feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

27 files changed, 0 insertions, 432 deletions

diff --git a/vendor/ref-cast/tests/compiletest.rs b/vendor/ref-cast/tests/compiletest.rs
deleted file mode 100644
index 23a6a065..00000000
--- a/vendor/ref-cast/tests/compiletest.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-#[rustversion::attr(not(nightly), ignore = "requires nightly")]
-#[cfg_attr(miri, ignore = "incompatible with miri")]
-#[test]
-fn ui() {
-    let t = trybuild::TestCases::new();
-    t.compile_fail("tests/ui/*.rs");
-}
diff --git a/vendor/ref-cast/tests/test_custom.rs b/vendor/ref-cast/tests/test_custom.rs
deleted file mode 100644
index 73d9bd69..00000000
--- a/vendor/ref-cast/tests/test_custom.rs
+++ /dev/null
@@ -1,18 +0,0 @@
-#[forbid(unsafe_code)]
-mod forbid_unsafe {
-    use ref_cast::{ref_cast_custom, RefCastCustom};
-
-    #[derive(RefCastCustom)]
-    #[repr(transparent)]
-    pub struct Custom(#[allow(dead_code)] str);
-
-    impl Custom {
-        #[ref_cast_custom]
-        pub fn new(s: &str) -> &Custom;
-    }
-}
-
-#[test]
-fn test_forbid_unsafe() {
-    forbid_unsafe::Custom::new("...");
-}
diff --git a/vendor/ref-cast/tests/test_trivial.rs b/vendor/ref-cast/tests/test_trivial.rs
deleted file mode 100644
index c5ec85ae..00000000
--- a/vendor/ref-cast/tests/test_trivial.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-#![allow(clippy::manual_non_exhaustive)]
-
-use ref_cast::RefCast;
-use std::marker::PhantomData;
-
-type Marker = PhantomData<str>;
-
-#[derive(RefCast)]
-#[repr(transparent)]
-pub struct ImplicitUnit {
-    pub value: usize,
-    _private: (),
-}
-
-#[derive(RefCast)]
-#[repr(transparent)]
-pub struct ImplicitPhantomData<T> {
-    pub value: T,
-    pub marker: PhantomData<T>,
-}
-
-#[derive(RefCast)]
-#[repr(transparent)]
-pub struct ExplicitTrivial {
-    pub value: usize,
-    #[trivial]
-    pub marker: Marker,
-}
-
-#[derive(RefCast)]
-#[repr(C)]
-pub struct Override<U, V> {
-    #[trivial]
-    pub first: PhantomData<U>,
-    pub second: PhantomData<V>,
-}
-
-#[derive(RefCast)]
-#[repr(transparent)]
-pub struct Unsized<'a> {
-    pub marker: PhantomData<&'a str>,
-    pub value: str,
-}
-
-#[test]
-fn test_trivial() {
-    ImplicitUnit::ref_cast(&0);
-    ImplicitPhantomData::ref_cast(&0);
-    ExplicitTrivial::ref_cast(&0);
-    Override::<u8, i8>::ref_cast(&PhantomData::<i8>);
-    Unsized::ref_cast("...");
-}
diff --git a/vendor/ref-cast/tests/ui/cross-crate.rs b/vendor/ref-cast/tests/ui/cross-crate.rs
deleted file mode 100644
index 7368b3d0..00000000
--- a/vendor/ref-cast/tests/ui/cross-crate.rs
+++ /dev/null
@@ -1,10 +0,0 @@
-use ref_cast::ref_cast_custom;
-use ref_cast_test_suite::Struct;
-
-#[ref_cast_custom]
-fn ref_cast(s: &str) -> &Struct;
-
-#[ref_cast_custom]
-fn ref_cast_mut(s: &mut str) -> &mut Struct;
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/cross-crate.stderr b/vendor/ref-cast/tests/ui/cross-crate.stderr
deleted file mode 100644
index 7de06292..00000000
--- a/vendor/ref-cast/tests/ui/cross-crate.stderr
+++ /dev/null
@@ -1,11 +0,0 @@
-error[E0639]: cannot create non-exhaustive struct using struct expression
- --> tests/ui/cross-crate.rs:5:32
-  |
-5 | fn ref_cast(s: &str) -> &Struct;
-  |                                ^
-
-error[E0639]: cannot create non-exhaustive struct using struct expression
- --> tests/ui/cross-crate.rs:8:44
-  |
-8 | fn ref_cast_mut(s: &mut str) -> &mut Struct;
-  |                                            ^
diff --git a/vendor/ref-cast/tests/ui/dst-before-trivial.rs b/vendor/ref-cast/tests/ui/dst-before-trivial.rs
deleted file mode 100644
index df294f54..00000000
--- a/vendor/ref-cast/tests/ui/dst-before-trivial.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-use ref_cast::RefCast;
-use std::marker::PhantomData;
-
-#[derive(RefCast)]
-#[repr(transparent)]
-struct Bytes<'arena> {
-    bytes: [u8],
-    #[trivial]
-    marker: PhantomData<&'arena ()>,
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/dst-before-trivial.stderr b/vendor/ref-cast/tests/ui/dst-before-trivial.stderr
deleted file mode 100644
index f5e8d4e9..00000000
--- a/vendor/ref-cast/tests/ui/dst-before-trivial.stderr
+++ /dev/null
@@ -1,17 +0,0 @@
-error[E0277]: the size for values of type `[u8]` cannot be known at compilation time
- --> tests/ui/dst-before-trivial.rs:7:12
-  |
-7 |     bytes: [u8],
-  |            ^^^^ doesn't have a size known at compile-time
-  |
-  = help: the trait `Sized` is not implemented for `[u8]`
-  = note: only the last field of a struct may have a dynamically sized type
-  = help: change the field's type to have a statically known size
-help: borrowed types always have a statically known size
-  |
-7 |     bytes: &[u8],
-  |            +
-help: the `Box` type always has a statically known size and allocates its contents in the heap
-  |
-7 |     bytes: Box<[u8]>,
-  |            ++++    +
diff --git a/vendor/ref-cast/tests/ui/extra-arg.rs b/vendor/ref-cast/tests/ui/extra-arg.rs
deleted file mode 100644
index a23eff2b..00000000
--- a/vendor/ref-cast/tests/ui/extra-arg.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-use ref_cast::{ref_cast_custom, RefCastCustom};
-
-#[derive(RefCastCustom)]
-#[repr(transparent)]
-pub struct Thing(String);
-
-impl Thing {
-    #[ref_cast_custom]
-    pub fn ref_cast(s: &String, wat: i32) -> &Self;
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/extra-arg.stderr b/vendor/ref-cast/tests/ui/extra-arg.stderr
deleted file mode 100644
index 4676d50d..00000000
--- a/vendor/ref-cast/tests/ui/extra-arg.stderr
+++ /dev/null
@@ -1,13 +0,0 @@
-error: ref_cast_custom function is required to have a single argument
- --> tests/ui/extra-arg.rs:9:33
-  |
-9 |     pub fn ref_cast(s: &String, wat: i32) -> &Self;
-  |                                 ^^^^^^^^
-
-error: associated function in `impl` without body
- --> tests/ui/extra-arg.rs:9:5
-  |
-9 |     pub fn ref_cast(s: &String, wat: i32) -> &Self;
-  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^-
-  |                                                   |
-  |                                                   help: provide a definition for the function: `{ <body> }`
diff --git a/vendor/ref-cast/tests/ui/function-body.rs b/vendor/ref-cast/tests/ui/function-body.rs
deleted file mode 100644
index 915044a8..00000000
--- a/vendor/ref-cast/tests/ui/function-body.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-use ref_cast::{ref_cast_custom, RefCastCustom};
-
-#[derive(RefCastCustom)]
-#[repr(transparent)]
-pub struct Thing(String);
-
-impl Thing {
-    #[ref_cast_custom]
-    pub fn ref_cast(s: &String) -> &Self {}
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/function-body.stderr b/vendor/ref-cast/tests/ui/function-body.stderr
deleted file mode 100644
index 3161d334..00000000
--- a/vendor/ref-cast/tests/ui/function-body.stderr
+++ /dev/null
@@ -1,13 +0,0 @@
-error: expected `;`
- --> tests/ui/function-body.rs:9:42
-  |
-9 |     pub fn ref_cast(s: &String) -> &Self {}
-  |                                          ^
-
-error[E0308]: mismatched types
- --> tests/ui/function-body.rs:9:36
-  |
-9 |     pub fn ref_cast(s: &String) -> &Self {}
-  |            --------                ^^^^^ expected `&Thing`, found `()`
-  |            |
-  |            implicitly returns `()` as its body has no tail or `return` expression
diff --git a/vendor/ref-cast/tests/ui/impl-trait.rs b/vendor/ref-cast/tests/ui/impl-trait.rs
deleted file mode 100644
index ee3777b4..00000000
--- a/vendor/ref-cast/tests/ui/impl-trait.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-use ref_cast::{ref_cast_custom, RefCastCustom};
-
-#[derive(RefCastCustom)]
-#[repr(transparent)]
-pub struct Thing(str);
-
-impl Thing {
-    #[ref_cast_custom]
-    pub fn ref_cast(s: impl AsRef<str>) -> &Self;
-
-    #[ref_cast_custom]
-    pub fn ref_cast2(s: &impl AsRef<str>) -> &Self;
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/impl-trait.stderr b/vendor/ref-cast/tests/ui/impl-trait.stderr
deleted file mode 100644
index e22076a6..00000000
--- a/vendor/ref-cast/tests/ui/impl-trait.stderr
+++ /dev/null
@@ -1,31 +0,0 @@
-error[E0106]: missing lifetime specifier
- --> tests/ui/impl-trait.rs:9:44
-  |
-9 |     pub fn ref_cast(s: impl AsRef<str>) -> &Self;
-  |                                            ^ expected named lifetime parameter
-  |
-  = help: this function's return type contains a borrowed value, but there is no value for it to be borrowed from
-help: consider using the `'static` lifetime, but this is uncommon unless you're returning a borrowed value from a `const` or a `static`
-  |
-9 |     pub fn ref_cast(s: impl AsRef<str>) -> &'static Self;
-  |                                             +++++++
-help: consider introducing a named lifetime parameter
-  |
-9 |     pub fn ref_cast<'a>(s: impl AsRef<str>) -> &'a Self;
-  |                    ++++                         ++
-
-error[E0562]: `impl Trait` is not allowed in paths
- --> tests/ui/impl-trait.rs:9:24
-  |
-9 |     pub fn ref_cast(s: impl AsRef<str>) -> &Self;
-  |                        ^^^^^^^^^^^^^^^
-  |
-  = note: `impl Trait` is only allowed in arguments and return types of functions and methods
-
-error[E0562]: `impl Trait` is not allowed in paths
-  --> tests/ui/impl-trait.rs:12:26
-   |
-12 |     pub fn ref_cast2(s: &impl AsRef<str>) -> &Self;
-   |                          ^^^^^^^^^^^^^^^
-   |
-   = note: `impl Trait` is only allowed in arguments and return types of functions and methods
diff --git a/vendor/ref-cast/tests/ui/no-custom.rs b/vendor/ref-cast/tests/ui/no-custom.rs
deleted file mode 100644
index 116b197c..00000000
--- a/vendor/ref-cast/tests/ui/no-custom.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-use ref_cast::ref_cast_custom;
-
-#[repr(transparent)]
-pub struct Thing(String);
-
-impl Thing {
-    #[ref_cast_custom]
-    pub fn ref_cast(s: &String) -> &Self;
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/no-custom.stderr b/vendor/ref-cast/tests/ui/no-custom.stderr
deleted file mode 100644
index 38269be3..00000000
--- a/vendor/ref-cast/tests/ui/no-custom.stderr
+++ /dev/null
@@ -1,35 +0,0 @@
-error[E0277]: the trait bound `&Thing: ref_cast::custom::RefCastOkay<&String>` is not satisfied
- --> tests/ui/no-custom.rs:8:36
-  |
-8 |     pub fn ref_cast(s: &String) -> &Self;
-  |                                    ^^^^^ the trait `RefCastCustom<String>` is not implemented for `Thing`
-  |
-  = help: the following other types implement trait `ref_cast::custom::RefCastOkay<From>`:
-            `&'a To` implements `ref_cast::custom::RefCastOkay<&'a From>`
-            `&'a mut To` implements `ref_cast::custom::RefCastOkay<&'a mut From>`
-  = note: required for `&Thing` to implement `ref_cast::custom::RefCastOkay<&String>`
-note: required by a bound in `ref_cast_custom`
- --> src/custom.rs
-  |
-  | pub fn ref_cast_custom<From, To>(_arg: From)
-  |        --------------- required by a bound in this function
-  | where
-  |     To: RefCastOkay<From>,
-  |         ^^^^^^^^^^^^^^^^^ required by this bound in `ref_cast_custom`
-
-error[E0071]: expected struct, variant or union type, found inferred type
- --> tests/ui/no-custom.rs:8:41
-  |
-8 |     pub fn ref_cast(s: &String) -> &Self;
-  |                                         ^ not a struct
-
-error[E0277]: the trait bound `Thing: RefCastCustom<String>` is not satisfied
- --> tests/ui/no-custom.rs:8:41
-  |
-8 |     pub fn ref_cast(s: &String) -> &Self;
-  |                                         ^ the trait `RefCastCustom<String>` is not implemented for `Thing`
-  |
-  = help: the following other types implement trait `ref_cast::custom::RefCastOkay<From>`:
-            `&'a To` implements `ref_cast::custom::RefCastOkay<&'a From>`
-            `&'a mut To` implements `ref_cast::custom::RefCastOkay<&'a mut From>`
-  = note: required for `&Thing` to implement `ref_cast::custom::RefCastOkay<&String>`
diff --git a/vendor/ref-cast/tests/ui/no-repr.rs b/vendor/ref-cast/tests/ui/no-repr.rs
deleted file mode 100644
index 65398da0..00000000
--- a/vendor/ref-cast/tests/ui/no-repr.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-use ref_cast::RefCast;
-
-#[derive(RefCast)]
-struct Test {
-    s: String,
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/no-repr.stderr b/vendor/ref-cast/tests/ui/no-repr.stderr
deleted file mode 100644
index 3fcc2d2e..00000000
--- a/vendor/ref-cast/tests/ui/no-repr.stderr
+++ /dev/null
@@ -1,7 +0,0 @@
-error: RefCast trait requires #[repr(transparent)]
- --> tests/ui/no-repr.rs:3:10
-  |
-3 | #[derive(RefCast)]
-  |          ^^^^^^^
-  |
-  = note: this error originates in the derive macro `RefCast` (in Nightly builds, run with -Z macro-backtrace for more info)
diff --git a/vendor/ref-cast/tests/ui/not-trivial.rs b/vendor/ref-cast/tests/ui/not-trivial.rs
deleted file mode 100644
index 292f282c..00000000
--- a/vendor/ref-cast/tests/ui/not-trivial.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-use ref_cast::RefCast;
-
-#[derive(RefCast)]
-#[repr(C)]
-struct Test {
-    one: String,
-    #[trivial]
-    two: String,
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/not-trivial.stderr b/vendor/ref-cast/tests/ui/not-trivial.stderr
deleted file mode 100644
index 9983cdc9..00000000
--- a/vendor/ref-cast/tests/ui/not-trivial.stderr
+++ /dev/null
@@ -1,15 +0,0 @@
-error[E0277]: the trait bound `String: ref_cast::trivial::Trivial` is not satisfied
- --> tests/ui/not-trivial.rs:8:10
-  |
-8 |     two: String,
-  |          ^^^^^^ the trait `ref_cast::trivial::Trivial` is not implemented for `String`
-  |
-  = help: the following other types implement trait `ref_cast::trivial::Trivial`:
-            ()
-            PhantomData<T>
-            PhantomPinned
-note: required by a bound in `assert_trivial`
- --> src/trivial.rs
-  |
-  | pub fn assert_trivial<T: Trivial>() {}
-  |                          ^^^^^^^ required by this bound in `assert_trivial`
diff --git a/vendor/ref-cast/tests/ui/private.rs b/vendor/ref-cast/tests/ui/private.rs
deleted file mode 100644
index 4c222a07..00000000
--- a/vendor/ref-cast/tests/ui/private.rs
+++ /dev/null
@@ -1,19 +0,0 @@
-use ref_cast::{ref_cast_custom, RefCast, RefCastCustom};
-
-#[derive(RefCast, RefCastCustom)]
-#[repr(transparent)]
-pub struct Public {
-    private: Private,
-}
-
-struct Private;
-
-impl Public {
-    #[ref_cast_custom]
-    fn ref_cast(private: &Private) -> &Public;
-
-    #[ref_cast_custom]
-    fn ref_cast_mut(private: &mut Private) -> &mut Public;
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/private.stderr b/vendor/ref-cast/tests/ui/private.stderr
deleted file mode 100644
index 732b31c5..00000000
--- a/vendor/ref-cast/tests/ui/private.stderr
+++ /dev/null
@@ -1,10 +0,0 @@
-error[E0446]: private type `Private` in public interface
- --> tests/ui/private.rs:3:10
-  |
-3 | #[derive(RefCast, RefCastCustom)]
-  |          ^^^^^^^ can't leak private type
-...
-9 | struct Private;
-  | -------------- `Private` declared as private
-  |
-  = note: this error originates in the derive macro `RefCast` (in Nightly builds, run with -Z macro-backtrace for more info)
diff --git a/vendor/ref-cast/tests/ui/repr-align.rs b/vendor/ref-cast/tests/ui/repr-align.rs
deleted file mode 100644
index 3b4ff4ae..00000000
--- a/vendor/ref-cast/tests/ui/repr-align.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-use ref_cast::RefCast;
-
-#[derive(RefCast)]
-#[repr(align(2), C, align = "2")]
-struct Test {
-    s: String,
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/repr-align.stderr b/vendor/ref-cast/tests/ui/repr-align.stderr
deleted file mode 100644
index 64e388a3..00000000
--- a/vendor/ref-cast/tests/ui/repr-align.stderr
+++ /dev/null
@@ -1,17 +0,0 @@
-error: aligned repr on struct that implements RefCast is not supported
- --> tests/ui/repr-align.rs:4:8
-  |
-4 | #[repr(align(2), C, align = "2")]
-  |        ^^^^^^^^
-
-error: aligned repr on struct that implements RefCast is not supported
- --> tests/ui/repr-align.rs:4:21
-  |
-4 | #[repr(align(2), C, align = "2")]
-  |                     ^^^^^^^^^^^
-
-error[E0693]: incorrect `repr(align)` attribute format
- --> tests/ui/repr-align.rs:4:21
-  |
-4 | #[repr(align(2), C, align = "2")]
-  |                     ^^^^^^^^^^^ help: use parentheses instead: `align(2)`
diff --git a/vendor/ref-cast/tests/ui/short-lifetime.rs b/vendor/ref-cast/tests/ui/short-lifetime.rs
deleted file mode 100644
index 83783c39..00000000
--- a/vendor/ref-cast/tests/ui/short-lifetime.rs
+++ /dev/null
@@ -1,12 +0,0 @@
-use ref_cast::{ref_cast_custom, RefCastCustom};
-
-#[derive(RefCastCustom)]
-#[repr(transparent)]
-pub struct Thing(String);
-
-impl Thing {
-    #[ref_cast_custom]
-    pub fn ref_cast<'a>(s: &String) -> &'a Self;
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/short-lifetime.stderr b/vendor/ref-cast/tests/ui/short-lifetime.stderr
deleted file mode 100644
index d3bfde1e..00000000
--- a/vendor/ref-cast/tests/ui/short-lifetime.stderr
+++ /dev/null
@@ -1,7 +0,0 @@
-error[E0621]: explicit lifetime required in the type of `s`
- --> tests/ui/short-lifetime.rs:9:48
-  |
-9 |     pub fn ref_cast<'a>(s: &String) -> &'a Self;
-  |                            -------             ^ lifetime `'a` required
-  |                            |
-  |                            help: add explicit lifetime `'a` to the type of `s`: `&'a String`
diff --git a/vendor/ref-cast/tests/ui/unrecognized-repr.rs b/vendor/ref-cast/tests/ui/unrecognized-repr.rs
deleted file mode 100644
index f74e0dc2..00000000
--- a/vendor/ref-cast/tests/ui/unrecognized-repr.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-use ref_cast::RefCast;
-
-#[derive(RefCast)]
-#[repr(packed, C, usize, usize(0), usize = "0")]
-struct Test {
-    s: String,
-}
-
-fn main() {}
diff --git a/vendor/ref-cast/tests/ui/unrecognized-repr.stderr b/vendor/ref-cast/tests/ui/unrecognized-repr.stderr
deleted file mode 100644
index ae5f2c15..00000000
--- a/vendor/ref-cast/tests/ui/unrecognized-repr.stderr
+++ /dev/null
@@ -1,39 +0,0 @@
-error: unrecognized repr on struct that implements RefCast
- --> tests/ui/unrecognized-repr.rs:4:19
-  |
-4 | #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                   ^^^^^
-
-error: unrecognized repr on struct that implements RefCast
- --> tests/ui/unrecognized-repr.rs:4:26
-  |
-4 | #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                          ^^^^^^^^
-
-error: unrecognized repr on struct that implements RefCast
- --> tests/ui/unrecognized-repr.rs:4:36
-  |
-4 | #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                                    ^^^^^^^^^^^
-
-error[E0552]: invalid representation hint: `usize` does not take a parenthesized argument list
- --> tests/ui/unrecognized-repr.rs:4:26
-  |
-4 | #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                          ^^^^^^^^
-
-error[E0552]: invalid representation hint: `usize` does not take a value
- --> tests/ui/unrecognized-repr.rs:4:36
-  |
-4 | #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                                    ^^^^^^^^^^^
-
-error[E0517]: attribute should be applied to an enum
- --> tests/ui/unrecognized-repr.rs:4:19
-  |
-4 |   #[repr(packed, C, usize, usize(0), usize = "0")]
-  |                     ^^^^^
-5 | / struct Test {
-6 | |     s: String,
-7 | | }
-  | |_- not an enum