From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- go.mod | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 go.mod (limited to 'go.mod') diff --git a/go.mod b/go.mod new file mode 100644 index 00000000..efc5a66d --- /dev/null +++ b/go.mod @@ -0,0 +1,46 @@ +module gitlab.com/gitlab-org/software-supply-chain-security/authorization/authzd.git + +go 1.24 + +require ( + github.com/authzed/authzed-go v1.4.1 + github.com/authzed/grpcutil v0.0.0-20240123194739-2ea1e3d2d98b + github.com/envoyproxy/go-control-plane/envoy v1.32.4 + github.com/rs/zerolog v1.34.0 + github.com/stretchr/testify v1.10.0 + github.com/xlgmokha/x v0.0.0-20250523153843-ded39aa54bc5 + google.golang.org/genproto/googleapis/rpc v0.0.0-20250715232539-7130f93afb79 + google.golang.org/grpc v1.74.0 +) + +require ( + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250613105001-9f2d3c737feb.1 // indirect + cloud.google.com/go/compute/metadata v0.7.0 // indirect + github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect + github.com/certifi/gocertifi v0.0.0-20210507211836-431795d63e8d // indirect + github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect + github.com/davecgh/go-spew v1.1.1 // indirect + github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect + github.com/google/go-cmp v0.7.0 // indirect + github.com/google/yamlfmt v0.17.2 // indirect + github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.0 // indirect + github.com/jzelinskie/stringz v0.0.3 // indirect + github.com/kr/text v0.2.0 // indirect + github.com/mattn/go-colorable v0.1.14 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mitchellh/mapstructure v1.5.0 // indirect + github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25 // indirect + github.com/pmezard/go-difflib v1.0.0 // indirect + github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect + github.com/samber/lo v1.51.0 // indirect + golang.org/x/net v0.42.0 // indirect + golang.org/x/sys v0.34.0 // indirect + golang.org/x/text v0.27.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect + google.golang.org/protobuf v1.36.6 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect +) + +tool github.com/google/yamlfmt/cmd/yamlfmt -- cgit v1.2.3