From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- vendor/github.com/authzed/grpcutil/util.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 vendor/github.com/authzed/grpcutil/util.go (limited to 'vendor/github.com/authzed/grpcutil/util.go') diff --git a/vendor/github.com/authzed/grpcutil/util.go b/vendor/github.com/authzed/grpcutil/util.go new file mode 100644 index 00000000..65bb3bd5 --- /dev/null +++ b/vendor/github.com/authzed/grpcutil/util.go @@ -0,0 +1,18 @@ +package grpcutil + +import ( + "testing" + + "github.com/stretchr/testify/require" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" +) + +// RequireStatus asserts that an error is a gRPC error and returns the expected +// status code. +func RequireStatus(t *testing.T, expected codes.Code, err error) { + require.Error(t, err) + errStatus, ok := status.FromError(err) + require.True(t, ok) + require.Equal(t, expected, errStatus.Code()) +} -- cgit v1.2.3