fix(authorization): Hierarchy working in GetDecisions #519
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jrschumacher
reviewed
Apr 4, 2024
pflynn-virtru
approved these changes
Apr 8, 2024
alkalescent
pushed a commit
that referenced
this pull request
Apr 8, 2024
Needed to provide additional scope to GetEntitlements for hierarchy attributes as the entity may not possess the specific resource attribute but an attribute higher/lower All rules working -- allof, anyof, hierarchy
github-merge-queue bot
pushed a commit
that referenced
this pull request
Apr 23, 2024
🤖 I have created a release *beep* *boop* --- ## [0.1.0](service-v0.1.0...service/v0.1.0) (2024-04-22) ### ⚠ BREAKING CHANGES * Singular platform/service ([#511](#511)) ### Features * ability to add public routes that bypass authn middleware ([#601](#601)) ([7c65308](7c65308)) * ability to set config key or config file from root cmd ([#502](#502)) ([56a0131](56a0131)) * allow --insecure in provision keycloak cmd ([#629](#629)) ([a672325](a672325)) * **kas:** support HSM and standard crypto ([#497](#497)) ([f0cbe03](f0cbe03)) * **opa:** Adding jq OPA builtin for selection ([#527](#527)) ([d4ab17a](d4ab17a)) * **policy:** add `created_at` and `updated_at` timestamps to metadata ([#538](#538)) ([e812563](e812563)) * **policy:** update fixtures, proto comments, and proto field names to reflect use of jq selector syntax within Conditions of Subject Sets ([#523](#523)) ([16f40f7](16f40f7)) * **sdk:** don't require `client_id` in the auth token ([#544](#544)) ([a1e70f9](a1e70f9)) * **sdk:** normalize token exchange ([#546](#546)) ([9059dff](9059dff)) ### Bug Fixes * **authorization:** Hierarchy working in GetDecisions ([#519](#519)) ([2856485](2856485)) * **core:** allow org-admin casbin role to call KAS rewrap endpoint ([#579](#579)) ([a64c62a](a64c62a)) * **core:** fix panic on nil pointer dereference by passing KAS the SDK instance on registration ([#574](#574)) ([327bfca](327bfca)) * **core:** fixes fixtures provisioning after filepath change with repo restructuring ([#521](#521)) ([f128e9f](f128e9f)) * load extraprops for a service config with remainder values ([#524](#524)) ([d3d72dc](d3d72dc)) * **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed attribute(s) can be deactivated w/o any prompts ([#489](#489)) ([e5a3324](e5a3324)) * **policy:** remove hardcoded schema in goose migration 20240405000000 ([#596](#596)) ([36c3b16](36c3b16)) * **policy:** return `created_at` and `updated_at` timestamps in CREATE metadata ([#557](#557)) ([fcaaeea](fcaaeea)) * resolves issues auth policy configuration ([#498](#498)) ([08e67cf](08e67cf)) * **service:** go.mod version fix sync ([#604](#604)) ([6323efd](6323efd)) * url encode db password field to handle special characters ([#624](#624)) ([5069f9d](5069f9d)) ### Code Refactoring * Singular platform/service ([#511](#511)) ([40c8b97](40c8b97)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42
added a commit
to tech-guru42/TDF
that referenced
this pull request
Jun 3, 2024
🤖 I have created a release *beep* *boop* --- ## [0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0) (2024-04-22) ### ⚠ BREAKING CHANGES * Singular platform/service ([#511](opentdf/platform#511)) ### Features * ability to add public routes that bypass authn middleware ([#601](opentdf/platform#601)) ([7c65308](opentdf/platform@7c65308)) * ability to set config key or config file from root cmd ([#502](opentdf/platform#502)) ([56a0131](opentdf/platform@56a0131)) * allow --insecure in provision keycloak cmd ([#629](opentdf/platform#629)) ([a672325](opentdf/platform@a672325)) * **kas:** support HSM and standard crypto ([#497](opentdf/platform#497)) ([f0cbe03](opentdf/platform@f0cbe03)) * **opa:** Adding jq OPA builtin for selection ([#527](opentdf/platform#527)) ([d4ab17a](opentdf/platform@d4ab17a)) * **policy:** add `created_at` and `updated_at` timestamps to metadata ([#538](opentdf/platform#538)) ([e812563](opentdf/platform@e812563)) * **policy:** update fixtures, proto comments, and proto field names to reflect use of jq selector syntax within Conditions of Subject Sets ([#523](opentdf/platform#523)) ([16f40f7](opentdf/platform@16f40f7)) * **sdk:** don't require `client_id` in the auth token ([#544](opentdf/platform#544)) ([a1e70f9](opentdf/platform@a1e70f9)) * **sdk:** normalize token exchange ([#546](opentdf/platform#546)) ([9059dff](opentdf/platform@9059dff)) ### Bug Fixes * **authorization:** Hierarchy working in GetDecisions ([#519](opentdf/platform#519)) ([2856485](opentdf/platform@2856485)) * **core:** allow org-admin casbin role to call KAS rewrap endpoint ([#579](opentdf/platform#579)) ([a64c62a](opentdf/platform@a64c62a)) * **core:** fix panic on nil pointer dereference by passing KAS the SDK instance on registration ([#574](opentdf/platform#574)) ([327bfca](opentdf/platform@327bfca)) * **core:** fixes fixtures provisioning after filepath change with repo restructuring ([#521](opentdf/platform#521)) ([f128e9f](opentdf/platform@f128e9f)) * load extraprops for a service config with remainder values ([#524](opentdf/platform#524)) ([d3d72dc](opentdf/platform@d3d72dc)) * **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed attribute(s) can be deactivated w/o any prompts ([#489](opentdf/platform#489)) ([e5a3324](opentdf/platform@e5a3324)) * **policy:** remove hardcoded schema in goose migration 20240405000000 ([#596](opentdf/platform#596)) ([36c3b16](opentdf/platform@36c3b16)) * **policy:** return `created_at` and `updated_at` timestamps in CREATE metadata ([#557](opentdf/platform#557)) ([fcaaeea](opentdf/platform@fcaaeea)) * resolves issues auth policy configuration ([#498](opentdf/platform#498)) ([08e67cf](opentdf/platform@08e67cf)) * **service:** go.mod version fix sync ([#604](opentdf/platform#604)) ([6323efd](opentdf/platform@6323efd)) * url encode db password field to handle special characters ([#624](opentdf/platform#624)) ([5069f9d](opentdf/platform@5069f9d)) ### Code Refactoring * Singular platform/service ([#511](opentdf/platform#511)) ([40c8b97](opentdf/platform@40c8b97)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127
added a commit
to passion-127/TDF
that referenced
this pull request
Jun 6, 2024
🤖 I have created a release *beep* *boop* --- ## [0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0) (2024-04-22) ### ⚠ BREAKING CHANGES * Singular platform/service ([#511](opentdf/platform#511)) ### Features * ability to add public routes that bypass authn middleware ([#601](opentdf/platform#601)) ([7c65308](opentdf/platform@7c65308)) * ability to set config key or config file from root cmd ([#502](opentdf/platform#502)) ([56a0131](opentdf/platform@56a0131)) * allow --insecure in provision keycloak cmd ([#629](opentdf/platform#629)) ([a672325](opentdf/platform@a672325)) * **kas:** support HSM and standard crypto ([#497](opentdf/platform#497)) ([f0cbe03](opentdf/platform@f0cbe03)) * **opa:** Adding jq OPA builtin for selection ([#527](opentdf/platform#527)) ([d4ab17a](opentdf/platform@d4ab17a)) * **policy:** add `created_at` and `updated_at` timestamps to metadata ([#538](opentdf/platform#538)) ([e812563](opentdf/platform@e812563)) * **policy:** update fixtures, proto comments, and proto field names to reflect use of jq selector syntax within Conditions of Subject Sets ([#523](opentdf/platform#523)) ([16f40f7](opentdf/platform@16f40f7)) * **sdk:** don't require `client_id` in the auth token ([#544](opentdf/platform#544)) ([a1e70f9](opentdf/platform@a1e70f9)) * **sdk:** normalize token exchange ([#546](opentdf/platform#546)) ([9059dff](opentdf/platform@9059dff)) ### Bug Fixes * **authorization:** Hierarchy working in GetDecisions ([#519](opentdf/platform#519)) ([2856485](opentdf/platform@2856485)) * **core:** allow org-admin casbin role to call KAS rewrap endpoint ([#579](opentdf/platform#579)) ([a64c62a](opentdf/platform@a64c62a)) * **core:** fix panic on nil pointer dereference by passing KAS the SDK instance on registration ([#574](opentdf/platform#574)) ([327bfca](opentdf/platform@327bfca)) * **core:** fixes fixtures provisioning after filepath change with repo restructuring ([#521](opentdf/platform#521)) ([f128e9f](opentdf/platform@f128e9f)) * load extraprops for a service config with remainder values ([#524](opentdf/platform#524)) ([d3d72dc](opentdf/platform@d3d72dc)) * **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed attribute(s) can be deactivated w/o any prompts ([#489](opentdf/platform#489)) ([e5a3324](opentdf/platform@e5a3324)) * **policy:** remove hardcoded schema in goose migration 20240405000000 ([#596](opentdf/platform#596)) ([36c3b16](opentdf/platform@36c3b16)) * **policy:** return `created_at` and `updated_at` timestamps in CREATE metadata ([#557](opentdf/platform#557)) ([fcaaeea](opentdf/platform@fcaaeea)) * resolves issues auth policy configuration ([#498](opentdf/platform#498)) ([08e67cf](opentdf/platform@08e67cf)) * **service:** go.mod version fix sync ([#604](opentdf/platform#604)) ([6323efd](opentdf/platform@6323efd)) * url encode db password field to handle special characters ([#624](opentdf/platform#624)) ([5069f9d](opentdf/platform@5069f9d)) ### Code Refactoring * Singular platform/service ([#511](opentdf/platform#511)) ([40c8b97](opentdf/platform@40c8b97)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Needed to provide additional scope to GetEntitlements for hierarchy attributes as the entity may not possess the specific resource attribute but an attribute higher/lower
All rules working -- allof, anyof, hierarchy