Skip to content

feat(policy): register unsafe service in platform #1066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 16 commits into from
Jul 2, 2024
Merged

feat(policy): register unsafe service in platform #1066

merged 16 commits into from
Jul 2, 2024

Conversation

@jakedoublev
Copy link
Contributor

@jakedoublev jakedoublev commented Jul 2, 2024 •
edited
Loading

Relates to #115

Closes #115

Drives authorization with existing casbin action definition matching logic: https://github.com/opentdf/platform/blob/main/service/internal/auth/authn.go#L289-L290

Middleware casbin tests (with local test-admin client given the admin role for validation):

time=2024-07-01T17:16:31.618-07:00 level=INFO msg="enforcing policy" subject=role:admin resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:16:31.618-07:00 level=WARN msg="permission denied" azp=b007dc27-e9a5-493b-8d2d-b26a92a6752c error="permission denied"
time=2024-07-01T17:18:08.028-07:00 level=INFO msg="enforcing policy" subject=role:standard resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:18:08.028-07:00 level=WARN msg="permission denied" azp=d8949062-977b-498a-a640-61865d633121 error="permission denied"
time=2024-07-01T17:18:30.518-07:00 level=INFO msg="enforcing policy" subject=role:org-admin resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:18:30.519-07:00 level=DEBUG msg=sql sql="SELECT opentdf_policy.attribute_namespaces.id, opentdf_policy.attribute_namespaces.name, opentdf_policy.attribute_namespaces.active, JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata->'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata, opentdf_policy.attribute_fqns.fqn FROM opentdf_policy
.....

@jakedoublev jakedoublev requested review from a team as code owners July 2, 2024 00:18
@jakedoublev jakedoublev mentioned this pull request Jul 2, 2024
Merged
github-merge-queue bot pushed a commit that referenced this pull request Jul 2, 2024
@jakedoublev @dmihalcik-virtru
fix(policy): rename unsafe rpcs for aligned casbin action determinati…
7861e4a 
…on (#1067)

5th PR for #115 

Makes all RPC names on the unsafe services also start with Update to
drive the casbin action definition matching logic:
[main/service/internal/auth/authn.go#L289-L290](https://github.com/opentdf/platform/blob/main/service/internal/auth/authn.go?rgh-link-date=2024-07-02T00%3A18%3A56Z#L289-L290)

Splitting out from #1066 due to the need to publish `/protocol/go`
module dependency for consumption upstream in `service` and `sdk`
modules.

---------

Co-authored-by: David Mihalcik <[email protected]>
@jakedoublev jakedoublev changed the title feat(policy): register unsafe service and support in SDK feat(policy): register unsafe service in platform Jul 2, 2024
jrschumacher
jrschumacher requested changes Jul 2, 2024
View reviewed changes
Copy link
Member

@jrschumacher jrschumacher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you update the example config to propagate the new default?

@jrschumacher jrschumacher enabled auto-merge July 2, 2024 17:40
@jrschumacher jrschumacher added this pull request to the merge queue Jul 2, 2024
Merged via the queue into main with commit b7796cd Jul 2, 2024
@jrschumacher jrschumacher deleted the feat/unsafe-activate branch July 2, 2024 17:47
This was referenced Jul 2, 2024
Merged
Merged
github-merge-queue bot pushed a commit that referenced this pull request Jul 2, 2024
@opentdf-automation
chore(main): release protocol/go 0.2.6 (#1081)
63b09de 
🤖 I have created a release *beep* *boop*
---


##
[0.2.6](protocol/go/v0.2.5...protocol/go/v0.2.6)
(2024-07-02)


### Features

* **policy:** register unsafe service in platform
([#1066](#1066))
([b7796cd](b7796cd))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
github-merge-queue bot pushed a commit that referenced this pull request Jul 2, 2024
@opentdf-automation
chore(main): release service 0.4.8 (#1028)
e3318e1 
🤖 I have created a release *beep* *boop*
---


##
[0.4.8](service/v0.4.7...service/v0.4.8)
(2024-07-02)


### Features

* **policy:** add index to fqn column in attribute_fqns table
([#1035](#1035))
([1b0cf38](1b0cf38)),
closes [#1053](#1053)
* **policy:** add unsafe attribute RPC db connectivity
([#1022](#1022))
([fbc02f3](fbc02f3))
* **policy:** attribute values unsafe actions db connectivity
([#1030](#1030))
([4a30426](4a30426))
* **policy:** register unsafe service in platform
([#1066](#1066))
([b7796cd](b7796cd))


### Bug Fixes

* **authz:** Return deny on GetDecision if resource attribute lookup
returns not found
([#962](#962))
([7dea640](7dea640))
* **core:** Autobump service
([#1072](#1072))
([409df67](409df67))
* **core:** Autobump service
([#1079](#1079))
([10138d2](10138d2))
* **core:** Autobump service
([#1084](#1084))
([968883e](968883e))
* **core:** database clients pooling improvements
([#1047](#1047))
([8193cec](8193cec))
* **core:** swap out internal issuer for external issuer endpoint
([#1027](#1027))
([c3828d0](c3828d0))
* **core:** update casbin policy to allow authorization service
([#1041](#1041))
([552e970](552e970))
* **policy:** provide ns and val fqns back on list attributes response
([#1050](#1050))
([1be04f6](1be04f6)),
closes [#1052](#1052)
* **policy:** rename unsafe rpcs for aligned casbin action determination
([#1067](#1067))
([7861e4a](7861e4a))
* **policy:** run migrations on db only once for all policy services
([#1040](#1040))
([db4f06f](db4f06f))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
jakedoublev added a commit that referenced this pull request Jul 7, 2024
@jakedoublev
feat(policy): register unsafe service in platform (#1066)
49a6826 
Relates to #115 

Closes #115 

Drives authorization with existing casbin action definition matching
logic:
https://github.com/opentdf/platform/blob/main/service/internal/auth/authn.go#L289-L290

Middleware casbin tests (with local `test-admin` client given the
`admin` role for validation):

```shell
time=2024-07-01T17:16:31.618-07:00 level=INFO msg="enforcing policy" subject=role:admin resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:16:31.618-07:00 level=WARN msg="permission denied" azp=b007dc27-e9a5-493b-8d2d-b26a92a6752c error="permission denied"
```

```shell
time=2024-07-01T17:18:08.028-07:00 level=INFO msg="enforcing policy" subject=role:standard resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:18:08.028-07:00 level=WARN msg="permission denied" azp=d8949062-977b-498a-a640-61865d633121 error="permission denied"
```

```shell
time=2024-07-01T17:18:30.518-07:00 level=INFO msg="enforcing policy" subject=role:org-admin resource=policy.unsafe.UnsafeService/UnsafeUpdateNamespace action=unsafe
time=2024-07-01T17:18:30.519-07:00 level=DEBUG msg=sql sql="SELECT opentdf_policy.attribute_namespaces.id, opentdf_policy.attribute_namespaces.name, opentdf_policy.attribute_namespaces.active, JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata->'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata, opentdf_policy.attribute_fqns.fqn FROM opentdf_policy
.....
```
jakedoublev pushed a commit that referenced this pull request Jul 7, 2024
@opentdf-automation @jakedoublev
chore(main): release protocol/go 0.2.6 (#1081)
b729599 
🤖 I have created a release *beep* *boop*
---


##
[0.2.6](protocol/go/v0.2.5...protocol/go/v0.2.6)
(2024-07-02)


### Features

* **policy:** register unsafe service in platform
([#1066](#1066))
([b7796cd](b7796cd))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
jakedoublev pushed a commit that referenced this pull request Jul 7, 2024
@opentdf-automation @jakedoublev
chore(main): release service 0.4.8 (#1028)
dfffc7a 
🤖 I have created a release *beep* *boop*
---


##
[0.4.8](service/v0.4.7...service/v0.4.8)
(2024-07-02)


### Features

* **policy:** add index to fqn column in attribute_fqns table
([#1035](#1035))
([1b0cf38](1b0cf38)),
closes [#1053](#1053)
* **policy:** add unsafe attribute RPC db connectivity
([#1022](#1022))
([fbc02f3](fbc02f3))
* **policy:** attribute values unsafe actions db connectivity
([#1030](#1030))
([4a30426](4a30426))
* **policy:** register unsafe service in platform
([#1066](#1066))
([b7796cd](b7796cd))


### Bug Fixes

* **authz:** Return deny on GetDecision if resource attribute lookup
returns not found
([#962](#962))
([7dea640](7dea640))
* **core:** Autobump service
([#1072](#1072))
([409df67](409df67))
* **core:** Autobump service
([#1079](#1079))
([10138d2](10138d2))
* **core:** Autobump service
([#1084](#1084))
([968883e](968883e))
* **core:** database clients pooling improvements
([#1047](#1047))
([8193cec](8193cec))
* **core:** swap out internal issuer for external issuer endpoint
([#1027](#1027))
([c3828d0](c3828d0))
* **core:** update casbin policy to allow authorization service
([#1041](#1041))
([552e970](552e970))
* **policy:** provide ns and val fqns back on list attributes response
([#1050](#1050))
([1be04f6](1be04f6)),
closes [#1052](#1052)
* **policy:** rename unsafe rpcs for aligned casbin action determination
([#1067](#1067))
([7861e4a](7861e4a))
* **policy:** run migrations on db only once for all policy services
([#1040](#1040))
([db4f06f](db4f06f))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jrschumacher jrschumacher jrschumacher approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Policy API: Enable admins to perform unsafe mutations on data in their platform

3 participants

@jakedoublev @jrschumacher