spakky-openfga

spakky-openfga는 Spakky Auth의 relation 기반 인가를 OpenFGA check로 수행하는 provider 플러그인입니다. @require_relation metadata를 OpenFGA tuple model과 store/client 설정에 연결합니다.

Auth Provider Capability

플러그인은 다음 capability를 구현하는 OpenFgaAuthProvider를 등록합니다.

  • AuthCapability.RELATION_CHECK
  • AuthCapability.POLICY_EVALUATION

RelationCheckRequest.relation과 AuthorizationRequest.action은 OpenFGA relation으로 매핑됩니다. AuthContext.subject.id는 OpenFGA user로 매핑되고, resource/tenant canonical ref는 OpenFGA object 문자열로 매핑됩니다.

설치

pip install spakky-auth spakky-openfga

설정

OpenFgaConfig는 settings Pod로 등록되며 SPAKKY_OPENFGA_* 환경변수를 읽습니다. OpenFGA API URL, store id, optional authorization model id, principal type, tenant/object 매핑 설정을 담습니다. 기본적으로 type prefix가 없는 subject id는 user:<subject>로 매핑되고, tenant ref는 <tenant>/<resource> 형태로 object ref 앞에 붙습니다.

주요 설정:

환경변수 의미 기본값
SPAKKY_OPENFGA_API_URL OpenFGA API URL http://localhost:8080
SPAKKY_OPENFGA_STORE_ID check request에 사용할 store id ""
SPAKKY_OPENFGA_AUTHORIZATION_MODEL_ID optional authorization model id 미설정
SPAKKY_OPENFGA_PRINCIPAL_TYPE type prefix 없는 subject id에 붙일 user type user
SPAKKY_OPENFGA_TENANT_SEPARATOR tenant ref와 resource ref를 결합할 separator /
SPAKKY_OPENFGA_INCLUDE_TENANT_IN_OBJECT tenant ref를 object string 앞에 붙일지 여부 true
SPAKKY_OPENFGA_RELATION_CHECK_AVAILABLE relation check provider 가용성 true

사용법

import spakky.auth
import spakky.plugins.openfga
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext

app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.openfga.PLUGIN_NAME,
        }
    )
    .start()
)

Base plugin entry point는 OpenFgaConfig, OpenFgaSdkCheckClient, OpenFgaAuthProvider를 등록하고 IRelationChecker, IAuthorizationPolicyEvaluator를 provider에 binding합니다. Auth feature contribution entry point는 spakky.contributions.spakky.auth group에 RELATION_CHECK, POLICY_EVALUATION capability metadata를 등록합니다.

범위 밖

이 패키지는 tuple write, authorization model migration, admin CLI/API, list resources, data/query filtering, tuple/model management surface를 제공하지 않습니다.

Provider를 사용할 수 없는 상태는 AuthorizationReasonCode.VERIFICATION_PROVIDER_UNAVAILABLE reason code를 가진 ERROR authorization decision으로 매핑됩니다.

개발 검증

패키지 단위 검증은 해당 패키지 디렉토리에서 실행합니다.

uv run ruff format .
uv run ruff check .
uv run pyrefly check
uv run pytest

pytest는 각 패키지 pyproject.toml의 coverage 설정을 사용합니다.

라이선스

MIT License

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_openfga-8.0.0.tar.gz (6.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_openfga-8.0.0-py3-none-any.whl (9.6 kB view details)

Uploaded Python 3

File details

Details for the file spakky_openfga-8.0.0.tar.gz.

File metadata

  • Download URL: spakky_openfga-8.0.0.tar.gz
  • Upload date:
  • Size: 6.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for spakky_openfga-8.0.0.tar.gz
Algorithm Hash digest
SHA256 b87010fd3518519834e6a18f551bf0375b66b5e2f232aadaed9d743dfa096184
MD5 c91922937c974ccbd67a4a59e0548184
BLAKE2b-256 2858ad79210ed3ad4370e13bb9ddea1267787ff25a9e2a72fea862e6feb3989c

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-8.0.0.tar.gz:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_openfga-8.0.0-py3-none-any.whl.

File metadata

  • Download URL: spakky_openfga-8.0.0-py3-none-any.whl
  • Upload date:
  • Size: 9.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for spakky_openfga-8.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 76e40a7dfd344374837cfa55910809a0100e37cadf22671b537d92c75d10a15f
MD5 5152095ceccc8125830c22f4224686be
BLAKE2b-256 9714001c0526501a2f57c3cdb9860ec797ce7b85c0dc4b2a68e2cd1179849ea2

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_openfga-8.0.0-py3-none-any.whl:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page