spakky-openfga

spakky-openfga는 Spakky Auth의 relation 기반 인가를 OpenFGA check로 수행하는 provider 플러그인입니다. @require_relation metadata를 OpenFGA tuple model과 store/client 설정에 연결합니다.

Auth Provider Capability

플러그인은 다음 capability를 구현하는 OpenFgaAuthProvider를 등록합니다.

  • AuthCapability.RELATION_CHECK
  • AuthCapability.POLICY_EVALUATION

RelationCheckRequest.relation과 AuthorizationRequest.action은 OpenFGA relation으로 매핑됩니다. AuthContext.subject.id는 OpenFGA user로 매핑되고, resource/tenant canonical ref는 OpenFGA object 문자열로 매핑됩니다.

설치

pip install spakky-auth spakky-openfga

설정

OpenFgaConfig는 settings Pod로 등록되며 SPAKKY_OPENFGA_* 환경변수를 읽습니다. OpenFGA API URL, store id, optional authorization model id, principal type, tenant/object 매핑 설정을 담습니다. 기본적으로 type prefix가 없는 subject id는 user:<subject>로 매핑되고, tenant ref는 <tenant>/<resource> 형태로 object ref 앞에 붙습니다.

주요 설정:

환경변수 의미 기본값
SPAKKY_OPENFGA_API_URL OpenFGA API URL http://localhost:8080
SPAKKY_OPENFGA_STORE_ID check request에 사용할 store id ""
SPAKKY_OPENFGA_AUTHORIZATION_MODEL_ID optional authorization model id 미설정
SPAKKY_OPENFGA_PRINCIPAL_TYPE type prefix 없는 subject id에 붙일 user type user
SPAKKY_OPENFGA_TENANT_SEPARATOR tenant ref와 resource ref를 결합할 separator /
SPAKKY_OPENFGA_INCLUDE_TENANT_IN_OBJECT tenant ref를 object string 앞에 붙일지 여부 true
SPAKKY_OPENFGA_RELATION_CHECK_AVAILABLE relation check provider 가용성 true

사용법

import spakky.auth
import spakky.plugins.openfga
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext

app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.openfga.PLUGIN_NAME,
        }
    )
    .start()
)

Base plugin entry point는 OpenFgaConfig, OpenFgaSdkCheckClient, OpenFgaAuthProvider를 등록하고 IRelationChecker, IAuthorizationPolicyEvaluator를 provider에 binding합니다. Auth feature contribution entry point는 spakky.contributions.spakky.auth group에 RELATION_CHECK, POLICY_EVALUATION capability metadata를 등록합니다.

범위 밖

이 패키지는 tuple write, authorization model migration, admin CLI/API, list resources, data/query filtering, tuple/model management surface를 제공하지 않습니다.

Provider를 사용할 수 없는 상태는 AuthorizationReasonCode.VERIFICATION_PROVIDER_UNAVAILABLE reason code를 가진 ERROR authorization decision으로 매핑됩니다.

개발 검증

패키지 단위 검증은 해당 패키지 디렉토리에서 실행합니다.

uv run ruff format .
uv run ruff check .
uv run pyrefly check
uv run pytest

pytest는 각 패키지 pyproject.toml의 coverage 설정을 사용합니다.

라이선스

MIT License

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_openfga-6.13.0.tar.gz (5.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_openfga-6.13.0-py3-none-any.whl (9.7 kB view details)

Uploaded Python 3

File details

Details for the file spakky_openfga-6.13.0.tar.gz.

File metadata

  • Download URL: spakky_openfga-6.13.0.tar.gz
  • Upload date:
  • Size: 5.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_openfga-6.13.0.tar.gz
Algorithm Hash digest
SHA256 7a34091640d0e85afc88e807f167b94cba3dcaf897752e14cf2101242b377279
MD5 f58a89d52b046ccd6d049c179d402bed
BLAKE2b-256 27c656ddb5361fdb3aa9f76916c3b1bd59ce9c6515174367d83d3fc564898d0e

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-6.13.0.tar.gz:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_openfga-6.13.0-py3-none-any.whl.

File metadata

File hashes

Hashes for spakky_openfga-6.13.0-py3-none-any.whl
Algorithm Hash digest
SHA256 52057dd73a3e492ae48189471be378eb9f58ad5e63fe99644ff3c17c6ffe6bc6
MD5 5cb9aeac4444beee4c24006a90b97049
BLAKE2b-256 2be092664f181c67c2304d61f47e8c24552aad4595d575f66f7493eaef766f10

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-6.13.0-py3-none-any.whl:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page