From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- vendor/security-framework/src/random.rs | 39 --------------------------------- 1 file changed, 39 deletions(-) delete mode 100644 vendor/security-framework/src/random.rs (limited to 'vendor/security-framework/src/random.rs') diff --git a/vendor/security-framework/src/random.rs b/vendor/security-framework/src/random.rs deleted file mode 100644 index 7bd7f614..00000000 --- a/vendor/security-framework/src/random.rs +++ /dev/null @@ -1,39 +0,0 @@ -//! Randomness support. - -use security_framework_sys::random::{SecRandomCopyBytes, SecRandomRef, kSecRandomDefault}; -use std::io; - -/// A source of random data. -pub struct SecRandom(SecRandomRef); - -unsafe impl Sync for SecRandom {} -unsafe impl Send for SecRandom {} - -impl Default for SecRandom { - #[inline(always)] - fn default() -> Self { - unsafe { Self(kSecRandomDefault) } - } -} - -impl SecRandom { - /// Fills the buffer with cryptographically secure random bytes. - pub fn copy_bytes(&self, buf: &mut [u8]) -> io::Result<()> { - if unsafe { SecRandomCopyBytes(self.0, buf.len(), buf.as_mut_ptr().cast()) } == 0 { - Ok(()) - } else { - Err(io::Error::last_os_error()) - } - } -} - -#[cfg(test)] -mod test { - use super::*; - - #[test] - fn basic() { - let mut buf = [0; 10]; - SecRandom::default().copy_bytes(&mut buf).unwrap(); - } -} -- cgit v1.2.3