From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- etc/authzd/spice.schema | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'etc/authzd/spice.schema') diff --git a/etc/authzd/spice.schema b/etc/authzd/spice.schema index 0d6a6482..da408b80 100644 --- a/etc/authzd/spice.schema +++ b/etc/authzd/spice.schema @@ -1,7 +1,17 @@ definition user {} + definition project { relation developer: user relation maintainer: user + + permission read = developer + maintainer + permission write = maintainer +} + +definition group { + relation developer: user + relation maintainer: user + permission read = developer + maintainer permission write = maintainer } -- cgit v1.2.3