Skip to content

Commit 011080b

Browse files
golanglemonadegolanglemonade
committed
openfga updates, cleanup, tuple cascade
Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>
1 parent c75f76c commit 011080b

13 files changed

Lines changed: 111 additions & 52 deletions

File tree

‎cli/go.mod‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ require (
2121
github.com/theopenlane/core/common v1.0.25
2222
github.com/theopenlane/go-client v0.13.0
2323
github.com/theopenlane/httpsling v0.3.0
24-
github.com/theopenlane/iam v0.35.7
24+
github.com/theopenlane/iam v0.35.8
2525
github.com/theopenlane/utils v0.7.1
2626
golang.org/x/oauth2 v0.36.0
2727
golang.org/x/term v0.45.0
@@ -37,7 +37,6 @@ require (
3737
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
3838
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
3939
github.com/fatih/color v1.19.0 // indirect
40-
github.com/felixge/httpsnoop v1.1.0 // indirect
4140
github.com/fsnotify/fsnotify v1.10.1 // indirect
4241
github.com/fumiama/go-docx v0.0.0-20250506085032-0c30fd09304b // indirect
4342
github.com/fumiama/imgsz v0.0.4 // indirect
@@ -76,7 +75,7 @@ require (
7675
github.com/olekukonko/tablewriter v1.1.4 // indirect
7776
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 // indirect
7877
github.com/openfga/go-sdk v0.8.2 // indirect
79-
github.com/openfga/language/pkg/go v0.3.1 // indirect
78+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70 // indirect
8079
github.com/philhofer/fwd v1.2.0 // indirect
8180
github.com/pkg/errors v0.9.1 // indirect
8281
github.com/redis/go-redis/v9 v9.21.0 // indirect

‎cli/go.sum‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,7 @@ github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 h1:xdVG0EDz9Z9Uh
151151
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20/go.mod h1:XDX4qYNBUM2Rsa2AbKPh+oocZc2zgme+EF2fFC6amVU=
152152
github.com/openfga/go-sdk v0.8.2 h1:eX2RJ7RD9sbxC4Oe8ZAFDZu6n/qYuO9SDrk7XAOE0Fg=
153153
github.com/openfga/go-sdk v0.8.2/go.mod h1:epiUE6IfG7Ezr3cYLepiUbCasChNowgP8AtJsN4HSpI=
154-
github.com/openfga/language/pkg/go v0.3.1 h1:o+m3s0aHyjjLH27wqu6/7vL6VWOL8sBqyrNXV87t/e8=
155-
github.com/openfga/language/pkg/go v0.3.1/go.mod h1:YVuB65nNynhIA5IT8AcBxuRGZYA/Wr8lI2PFyU+jMwA=
154+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70 h1:9RtXJ5iSKUnIFB+OduCFEY+TEDqpOKOJRZcD8LZB7Ng=
156155
github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
157156
github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
158157
github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
@@ -204,8 +203,7 @@ github.com/theopenlane/go-client v0.13.0 h1:/jSEZLu1urijrmM1skYo9kf0MsVJwe3DNpuy
204203
github.com/theopenlane/go-client v0.13.0/go.mod h1:g5i+gYjkih1SSgY/lFi4p302cLZBOJ8pgCFf02eZKaI=
205204
github.com/theopenlane/httpsling v0.3.0 h1:Bad0dGdqCqAB8UVDyVo+YCevzRvGHhmkK22F7T3pXtY=
206205
github.com/theopenlane/httpsling v0.3.0/go.mod h1:iJc3XRLYTFIpfCnPpLZVMBP0xsWIPAb7ozARtQoclAE=
207-
github.com/theopenlane/iam v0.35.7 h1:avxRd4HSzjoG056Kd7LcZ4qC7xPIsbEcJw80nHGOCBc=
208-
github.com/theopenlane/iam v0.35.7/go.mod h1:KqpLIxEhMsow3q2wGHFn7q7OH4JoN5GcBUrZpd3yVfk=
206+
github.com/theopenlane/iam v0.35.8 h1:tRkO96NUfG57fgyTWFZwpyzXiKf/1Av/jx5gjFZlXZg=
209207
github.com/theopenlane/utils v0.7.1 h1:x+9kVMgOALYqAH6GaLaDb9tj16nzasoGM8X0v0XNTn8=
210208
github.com/theopenlane/utils v0.7.1/go.mod h1:uxiLqjtcqgH57yOpYl3tTfKuenGYyAROxHFMpXx6mDY=
211209
github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=

‎common/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ require (
5454
github.com/muhlemmer/gu v0.3.1 // indirect
5555
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 // indirect
5656
github.com/openfga/go-sdk v0.8.2 // indirect
57-
github.com/openfga/language/pkg/go v0.3.1 // indirect
57+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70 // indirect
5858
github.com/philhofer/fwd v1.2.0 // indirect
5959
github.com/pkg/errors v0.9.1 // indirect
6060
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

‎common/go.sum‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,7 @@ github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 h1:xdVG0EDz9Z9Uh
105105
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20/go.mod h1:XDX4qYNBUM2Rsa2AbKPh+oocZc2zgme+EF2fFC6amVU=
106106
github.com/openfga/go-sdk v0.8.2 h1:eX2RJ7RD9sbxC4Oe8ZAFDZu6n/qYuO9SDrk7XAOE0Fg=
107107
github.com/openfga/go-sdk v0.8.2/go.mod h1:epiUE6IfG7Ezr3cYLepiUbCasChNowgP8AtJsN4HSpI=
108-
github.com/openfga/language/pkg/go v0.3.1 h1:o+m3s0aHyjjLH27wqu6/7vL6VWOL8sBqyrNXV87t/e8=
109-
github.com/openfga/language/pkg/go v0.3.1/go.mod h1:YVuB65nNynhIA5IT8AcBxuRGZYA/Wr8lI2PFyU+jMwA=
108+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70 h1:9RtXJ5iSKUnIFB+OduCFEY+TEDqpOKOJRZcD8LZB7Ng=
110109
github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
111110
github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
112111
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

‎docker/all-in-one/Dockerfile.all-in-one‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ COPY --from=ghcr.io/theopenlane/riverboat:amd64-latest /bin/riverboat /bin/river
2121
COPY --from=redis:7.4.9 /usr/local/bin/redis-server /bin/redis-server
2222

2323
# Copy FGA binary
24-
COPY --from=openfga/openfga:v1.18.1 /openfga /bin/openfga
24+
COPY --from=openfga/openfga:v1.18.3 /openfga /bin/openfga
2525

2626
# Copy default model into image
2727
COPY fga/model/ fga/model/
@@ -43,9 +43,6 @@ EXPOSE 8080
4343
EXPOSE 8081
4444
EXPOSE 2112
4545

46-
#Expose dbx ports
47-
EXPOSE 1337
48-
4946
# Expose redis ports
5047
EXPOSE 6379
5148

‎docker/docker-compose-fga.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ include:
22
- docker-compose-pg.yml
33
services:
44
migrate:
5-
image: openfga/openfga:v1.18.1
5+
image: openfga/openfga:v1.18.3
66
command: migrate
77
depends_on:
88
postgres:
@@ -16,7 +16,7 @@ services:
1616
depends_on:
1717
migrate:
1818
condition: service_completed_successfully
19-
image: openfga/openfga:v1.18.1
19+
image: openfga/openfga:v1.18.3
2020
environment:
2121
- OPENFGA_DATASTORE_ENGINE=postgres
2222
- OPENFGA_DATASTORE_URI=postgres://postgres:password@postgres:5432/openfga?sslmode=disable

‎go.mod‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ require (
8686
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
8787
github.com/pquerna/otp v1.5.0
8888
github.com/pressly/goose/v3 v3.27.3
89-
github.com/prometheus/client_golang v1.23.2
89+
github.com/prometheus/client_golang v1.24.0
9090
github.com/redis/go-redis/v9 v9.21.0
9191
github.com/riverqueue/river v0.43.0
9292
github.com/riverqueue/river/riverdriver/riverpgxv5 v0.43.0
@@ -108,7 +108,7 @@ require (
108108
github.com/theopenlane/go-client v0.13.0
109109
github.com/theopenlane/gqlgen-plugins v0.14.7
110110
github.com/theopenlane/httpsling v0.3.0
111-
github.com/theopenlane/iam v0.35.7
111+
github.com/theopenlane/iam v0.35.8
112112
github.com/theopenlane/newman v0.4.2
113113
github.com/theopenlane/riverboat v0.13.1
114114
github.com/theopenlane/utils v0.7.1
@@ -126,7 +126,7 @@ require (
126126
golang.org/x/sync v0.22.0
127127
golang.org/x/text v0.40.0
128128
golang.org/x/tools v0.48.0
129-
google.golang.org/api v0.290.0
129+
google.golang.org/api v0.291.0
130130
gopkg.in/yaml.v3 v3.0.1
131131
gotest.tools/v3 v3.5.2
132132
)
@@ -202,7 +202,7 @@ require (
202202
ariga.io/atlas v1.3.0
203203
cel.dev/expr v0.25.2 // indirect
204204
cloud.google.com/go v0.123.0 // indirect
205-
cloud.google.com/go/auth v0.20.0 // indirect
205+
cloud.google.com/go/auth v0.22.0 // indirect
206206
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
207207
cloud.google.com/go/compute/metadata v0.9.0 // indirect
208208
cloud.google.com/go/iam v1.11.0 // indirect
@@ -326,7 +326,7 @@ require (
326326
github.com/google/go-querystring v1.2.0 // indirect
327327
github.com/google/go-tpm v0.9.8 // indirect
328328
github.com/google/s2a-go v0.1.9 // indirect
329-
github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect
329+
github.com/googleapis/enterprise-certificate-proxy v0.3.19 // indirect
330330
github.com/googleapis/gax-go/v2 v2.23.0 // indirect
331331
github.com/gorilla/css v1.0.1 // indirect
332332
github.com/gorilla/securecookie v1.1.2 // indirect
@@ -360,12 +360,12 @@ require (
360360
github.com/opencontainers/image-spec v1.1.1 // indirect
361361
github.com/opencontainers/runc v1.3.6 // indirect
362362
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 // indirect
363-
github.com/openfga/language/pkg/go v0.3.1
364-
github.com/openfga/openfga v1.18.1 // indirect
363+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70
364+
github.com/openfga/openfga v1.18.3 // indirect
365365
github.com/ory/dockertest v3.3.5+incompatible // indirect
366366
github.com/pelletier/go-toml/v2 v2.3.1 // indirect
367367
github.com/prometheus/client_model v0.6.2 // indirect
368-
github.com/prometheus/common v0.67.5 // indirect
368+
github.com/prometheus/common v0.70.0 // indirect
369369
github.com/prometheus/procfs v0.21.1 // indirect
370370
github.com/resend/resend-go/v3 v3.10.1
371371
github.com/riverqueue/river/riverdriver v0.43.0 // indirect
@@ -401,7 +401,6 @@ require (
401401
go.opentelemetry.io/otel/trace v1.44.0 // indirect
402402
go.uber.org/goleak v1.3.0 // indirect
403403
go.uber.org/multierr v1.11.0 // indirect
404-
go.yaml.in/yaml/v2 v2.4.4 // indirect
405404
golang.org/x/exp v0.0.0-20260718201538-764159d718ef // indirect
406405
golang.org/x/net v0.57.0
407406
golang.org/x/sys v0.47.0 // indirect

‎go.sum‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
66
cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
77
cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
88
cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
9-
cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
10-
cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
9+
cloud.google.com/go/auth v0.22.0 h1:Xp9wAKkLoeaYb5pYZZoQGz4E9sdPxIbzS3gywZE3ciQ=
10+
cloud.google.com/go/auth v0.22.0/go.mod h1:M9o2Oz+YI2jAfxewJgb1vyI3vceHF+eohmxyzmrl+9s=
1111
cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
1212
cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
1313
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
@@ -335,8 +335,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
335335
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
336336
github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
337337
github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
338-
github.com/googleapis/enterprise-certificate-proxy v0.3.18 h1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k=
339-
github.com/googleapis/enterprise-certificate-proxy v0.3.18/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
338+
github.com/googleapis/enterprise-certificate-proxy v0.3.19 h1:mMOE7DN2+p76/EdIrmAy9B9bH+yC4563vmnJ34QR8i4=
339+
github.com/googleapis/enterprise-certificate-proxy v0.3.19/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
340340
github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
341341
github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
342342
github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -569,10 +569,10 @@ github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 h1:xdVG0EDz9Z9Uh
569569
github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20/go.mod h1:XDX4qYNBUM2Rsa2AbKPh+oocZc2zgme+EF2fFC6amVU=
570570
github.com/openfga/go-sdk v0.8.2 h1:eX2RJ7RD9sbxC4Oe8ZAFDZu6n/qYuO9SDrk7XAOE0Fg=
571571
github.com/openfga/go-sdk v0.8.2/go.mod h1:epiUE6IfG7Ezr3cYLepiUbCasChNowgP8AtJsN4HSpI=
572-
github.com/openfga/language/pkg/go v0.3.1 h1:o+m3s0aHyjjLH27wqu6/7vL6VWOL8sBqyrNXV87t/e8=
573-
github.com/openfga/language/pkg/go v0.3.1/go.mod h1:YVuB65nNynhIA5IT8AcBxuRGZYA/Wr8lI2PFyU+jMwA=
574-
github.com/openfga/openfga v1.18.1 h1:scfXscw1co45EJxPHSWQ9OXso+MnmkkGEdQ3+Y2P4mo=
575-
github.com/openfga/openfga v1.18.1/go.mod h1:se83OqKfGcb9Ddw/Bk85d2WE7PisFmDv/CeZQh3ZyIM=
572+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70 h1:9RtXJ5iSKUnIFB+OduCFEY+TEDqpOKOJRZcD8LZB7Ng=
573+
github.com/openfga/language/pkg/go v0.3.2-0.20260730144454-83fedf8a4e70/go.mod h1:HJr87kSwUb6NLfspULfl8IoQk6BcXjR+EvzyTnyp7II=
574+
github.com/openfga/openfga v1.18.3 h1:BJE8cdVjURq0YhFOh8OgeJ7OfzXGyiGgTAbpbmiZZ10=
575+
github.com/openfga/openfga v1.18.3/go.mod h1:Bxir9445ZY3SLPSh//uN3/+s/SsR+ejuWiYBFDUMnEE=
576576
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
577577
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
578578
github.com/ory/dockertest v3.3.5+incompatible h1:iLLK6SQwIhcbrG783Dghaaa3WPzGc+4Emza6EbVUUGA=
@@ -605,12 +605,12 @@ github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
605605
github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
606606
github.com/pressly/goose/v3 v3.27.3 h1:pIglVHjw99r4e/hDHHwbl9vfOsDMqUokfkXo6+n/RxA=
607607
github.com/pressly/goose/v3 v3.27.3/go.mod h1:Dag+xpV6o20HR2LFY1j0q6MDwc3f7vPUFDA77R+0yGY=
608-
github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
609-
github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
608+
github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
609+
github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
610610
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
611611
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
612-
github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
613-
github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
612+
github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
613+
github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
614614
github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
615615
github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
616616
github.com/q-uint/parser v0.3.1 h1:VCHob90UXy0L5oMgny5EjbDC2YeEGNc6qahWa8+tUhQ=
@@ -739,8 +739,8 @@ github.com/theopenlane/gqlgen-plugins v0.14.7 h1:B9I6tpgevch3xQfV3qqRTpxHIlJvwtX
739739
github.com/theopenlane/gqlgen-plugins v0.14.7/go.mod h1:fUjo1cVKEAPLhtRrH+iJtrfivCNp+GxVSB/UJgVBDuA=
740740
github.com/theopenlane/httpsling v0.3.0 h1:Bad0dGdqCqAB8UVDyVo+YCevzRvGHhmkK22F7T3pXtY=
741741
github.com/theopenlane/httpsling v0.3.0/go.mod h1:iJc3XRLYTFIpfCnPpLZVMBP0xsWIPAb7ozARtQoclAE=
742-
github.com/theopenlane/iam v0.35.7 h1:avxRd4HSzjoG056Kd7LcZ4qC7xPIsbEcJw80nHGOCBc=
743-
github.com/theopenlane/iam v0.35.7/go.mod h1:KqpLIxEhMsow3q2wGHFn7q7OH4JoN5GcBUrZpd3yVfk=
742+
github.com/theopenlane/iam v0.35.8 h1:tRkO96NUfG57fgyTWFZwpyzXiKf/1Av/jx5gjFZlXZg=
743+
github.com/theopenlane/iam v0.35.8/go.mod h1:Va0pIutagrlfFUdXOcxg4IRMAkdvGemcDJmOLwo7qKg=
744744
github.com/theopenlane/newman v0.4.2 h1:8hcZkPBZgPrROB9UXZSQv4xDUP7KDya2o8WfYokXCl0=
745745
github.com/theopenlane/newman v0.4.2/go.mod h1:tCDhl2yzEFNg387YdQK5ztgwgH0dYgDnTB8SPqPNRbY=
746746
github.com/theopenlane/oscalot v0.1.0 h1:ExYiMU4Q1ezbGq77sxkgahmfmc46L+2NqB39fg0HXjU=
@@ -908,8 +908,8 @@ golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhS
908908
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
909909
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
910910
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
911-
google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=
912-
google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
911+
google.golang.org/api v0.291.0 h1:wfPbbY+mr9c7wZLqqzrHJLft/q8iFKREd6IgTBUene0=
912+
google.golang.org/api v0.291.0/go.mod h1:at7kwWbuonglBFEBoeMDAV1bguHqL3qf0BHFsv3coa0=
913913
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
914914
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
915915
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a h1:97PfJ4tCxY5C7NzzgGqQEMZmXbISdvSArNNEOoUGKBg=

‎internal/ent/hooks/contextx/tuplecleanup.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package contextx
2+
3+
import "context"
4+
5+
// TupleCleanupKey is the context key used to force relationship tuple cleanup on delete
6+
type TupleCleanupKey string
7+
8+
const (
9+
// TupleCleanup is the context value that forces tuple cleanup even for internal requests
10+
TupleCleanup TupleCleanupKey = "cascade_delete_tuple_cleanup"
11+
)
12+
13+
// WithTupleCleanup returns a new context that forces the delete permissions hook to run even though
14+
// the request is an internal one. The organization cascade delete runs as an internal caller so it
15+
// can bypass privacy rules, but the records it removes still need their tuples cleaned out of FGA
16+
func WithTupleCleanup(ctx context.Context) context.Context {
17+
return context.WithValue(ctx, TupleCleanup, true)
18+
}
19+
20+
// TupleCleanupEnabled reports whether tuple cleanup should run despite an internal request
21+
func TupleCleanupEnabled(ctx context.Context) bool {
22+
cleanup, ok := ctx.Value(TupleCleanup).(bool)
23+
24+
return ok && cleanup
25+
}

‎internal/ent/hooks/listeners_organization_cleanup.go‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func handleOrganizationCascadeDelete(ctx gala.HandlerContext, payload eventqueue
4545
return nil
4646
}
4747

48-
cleanupCtx := entgen.NewContext(organizationCleanupContext(handlerCtx.Context), client)
48+
cleanupCtx := entgen.NewContext(organizationCleanupContext(handlerCtx.Context, orgID), client)
4949

5050
cleanupCtx = logx.WithFields(cleanupCtx, logx.LogFields{
5151
"organization_id": orgID,
@@ -81,11 +81,24 @@ func handleOrganizationCascadeDelete(ctx gala.HandlerContext, payload eventqueue
8181

8282
// organizationCleanupContext builds the context the cascade runs under, it bypasses privacy rules,
8383
// turns the cascaded deletes into hard deletes and opts the cascade into purging history rows
84-
func organizationCleanupContext(ctx context.Context) context.Context {
84+
func organizationCleanupContext(ctx context.Context, orgID string) context.Context {
8585
allowCtx := privacy.DecisionContext(ctx, privacy.Allow)
86-
allowCtx = auth.WithCaller(allowCtx, auth.NewWebhookCaller(""))
86+
allowCtx = auth.WithCaller(allowCtx, newOrganizationCleanupCaller(orgID))
8787

8888
allowCtx = entx.SkipSoftDelete(allowCtx)
8989

90+
// explicitly cleanup tuples for every record
91+
allowCtx = contextx.WithTupleCleanup(allowCtx)
92+
9093
return contextx.WithPurgeHistory(allowCtx)
9194
}
95+
96+
// newOrganizationCleanupCaller returns the caller the cascade runs as. It needs to reach every
97+
// record the organization owns regardless of who is deleting it, so it bypasses the organization
98+
// filter and FGA checks and identifies itself as an internal operation
99+
func newOrganizationCleanupCaller(orgID string) *auth.Caller {
100+
return &auth.Caller{
101+
OrganizationID: orgID,
102+
Capabilities: auth.CapBypassOrgFilter | auth.CapBypassFGA | auth.CapInternalOperation,
103+
}
104+
}

0 commit comments

Comments
 (0)