spakky-openfga

spakky-openfga는 Spakky Auth의 relation 기반 인가를 OpenFGA check로 수행하는 provider 플러그인입니다. @require_relation metadata를 OpenFGA tuple model과 store/client 설정에 연결합니다.

Auth Provider Capability

플러그인은 다음 capability를 구현하는 OpenFgaAuthProvider를 등록합니다.

  • AuthCapability.RELATION_CHECK
  • AuthCapability.POLICY_EVALUATION

RelationCheckRequest.relation과 AuthorizationRequest.action은 OpenFGA relation으로 매핑됩니다. AuthContext.subject.id는 OpenFGA user로 매핑되고, resource/tenant canonical ref는 OpenFGA object 문자열로 매핑됩니다.

설치

pip install spakky-auth spakky-openfga

설정

OpenFgaConfig는 settings Pod로 등록되며 SPAKKY_OPENFGA_* 환경변수를 읽습니다. OpenFGA API URL, store id, optional authorization model id, principal type, tenant/object 매핑 설정을 담습니다. 기본적으로 type prefix가 없는 subject id는 user:<subject>로 매핑되고, tenant ref는 <tenant>/<resource> 형태로 object ref 앞에 붙습니다.

주요 설정:

환경변수 의미 기본값
SPAKKY_OPENFGA_API_URL OpenFGA API URL http://localhost:8080
SPAKKY_OPENFGA_STORE_ID check request에 사용할 store id ""
SPAKKY_OPENFGA_AUTHORIZATION_MODEL_ID optional authorization model id 미설정
SPAKKY_OPENFGA_PRINCIPAL_TYPE type prefix 없는 subject id에 붙일 user type user
SPAKKY_OPENFGA_TENANT_SEPARATOR tenant ref와 resource ref를 결합할 separator /
SPAKKY_OPENFGA_INCLUDE_TENANT_IN_OBJECT tenant ref를 object string 앞에 붙일지 여부 true
SPAKKY_OPENFGA_RELATION_CHECK_AVAILABLE relation check provider 가용성 true

사용법

import spakky.auth
import spakky.plugins.openfga
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext

app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.openfga.PLUGIN_NAME,
        }
    )
    .start()
)

Base plugin entry point는 OpenFgaConfig, OpenFgaSdkCheckClient, OpenFgaAuthProvider를 등록하고 IRelationChecker, IAuthorizationPolicyEvaluator를 provider에 binding합니다. Auth feature contribution entry point는 spakky.contributions.spakky.auth group에 RELATION_CHECK, POLICY_EVALUATION capability metadata를 등록합니다.

범위 밖

이 패키지는 tuple write, authorization model migration, admin CLI/API, list resources, data/query filtering, tuple/model management surface를 제공하지 않습니다.

Provider를 사용할 수 없는 상태는 AuthorizationReasonCode.VERIFICATION_PROVIDER_UNAVAILABLE reason code를 가진 ERROR authorization decision으로 매핑됩니다.

개발 검증

패키지 단위 검증은 해당 패키지 디렉토리에서 실행합니다.

uv run ruff format .
uv run ruff check .
uv run pyrefly check
uv run pytest

pytest는 각 패키지 pyproject.toml의 coverage 설정을 사용합니다.

라이선스

MIT License

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_openfga-7.1.0.tar.gz (5.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_openfga-7.1.0-py3-none-any.whl (9.6 kB view details)

Uploaded Python 3

File details

Details for the file spakky_openfga-7.1.0.tar.gz.

File metadata

  • Download URL: spakky_openfga-7.1.0.tar.gz
  • Upload date:
  • Size: 5.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_openfga-7.1.0.tar.gz
Algorithm Hash digest
SHA256 47e6492f4a71b8a9a40ede23dd5818efa829bba5244cca281603a159041ca0aa
MD5 d0f4f0edc82cbde05fe2fe9a82abd7d5
BLAKE2b-256 f665a68d69f0333ef96a1b5321719314853d08c404fce8acd42a02cfa31dd4ea

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-7.1.0.tar.gz:

Publisher: publish-package.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_openfga-7.1.0-py3-none-any.whl.

File metadata

  • Download URL: spakky_openfga-7.1.0-py3-none-any.whl
  • Upload date:
  • Size: 9.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_openfga-7.1.0-py3-none-any.whl
Algorithm Hash digest
SHA256 719d71023ea7816b4a3a7bfc944f6a351562ba7a71d1261cbb7da50dc432bf82
MD5 f74bc4153e62eff33a5a1fb8a8ffb3a8
BLAKE2b-256 fdf505f2c57696e2924b0b0a3b8b1a87170170eae6296d4ba1f118f04eb02e9a

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-7.1.0-py3-none-any.whl:

Publisher: publish-package.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page