feat: admin API client and protocol selection (graphql/rest/grpc)#17
Merged
Conversation
- split fga.go into check_permissions.go / list_permissions.go to match the one-file-per-API layout - ListPermissions: relation/object_type now optional (empty request lists everything the caller holds); response adds permissions (object/relation detail) and truncated (1000-entry cap flag) - widen FGA-unavailable skip detection so integration tests skip cleanly against pre-FGA server images
Authorizer >= v2.3.0 rejects state-changing requests without an Origin/Referer header (CSRF guard), which 403'd every call from this server-side client. Default Origin to the server's own origin (always passes the guard's same-origin rule); callers can override it via ExtraHeaders or per-call headers for ALLOWED_ORIGINS allowlists. Also surface non-GraphQL failure responses (the guard's 403, proxy error pages) as errors — previously they produced a nil result with a nil error and panicked callers. Verified live against quay.io/authorizer/authorizer:2.3.0-rc.2: full suite passes (9 pass / 4 env skips); login, check_permissions and list_permissions all 403'd before this fix.
Add AuthorizerAdminClient over the AuthorizerAdminService surface (users, access, webhooks, email templates, audit, FGA admin) plus a Protocol option (graphql default, rest, grpc) on the user and admin clients, so the same calls run over GraphQL, REST, or gRPC. - gRPC uses a separate endpoint (default :9091), configurable via WithGRPCEndpoint; auth/admin-secret flow as outgoing metadata. - REST decodes proto JSON (int64-as-string) via protojson. - Responses use the flat rc.9 envelope (PR #635), identical across transports. - Vendor generated gRPC stubs under internal/genpb. - Integration tests sweep every method across supported protocols; add Test CI and an examples/manual smoke script.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
AuthorizerAdminClient) covering the fullAuthorizerAdminServicesurface: admin auth/session/meta, users, access (revoke/enable/invite), webhooks, email templates, audit logs, and FGA admin (model/tuples/list/expand/reset). Auth viax-authorizer-admin-secret.graphql(default, backward compatible),rest,grpc. The same method runs over any supported transport.Why
Server 2.3.0-rc.9 (#635) serves all auth ops over gRPC/REST with a flat response envelope identical to GraphQL, so the SDK can offer real protocol choice and a typed admin surface.
Notes
:9091); set viaWithGRPCEndpoint. Bearer/admin-secret are sent as outgoing metadata. Use--grpc-insecureserver-side for plaintext.protojson.internal/genpb(regenerated in the mainauthorizerrepo).examples/manualsmoke script.main; the admin/protocol work depends on the Origin fix.