Repository navigation
Add the environment authorization type - #35
Merged
Merged
Conversation
Environments had no OpenFGA type at all, so the only thing that could be said about one was which organization it belonged to. The type mirrors agent, with the one relation agents have no need for. can_use separates running in an environment from editing one. An environment carries secret-backed ENVs, egress rules that inject credentials, and the contents of its volumes, and anyone who can start a sandbox in it gets a shell sitting on all three -- so using one is a grant of its own, not a consequence of being able to see it. A team can hand out user widely while keeping authorship to itself. can_create_environment follows member: an environment is authored by whoever needs one, and its creator becomes the owner. Additive and inert until the Agents service writes these tuples.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Environments had no OpenFGA type at all, so the only thing that could be said
about one was which organization it belonged to.
The type mirrors
agent, with the one relation agents have no need for.can_useseparates running in an environment from editing one: an environmentcarries secret-backed ENVs, egress rules that inject credentials, and the
contents of its volumes, and anyone who can start a sandbox in it gets a shell
sitting on all three. A team can hand
userout widely while keeping authorshipto itself.
can_create_environmentfollowsmember— an environment is authored bywhoever needs one, and its creator becomes the owner.
Additive and inert until the Agents service writes these tuples, so it deploys
on its own.
fga model testgoes from 24/25 to 28/29 — four new tests, 28 new checks, allpassing. The one remaining failure predates this branch
(
can_list_sandboxesfor a cluster admin: the model allows it, the assertionsays it should not) and is left alone rather than silently resolved either way.
Spec:
architecture/architecture/authz.md#environment