdf.GrpcServer, otdf.GrpcInProcess.Conn(), otdf.Mux)
170170
if err != nil {
171171
return fmt.Errorf("could not register authorization service: %w", err)
172172
}

‎docs/grpc/index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -746,7 +746,7 @@ <h3 id="authorization.Action">Action</h3>
746746

747747

748748
<h3 id="authorization.DecisionRequest">DecisionRequest</h3>
749-
<p>Example Request Get Decisions to answer the question - Do Bob (represented by entity chain ec1)</p><p>and Alice (represented by entity chain ec2) have TRANSMIT authorization for</p><p>2 resources; resource1 (attr-set-1) defined by attributes foo:bar resource2 (attr-set-2) defined by attribute foo:bar, color:red ?</p><p>{</p><p>"actions": [</p><p>{</p><p>"standard": "STANDARD_ACTION_TRANSMIT"</p><p>}</p><p>],</p><p>"entityChains": [</p><p>{</p><p>"id": "ec1",</p><p>"entities": [</p><p>{</p><p>"emailAddress": "[email protected]"</p><p>}</p><p>]</p><p>},</p><p>{</p><p>"id": "ec2",</p><p>"entities": [</p><p>{</p><p>"userName": "[email protected]"</p><p>}</p><p>]</p><p>}</p><p>],</p><p>"resourceAttributes": [</p><p>{</p><p>"attributeValueReferences": [</p><p>{</p><p>"attributeFqn": "http://www.example.org/attr/foo/value/bar"</p><p>}</p><p>]</p><p>},</p><p>{</p><p>"attributeValueReferences": [</p><p>{</p><p>"attributeFqn": "http://www.example.org/attr/foo/value/bar"</p><p>},</p><p>{</p><p>"attributeFqn": "http://www.example.org/attr/color/value/red"</p><p>}</p><p>]</p><p>}</p><p>]</p><p>}</p>
749+
<p>Example Request Get Decisions to answer the question - Do Bob (represented by entity chain ec1)</p><p>and Alice (represented by entity chain ec2) have TRANSMIT authorization for</p><p>2 resources; resource1 (attr-set-1) defined by attributes foo:bar resource2 (attr-set-2) defined by attribute foo:bar, color:red ?</p><p>{</p><p>"actions": [</p><p>{</p><p>"standard": "STANDARD_ACTION_TRANSMIT"</p><p>}</p><p>],</p><p>"entityChains": [</p><p>{</p><p>"id": "ec1",</p><p>"entities": [</p><p>{</p><p>"emailAddress": "[email protected]"</p><p>}</p><p>]</p><p>},</p><p>{</p><p>"id": "ec2",</p><p>"entities": [</p><p>{</p><p>"userName": "[email protected]"</p><p>}</p><p>]</p><p>}</p><p>],</p><p>"resourceAttributes": [</p><p>{</p><p>"attributeFqns": [</p><p>"https://www.example.org/attr/foo/value/value1"</p><p>]</p><p>},</p><p>{</p><p>"attributeFqns": [</p><p>"https://example.net/attr/attr1/value/value1",</p><p>"https://example.net/attr/attr1/value/value2"</p><p>]</p><p>}</p><p>]</p><p>}</p>
750750

751751

752752
<table class="field-table">

‎docs/openapi/authorization/authorization.swagger.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@
130130
}
131131
}
132132
},
133-
"description": "{\n\"actions\": [\n{\n\"standard\": \"STANDARD_ACTION_TRANSMIT\"\n}\n],\n\"entityChains\": [\n{\n\"id\": \"ec1\",\n\"entities\": [\n{\n\"emailAddress\": \"[email protected]\"\n}\n]\n},\n{\n\"id\": \"ec2\",\n\"entities\": [\n{\n\"userName\": \"[email protected]\"\n}\n]\n}\n],\n\"resourceAttributes\": [\n{\n\"attributeValueReferences\": [\n{\n\"attributeFqn\": \"http://www.example.org/attr/foo/value/bar\"\n}\n]\n},\n{\n\"attributeValueReferences\": [\n{\n\"attributeFqn\": \"http://www.example.org/attr/foo/value/bar\"\n},\n{\n\"attributeFqn\": \"http://www.example.org/attr/color/value/red\"\n}\n]\n}\n]\n}",
133+
"description": "{\n\"actions\": [\n{\n\"standard\": \"STANDARD_ACTION_TRANSMIT\"\n}\n],\n\"entityChains\": [\n{\n\"id\": \"ec1\",\n\"entities\": [\n{\n\"emailAddress\": \"[email protected]\"\n}\n]\n},\n{\n\"id\": \"ec2\",\n\"entities\": [\n{\n\"userName\": \"[email protected]\"\n}\n]\n}\n],\n\"resourceAttributes\": [\n{\n\"attributeFqns\": [\n\"https://www.example.org/attr/foo/value/value1\"\n]\n},\n{\n\"attributeFqns\": [\n\"https://example.net/attr/attr1/value/value1\",\n\"https://example.net/attr/attr1/value/value2\"\n]\n}\n]\n}",
134134
"title": "Example Request Get Decisions to answer the question - Do Bob (represented by entity chain ec1)\nand Alice (represented by entity chain ec2) have TRANSMIT authorization for\n2 resources; resource1 (attr-set-1) defined by attributes foo:bar resource2 (attr-set-2) defined by attribute foo:bar, color:red ?"
135135
},
136136
"authorizationDecisionResponse": {

‎protocol/go/authorization/authorization.pb.go‎

Lines changed: 5 additions & 11 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdkjava/src/main/java/io/opentdf/platform/authorization/DecisionRequest.java‎

Lines changed: 10 additions & 22 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎services/authorization/authorization.go‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,24 @@ import (
44
"context"
55
"fmt"
66
"log/slog"
7+
"strings"
78

89
"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
910
"github.com/opentdf/platform/protocol/go/authorization"
11+
attr "github.com/opentdf/platform/protocol/go/policy/attributes"
12+
"github.com/opentdf/platform/services"
1013
"google.golang.org/grpc"
1114
)
1215

1316
type AuthorizationService struct {
1417
authorization.UnimplementedAuthorizationServiceServer
18+
cc *grpc.ClientConn
1519
}
1620

17-
func NewAuthorizationServer(g *grpc.Server, s *runtime.ServeMux) error {
18-
as := &AuthorizationService{}
21+
func NewAuthorizationServer(g *grpc.Server, cc *grpc.ClientConn, s *runtime.ServeMux) error {
22+
as := &AuthorizationService{
23+
cc: cc,
24+
}
1925
authorization.RegisterAuthorizationServiceServer(g, as)
2026
err := authorization.RegisterAuthorizationServiceHandlerServer(context.Background(), s, as)
2127
if err != nil {
@@ -27,13 +33,25 @@ func NewAuthorizationServer(g *grpc.Server, s *runtime.ServeMux) error {
2733
func (as AuthorizationService) GetDecisions(ctx context.Context, req *authorization.GetDecisionsRequest) (*authorization.GetDecisionsResponse, error) {
2834
slog.Debug("getting decisions")
2935

36+
attrClient := attr.NewAttributesServiceClient(as.cc)
37+
3038
// Temporary canned echo response with permit decision for all requested decision/entity/ra combos
3139
rsp := &authorization.GetDecisionsResponse{
3240
DecisionResponses: make([]*authorization.DecisionResponse, 0),
3341
}
3442
for _, dr := range req.DecisionRequests {
3543
for _, ra := range dr.ResourceAttributes {
44+
slog.Debug("getting resource attributes", slog.String("FQNs", strings.Join(ra.AttributeFqns, ", ")))
45+
46+
attrs, err := attrClient.GetAttributesByValueFqns(ctx, &attr.GetAttributesByValueFqnsRequest{
47+
Fqns: ra.AttributeFqns,
48+
})
49+
if err != nil {
50+
// TODO: should all decisions in a request fail if one FQN lookup fails?
51+
return nil, services.HandleError(err, services.ErrGetRetrievalFailed, slog.String("fqns", strings.Join(ra.AttributeFqns, ", ")))
52+
}
3653
for _, ec := range dr.EntityChains {
54+
fmt.Printf("\nTODO: make access decision here with these fully qualified attributes: %+v\n", attrs)
3755
decision := &authorization.DecisionResponse{
3856
Decision: authorization.DecisionResponse_DECISION_PERMIT,
3957
EntityChainId: ec.Id,

‎services/authorization/authorization.proto‎

Lines changed: 38 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -49,52 +49,44 @@ message Action {
4949
and Alice (represented by entity chain ec2) have TRANSMIT authorization for
5050
2 resources; resource1 (attr-set-1) defined by attributes foo:bar resource2 (attr-set-2) defined by attribute foo:bar, color:red ?
5151
52-
{
53-
"actions": [
54-
{
55-
"standard": "STANDARD_ACTION_TRANSMIT"
56-
}
57-
],
58-
"entityChains": [
59-
{
60-
"id": "ec1",
61-
"entities": [
62-
{
63-
"emailAddress": "[email protected]"
64-
}
65-
]
66-
},
67-
{
68-
"id": "ec2",
69-
"entities": [
70-
{
71-
"userName": "[email protected]"
72-
}
73-
]
74-
}
75-
],
76-
"resourceAttributes": [
77-
{
78-
"attributeValueReferences": [
79-
{
80-
"attributeFqn": "http://www.example.org/attr/foo/value/bar"
81-
}
82-
]
83-
},
84-
{
85-
"attributeValueReferences": [
86-
{
87-
"attributeFqn": "http://www.example.org/attr/foo/value/bar"
88-
},
89-
{
90-
"attributeFqn": "http://www.example.org/attr/color/value/red"
91-
}
92-
]
93-
}
94-
]
95-
}
96-
97-
52+
{
53+
"actions": [
54+
{
55+
"standard": "STANDARD_ACTION_TRANSMIT"
56+
}
57+
],
58+
"entityChains": [
59+
{
60+
"id": "ec1",
61+
"entities": [
62+
{
63+
"emailAddress": "[email protected]"
64+
}
65+
]
66+
},
67+
{
68+
"id": "ec2",
69+
"entities": [
70+
{
71+
"userName": "[email protected]"
72+
}
73+
]
74+
}
75+
],
76+
"resourceAttributes": [
77+
{
78+
"attributeFqns": [
79+
"https://www.example.org/attr/foo/value/value1"
80+
]
81+
},
82+
{
83+
"attributeFqns": [
84+
"https://example.net/attr/attr1/value/value1",
85+
"https://example.net/attr/attr1/value/value2"
86+
]
87+
}
88+
]
89+
}
9890
9991
*/
10092
message DecisionRequest {

‎services/policy/attributes/attributes.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,14 @@ type AttributesService struct {
1818
dbClient *policydb.PolicyDbClient
1919
}
2020

21-
func NewAttributesServer(dbClient *db.Client, g *grpc.Server, s *runtime.ServeMux) error {
21+
func NewAttributesServer(dbClient *db.Client, g *grpc.Server, grpcInprocess *grpc.Server, s *runtime.ServeMux) error {
2222
as := &AttributesService{
2323
dbClient: policydb.NewClient(*dbClient),
2424
}
2525
attr.RegisterAttributesServiceServer(g, as)
26+
if grpcInprocess != nil {
27+
attr.RegisterAttributesServiceServer(grpcInprocess, as)
28+
}
2629
err := attr.RegisterAttributesServiceHandlerServer(context.Background(), s, as)
2730
if err != nil {
2831
return fmt.Errorf("failed to register attributes service handler: %w", err)

0 commit comments

Comments
 (0)