feat: unified APIs with REST, gRPC and Connect RPC

.golangci.yml

@@ -1,9 +1,24 @@
 version: "2"
 
 linters:
+  default: none
   enable:
     - gosec
     - errcheck
     - ineffassign
     - staticcheck
     - unused
+  settings:
+    gosec:
+      excludes:
+        - G115
+    staticcheck:
+      checks:
+        - all
+        - "-ST1000"
+        - "-ST1003"
+        - "-ST1016"
+        - "-ST1020"
+        - "-ST1021"
+        - "-ST1022"
+        - "-SA1019" # Ignore warnings about deprecated code for now

.schema/openapi/patches/checkServices.yaml

@@ -0,0 +1,22 @@
+- op: add
+  path: /paths/~1relation-tuples~1check/get/operationId
+  value: checkPermissionOrError
+- op: add
+  path: /paths/~1relation-tuples~1check/post/operationId
+  value: postCheckPermissionOrError
+- op: add
+  path: /paths/~1relation-tuples~1check~1openapi/get/operationId
+  value: checkPermission
+- op: add
+  path: /paths/~1relation-tuples~1check~1openapi/post/operationId
+  value: postCheckPermission
+
+# Remove schema from empty response.
+- op: replace
+  path: /paths/~1admin~1relation-tuples/delete/responses/204
+  value:
+    description: An empty response.
+- op: replace
+  path: /paths/~1admin~1relation-tuples/patch/responses/204
+  value:
+    description: An empty response.

.schema/openapi/patches/health.yaml

@@ -1,4 +1,4 @@
-- op: replace
+- op: add
   path: /paths/~1health~1alive
   value:
     get:
@@ -17,17 +17,22 @@
           content:
             application/json:
               schema:
-                "$ref": "#/components/schemas/healthStatus"
+                required:
+                  - status
+                type: object
+                properties:
+                  status:
+                    type: string
           description: {{.ProjectHumanName}} is ready to accept connections.
         '500':
           content:
             application/json:
               schema:
-                "$ref": "#/components/schemas/genericError"
+                "$ref": "#/definitions/errorGeneric"
           description: genericError
       summary: Check HTTP Server Status
       tags: {{ .HealthPathTags | toJson }}
-- op: replace
+- op: add
   path: /paths/~1health~1ready
   value:
     get:
@@ -46,6 +51,8 @@
           content:
             application/json:
               schema:
+                required:
+                  - status
                 type: object
                 properties:
                   status:
@@ -56,6 +63,8 @@
           content:
             application/json:
               schema:
+                required:
+                  - errors
                 properties:
                   errors:
                     additionalProperties:
@@ -64,6 +73,12 @@
                     type: object
                 type: object
           description: Ory Kratos is not yet ready to accept requests.
+        default:
+          content:
+            text/plain:
+              schema:
+                type: string
+          description: Unexpected error
       summary: Check HTTP Server and Database Status
       tags: {{ .HealthPathTags | toJson }}
 - op: replace
@@ -85,6 +100,8 @@
             application/json:
               schema:
                 type: object
+                required:
+                  - version
                 properties:
                   version:
                     description: The version of {{.ProjectHumanName}}.

.schema/openapi/patches/meta.yaml

@@ -1,4 +1,4 @@
-- op: replace
+- op: add
   path: /info
   value:
     title: Ory Keto API

.schema/openapi/patches/replacements.sed

@@ -0,0 +1,14 @@
+s/ory.keto.relation_tuples.v1alpha2.ErrorResponse/errorGeneric/g
+s/ory.keto.relation_tuples.v1alpha2.ErrorResponse.Error/genericError/g
+s/ory.keto.relation_tuples.v1alpha2.CreateRelationTupleRequest.Relationship/createRelationshipBody/g
+s/ory.keto.relation_tuples.v1alpha2.SubjectSet/subjectSet/g
+s/ory.keto.relation_tuples.v1alpha2.SubjectTree/expandedPermissionTree/g
+s/ory.keto.relation_tuples.v1alpha2.RelationTupleDelta/relationshipPatch/g
+s/ory.keto.relation_tuples.v1alpha2.RelationTuple/relationship/g
+s/ory.keto.relation_tuples.v1alpha2.ListRelationTuplesResponse/relationships/g
+s/ory.keto.relation_tuples.v1alpha2.ListNamespacesResponse/relationshipNamespaces/g
+s/ory.keto.relation_tuples.v1alpha2.CheckRequest/postCheckPermissionBody/g
+s/ory.keto.relation_tuples.v1alpha2.CheckResponse/checkPermissionResult/g
+s/ory.keto.relation_tuples.v1alpha2.BatchCheckRequestBody/batchCheckPermissionBody/g
+s/ory.keto.relation_tuples.v1alpha2.BatchCheckResponse/batchCheckPermissionResult/g
+s/ory.keto.opl.v1alpha1.CheckResponse/checkOplSyntaxResult/g

Makefile

@@ -29,6 +29,7 @@ format: .bin/ory node_modules
 	.bin/ory dev headers copyright --type=open-source --exclude=.bin --exclude=internal/httpclient --exclude=proto --exclude=oryx
 	go tool goimports -w -local github.com/ory/keto *.go internal cmd contrib ketoctx ketoapi embedx
 	npm exec -- prettier --write .
+	go tool buf format -w
 
 .PHONY: install
 install:
@@ -40,21 +41,18 @@ docker:
 
 # Generates the SDKs
 .PHONY: sdk
-sdk: .bin/ory node_modules
+sdk: buf .bin/ory node_modules
 	rm -rf internal/httpclient
-	go tool swagger generate spec -m -o spec/swagger.json \
-		-c github.com/ory/keto \
-		-c github.com/ory/x/healthx \
-		-x internal/httpclient \
-		-x internal/e2e
-	.bin/ory dev swagger sanitize ./spec/swagger.json
-	go tool swagger validate ./spec/swagger.json
+	.bin/ory dev swagger sanitize ./spec/api.swagger.json
+	sed -i -f ./.schema/openapi/patches/replacements.sed ./spec/api.swagger.json
+	go tool swagger validate ./spec/api.swagger.json
 	CIRCLE_PROJECT_USERNAME=ory CIRCLE_PROJECT_REPONAME=keto \
 		.bin/ory dev openapi migrate \
 			--health-path-tags metadata \
 			-p https://raw.githubusercontent.com/ory/x/master/healthx/openapi/patch.yaml \
 			-p file://.schema/openapi/patches/meta.yaml \
-			spec/swagger.json spec/api.json
+			-p file://.schema/openapi/patches/checkServices.yaml \
+			spec/api.swagger.json spec/api.json
 
 	mkdir -p internal/httpclient
 
@@ -82,9 +80,7 @@ build:
 #
 .PHONY: buf-gen
 buf-gen: node_modules
-	go tool -n protoc-gen-doc # Apparently on the first run the path is the temporary build output and will be deleted again. Later invocations use the correct go build cache path.
-	PATH=$$PATH:$$(dirname "$$(go tool -n protoc-gen-doc)") \
-		go tool buf generate proto
+	go tool buf generate proto
 	make format
 	@echo "All code was generated successfully!"
 

buf.gen.yaml

@@ -1,28 +1,43 @@
-version: v1
+version: v2
+
+inputs:
+  - directory: "proto"
 
 plugins:
-  - plugin: buf.build/protocolbuffers/go
+  - remote: buf.build/protocolbuffers/go
     out: proto
     opt: paths=source_relative
 
-  - plugin: buf.build/grpc/go
+  - remote: buf.build/grpc/go
     out: proto
     opt: paths=source_relative,require_unimplemented_servers=false
 
-  - plugin: buf.build/protocolbuffers/js
+  - remote: buf.build/protocolbuffers/js
     out: proto
     opt: import_style=commonjs,binary
+    include_imports: true
+    include_wkt: true
 
-  - plugin: buf.build/grpc/node
+  - remote: buf.build/grpc/node
     out: proto
     opt: grpc_js,binary,import_style=commonjs
 
-  - name: ts
+  - local: node_modules/.bin/protoc-gen-ts
     out: proto
     opt: grpc_js
-    path: node_modules/.bin/protoc-gen-ts
 
-  - name: doc
+  - local: ["go", "tool", "protoc-gen-doc"]
     out: proto
     opt: proto/markdown.tmpl,proto/buf.md
     strategy: all
+
+  - remote: buf.build/grpc-ecosystem/openapiv2
+    opt:
+      - allow_merge=true
+      - merge_file_name=api
+      - openapi_naming_strategy=fqn
+      - visibility_restriction_selectors=PUBLIC
+      - disable_service_tags=true
+      - disable_default_errors=true
+      - disable_default_responses=true
+    out: spec

buf.lock

@@ -0,0 +1,12 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/bufbuild/protovalidate
+    commit: d39267d9df8f4053bbac6b956a23169f
+    digest: b5:c2542c2e9935dd9a7f12ef79f76aa5b53cf1c8312d720da54e03953f27ad952e2b439cbced06e3b4069e466bd9b64019cf9f687243ad51aa5dc2b5f364fac71e
+  - name: buf.build/googleapis/googleapis
+    commit: 546238c53f7340c6a2a6099fb863bc1b
+    digest: b5:e017bbf31a3f912e2b969c03c3aa711f466cfe104f510865d1a8ede1be490240aabd4cca5865459a0f15222747284395f98afc094b0fd086e8917a5a7bdd9db0
+  - name: buf.build/grpc-ecosystem/grpc-gateway
+    commit: 4c5ba75caaf84e928b7137ae5c18c26a
+    digest: b5:c113e62fb3b29289af785866cae062b55ec8ae19ab3f08f3004098928fbca657730a06810b2012951294326b95669547194fa84476b9e9b688d4f8bf77a0691d

buf.yaml

@@ -0,0 +1,27 @@
+version: v2
+modules:
+  - path: proto
+    name: buf.build/ory/keto
+    excludes:
+      - proto/node_modules
+deps:
+  - buf.build/bufbuild/protovalidate
+  - buf.build/googleapis/googleapis
+  - buf.build/grpc-ecosystem/grpc-gateway
+lint:
+  use:
+    - STANDARD
+  except:
+    - ENUM_NO_ALLOW_ALIAS
+    - ENUM_VALUE_PREFIX
+    - ENUM_VALUE_UPPER_SNAKE_CASE
+    - ENUM_ZERO_VALUE_SUFFIX
+    - FIELD_NOT_REQUIRED
+    - PACKAGE_NO_IMPORT_CYCLE
+  disallow_comment_ignores: true
+breaking:
+  use:
+    - FILE
+  except:
+    - EXTENSION_NO_DELETE
+    - FIELD_SAME_DEFAULT

cmd/check/root.go

@@ -7,18 +7,21 @@ import (
 	"fmt"
 	"strings"
 
+	"google.golang.org/grpc"
+
 	"github.com/ory/keto/ketoapi"
 	rts "github.com/ory/keto/proto/ory/keto/relation_tuples/v1alpha2"
 
-	"github.com/ory/keto/internal/check"
+	"github.com/spf13/cobra"
 
 	"github.com/ory/x/cmdx"
-	"github.com/spf13/cobra"
 
 	"github.com/ory/keto/cmd/client"
 )
 
-type checkOutput check.CheckPermissionResult
+type checkOutput struct {
+	Allowed bool `json:"allowed"`
+}
 
 func (o *checkOutput) String() string {
 	if o.Allowed {
@@ -40,7 +43,12 @@ func NewCheckCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			defer conn.Close()
+			defer func(conn *grpc.ClientConn) {
+				err := conn.Close()
+				if err != nil {
+					_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not close connection: %s\n", err)
+				}
+			}(conn)
 
 			maxDepth, err := cmd.Flags().GetInt32(FlagMaxDepth)
 			if err != nil {

cmd/expand/root.go

@@ -6,15 +6,18 @@ package expand
 import (
 	"fmt"
 
+	"google.golang.org/protobuf/encoding/protojson"
+
 	"github.com/ory/keto/ketoapi"
 
 	rts "github.com/ory/keto/proto/ory/keto/relation_tuples/v1alpha2"
 
 	"github.com/ory/x/flagx"
 
-	"github.com/ory/x/cmdx"
 	"github.com/spf13/cobra"
 
+	"github.com/ory/x/cmdx"
+
 	"github.com/ory/keto/cmd/client"
 )
 
@@ -31,7 +34,11 @@ func NewExpandCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			defer conn.Close()
+			defer func() {
+				if err := conn.Close(); err != nil {
+					_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Error closing connection: %v\n", err)
+				}
+			}()
 
 			maxDepth, err := cmd.Flags().GetInt32(FlagMaxDepth)
 			if err != nil {
@@ -53,7 +60,7 @@ func NewExpandCmd() *cobra.Command {
 				tree = ketoapi.TreeFromProto[*ketoapi.RelationTuple](resp.Tree)
 			}
 
-			cmdx.PrintJSONAble(cmd, tree)
+			cmdx.PrintJSONAble(cmd, &pbJSONValue{resp})
 			switch flagx.MustGetString(cmd, cmdx.FlagFormat) {
 			case string(cmdx.FormatDefault), "":
 				if tree == nil && !flagx.MustGetBool(cmd, cmdx.FlagQuiet) {
@@ -76,3 +83,20 @@ func NewExpandCmd() *cobra.Command {
 func RegisterCommandsRecursive(parent *cobra.Command) {
 	parent.AddCommand(NewExpandCmd())
 }
+
+type pbJSONValue struct{ *rts.ExpandResponse }
+
+func (v *pbJSONValue) MarshalJSON() ([]byte, error) {
+	marshaler := &protojson.MarshalOptions{EmitUnpopulated: true}
+	if v.Tree == nil || v.Tree.NodeType.Number() == 0 {
+		return []byte("null"), nil
+	}
+	return marshaler.Marshal(v.Tree)
+}
+func (v *pbJSONValue) String() string {
+	var tree *ketoapi.Tree[*ketoapi.RelationTuple]
+	if v.Tree != nil {
+		tree = ketoapi.TreeFromProto[*ketoapi.RelationTuple](v.Tree)
+	}
+	return tree.String()
+}