-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add RFCs for unique store and model names #27
Draft
aaguiarz
wants to merge
2
commits into
main
Choose a base branch
from
feat/store-uniqueness
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Draft
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
# Unique Model Names | ||
|
||
## Meta | ||
|
||
- **Name**: Unique Model Names | ||
- **Start Date**: 2024-10-25 | ||
- **Last Updated Date**: 2024-10-25 | ||
- **Author(s)**: [aaguiarz](https://github.com/aaguiarz) | ||
- **Status**: Draft | ||
- **PR Link**: | ||
- **Relevant Issues**: | ||
- **Supersedes**: N/A | ||
|
||
## Summary | ||
|
||
When [creating a model](https://openfga.dev/api/service#/Authorization%20Models/WriteAuthorizationModel), OpenFGA does not allow to provide a name,and it will return a unique id. | ||
|
||
This RFC proposes a way to specify a unique name when writing a model. | ||
|
||
## Motivation | ||
|
||
In some cases, developers would benefit from having an external identifier for the model. | ||
|
||
For example, when deploying applications in development/staging environments a new model needs to be created in each deployment, and it desirable to have a predictable identifier for the model. Given OpenFGA creates a different Model ID each time, it's not possible. It needs to be stored in a secret storage vault, and retrieved at runtime, which adds friction. Some OpenFGA developers, for example, keep a database table that has a Github commit hash and the equivalent Model ID. | ||
|
||
## Requirements | ||
|
||
- It should be possible to upgrade to OpenFGA version that implements this feature without downtime. | ||
- The OpenFGA [ReadAuthorizationModels endpoint](https://openfga.dev/api/service#/Authorization%20Models/ReadAuthorizationModels) endpoint should support filtering by name. | ||
- The model name should be unique per store, not unique per OpenFGA instance. | ||
|
||
## Proposed Solution | ||
|
||
- Add a `name` parameter to the (https://openfga.dev/api/service#/Authorization%20Models/WriteAuthorizationModel). | ||
- Validate that the name is unique. If a database constraint is used, a migration should be created that sets the Model Name = Model ID. | ||
- Add a `name` parameter to the [ReadAuthorizationModels endpoint](https://openfga.dev/api/service#/Authorization%20Models/ReadAuthorizationModels). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,38 @@ | ||||||
# Unique Store Names | ||||||
|
||||||
## Meta | ||||||
|
||||||
- **Name**: Unique Store Names | ||||||
- **Start Date**: 2024-10-25 | ||||||
- **Last Updated Date**: 2024-10-25 | ||||||
- **Author(s)**: [aaguiarz](https://github.com/aaguiarz) | ||||||
- **Status**: Draft | ||||||
- **PR Link**: | ||||||
- **Relevant Issues**: | ||||||
- **Supersedes**: N/A | ||||||
|
||||||
## Summary | ||||||
|
||||||
When [creating a store](https://openfga.dev/api/service#/Stores/CreateStore), OpenFGA allows providing a store name, and it will return a unique id. | ||||||
|
||||||
This RFC proposes a way to configure OpenFGA in a way that the store name can be unique. | ||||||
|
||||||
## Motivation | ||||||
|
||||||
In some cases, developers would benefit from having an external identifier for the store. Some examples are: | ||||||
|
||||||
- The application is architected to use one store per tenant, and they need to map the internal tenant ID to the store ID. | ||||||
|
||||||
- When deploying applications in development/staging environments a new store needs to be created in each deploy, and it desirable to have a predictable identifier for the store. Given OpenFGA creates a different Store ID each time, it's not possible. It needs to be stored in a secret storage vault, and retrieved at runtime, which adds friction | ||||||
|
||||||
## Requirements | ||||||
|
||||||
- Existing OpenFGA deployments that have duplicated names should still work. | ||||||
- OpenFGA [GetStores endpoint](https://openfga.dev/api/service#/Stores/GetStore) endpoint should support filtering by name. Given it's possible that there could be more than one store with the same name, it needs to return an array. If the store name is unique, it will return an array with a single element. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
|
||||||
## Proposed Solution | ||||||
|
||||||
- Add a configuration option to OpenFGA to enable unique store names. | ||||||
- Add a `name` parameter to the [GetStores endpoint](https://openfga.dev/api/service#/Stores/GetStore) that returns an array of stores. | ||||||
- Modify the storage adapters to validate that store names are unique when creating them. Given it is required to also support duplicated store names, we can't rely on database constraints. | ||||||
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A suggestion for improvement: consider using “version” instead of “name” for identifying authorization models. While stores benefit from having unique names tied to their domain, authorization models are better suited to identification through meaningful versions, such as 1.0.1 → 1.0.2 or Git commit hashes. The store already provides the domain context.