spakky-openfga

spakky-openfga는 Spakky Auth의 relation 기반 인가를 OpenFGA check로 수행하는 provider 플러그인입니다. @require_relation metadata를 OpenFGA tuple model과 store/client 설정에 연결합니다.

Auth Provider Capability

플러그인은 다음 capability를 구현하는 OpenFgaAuthProvider를 등록합니다.

  • AuthCapability.RELATION_CHECK
  • AuthCapability.POLICY_EVALUATION

RelationCheckRequest.relation과 AuthorizationRequest.action은 OpenFGA relation으로 매핑됩니다. AuthContext.subject.id는 OpenFGA user로 매핑되고, resource/tenant canonical ref는 OpenFGA object 문자열로 매핑됩니다.

설치

pip install spakky-auth spakky-openfga

설정

OpenFgaConfig는 settings Pod로 등록되며 SPAKKY_OPENFGA_* 환경변수를 읽습니다. OpenFGA API URL, store id, optional authorization model id, principal type, tenant/object 매핑 설정을 담습니다. 기본적으로 type prefix가 없는 subject id는 user:<subject>로 매핑되고, tenant ref는 <tenant>/<resource> 형태로 object ref 앞에 붙습니다.

주요 설정:

환경변수 의미 기본값
SPAKKY_OPENFGA_API_URL OpenFGA API URL http://localhost:8080
SPAKKY_OPENFGA_STORE_ID check request에 사용할 store id ""
SPAKKY_OPENFGA_AUTHORIZATION_MODEL_ID optional authorization model id 미설정
SPAKKY_OPENFGA_PRINCIPAL_TYPE type prefix 없는 subject id에 붙일 user type user
SPAKKY_OPENFGA_TENANT_SEPARATOR tenant ref와 resource ref를 결합할 separator /
SPAKKY_OPENFGA_INCLUDE_TENANT_IN_OBJECT tenant ref를 object string 앞에 붙일지 여부 true
SPAKKY_OPENFGA_RELATION_CHECK_AVAILABLE relation check provider 가용성 true

사용법

import spakky.auth
import spakky.plugins.openfga
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext

app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.openfga.PLUGIN_NAME,
        }
    )
    .start()
)

Base plugin entry point는 OpenFgaConfig, OpenFgaSdkCheckClient, OpenFgaAuthProvider를 등록하고 IRelationChecker, IAuthorizationPolicyEvaluator를 provider에 binding합니다. Auth feature contribution entry point는 spakky.contributions.spakky.auth group에 RELATION_CHECK, POLICY_EVALUATION capability metadata를 등록합니다.

범위 밖

이 패키지는 tuple write, authorization model migration, admin CLI/API, list resources, data/query filtering, tuple/model management surface를 제공하지 않습니다.

Provider를 사용할 수 없는 상태는 AuthorizationReasonCode.VERIFICATION_PROVIDER_UNAVAILABLE reason code를 가진 ERROR authorization decision으로 매핑됩니다.

개발 검증

패키지 단위 검증은 해당 패키지 디렉토리에서 실행합니다.

uv run ruff format .
uv run ruff check .
uv run pyrefly check
uv run pytest

pytest는 각 패키지 pyproject.toml의 coverage 설정을 사용합니다.

라이선스

MIT License

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_openfga-6.11.0.tar.gz (5.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_openfga-6.11.0-py3-none-any.whl (9.7 kB view details)

Uploaded Python 3

File details

Details for the file spakky_openfga-6.11.0.tar.gz.

File metadata

  • Download URL: spakky_openfga-6.11.0.tar.gz
  • Upload date:
  • Size: 5.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_openfga-6.11.0.tar.gz
Algorithm Hash digest
SHA256 f2468f4175596cdbcbc6785bc8065d420676ec4b978048361b16321e5dfb1e97
MD5 84127ca491634de1e7e6abbcde070b7b
BLAKE2b-256 b27979c9cf4a78efd9f35fb9b63290bbf701f2ff6021b4d5dd774d8468b8fa76

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-6.11.0.tar.gz:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_openfga-6.11.0-py3-none-any.whl.

File metadata

File hashes

Hashes for spakky_openfga-6.11.0-py3-none-any.whl
Algorithm Hash digest
SHA256 ca6d490d50b3823075d911ad87370370ca0018e50568e65cd4f35e6ae634d3a0
MD5 b82fd4aee8d83809b53913516804e557
BLAKE2b-256 816d9cef34c5d72801a15df90936a8db0ae2442811e3c8b8eac7b2c13c66cb25

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-6.11.0-py3-none-any.whl:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page