feat: premissions revamp by golanglemonade · Pull Request #2398 · theopenlane/core

golanglemonade · 2026-05-14T05:17:26Z

⚠️ Breaking Changes

This PR contains revamped changes to permissions constructs and requires data migration.

FGA Model - this switches to using a fga.mod file in order to break up permissions into more manageable files. These are grouped based on functionality (e.g. compliance, trust center, regsitry, etc.
All base crud permissions are now generated based on the ent schema and are located in fga/model/generated/crud.fga. This contains all the can_<action>_<object> permissions that are used for both API Token scopes as well as base sets of permissions
New roles.fga file that contains more defined role types, e.g. compliance_manager, policy_manager, risk_manager - this will allow for easier designation of roles to user. These can be added on top of organization roles. For example, a member can be given policy_manger role which will give them full access to manage all policies in the organization.
- This file uses special annotations to allow for easier management without duplication:
  - @inherit: This inherits all the same permissions as the specified roles, e.g. compliance_manager inherits the permissions given to can_manage_compliance, can_manage_policies, can_manage_registry, can_manage_risk
  - @crud: This specifies which objects the role provides crud access to
New Roles:
- Super Admin: Users with this role will have the same permissions as the owner with the exception of being able to delete the organization. Organizations can have 0->many super admins
- Auditor: This will be a mostly read-only role users can give to their auditor and in the future be able to specifiy what they have access to
Scoped API Tokens - The update will allow API Tokens to be scoped to specific objects + operations allowing for more fined grained access on the tokens. This deprecates the old can_view, can_edit, can_delete, group_manager scopes in favor of new scopes. THE UI NEEDS TO BE UPDATED TO ACCOMODATE THIS CHANGE
Adds new parent_context relation which replaces the parent relation for organization level checks for all objects with the exception of files. This requires a migration of parent relations for organization objects to parent_context. We cannot use contextual tuples because of parent hierarchy, e.g. this fails when you get to something like control_implementation where the access is based on the control and the control is based on the organization - we'd have to pass the full hierachy for this to work with the structure we have today.
Removes adding user tuples when objects are created; previously this meant if you changed roles your access wasn't removed for any objects you created. Now, it is based on the roles - so if you can manage policies, you can see the policy you created and do not need a user specific tuple.

Other Changes:

Logs email when checkAllowedEmailDomain fails so we know the user attempted to be added to the organization
Changes the entitlement reconciliation failed logs when a constraint error to an warn log so test logs aren't full of these errors but we still see the warning in production. All other errors are kept as error level logs.
Updates default org update logic to order by personal org desc so we don't set the default org to the personal org if there are other orgs available to the user
Adds helpers for creating a fresh org, cleaning up org after
Moves all tests that create fresh orgs and do not do river checks (most of the trust center tests) to use t.Parallel()

Deps:

Migration Guide
Depends on: feat: disable parent by default iam#508

theopenlane-bender · 2026-05-15T21:16:32Z

🔧 Configuration Changes Detected

This PR contains changes that will affect the Helm chart configuration. A draft infrastructure PR has been automatically created to preview these changes:

📋 Draft PR: https://github.com/theopenlane/openlane-infra/pull/928

Changes Preview:

✅ Updated ConfigMap template

🔄 Merged Helm values.yaml
🔐 External secrets configuration updated
✅ Updated ConfigMap template

The draft infrastructure PR will be closed automatically after this core PR is merged.

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

sonarqubecloud · 2026-05-20T19:14:52Z

Quality Gate failed

Failed conditions
13.3% Coverage on New Code (required ≥ 20%)

See analysis details on SonarQube Cloud

matoszz · 2026-05-21T20:50:12Z

+				_, scopesModified = m.AppendedScopes()
+			}
+
+			if scopesModified && m.Op().Is(ent.OpUpdateOne) {


the hook triggers on OpUpdate and OpUpdateOne but you only have logic for OpUpdateOne

matoszz · 2026-05-21T20:53:06Z

@@ -39,7 +37,9 @@ func HookObjectOwnedTuples(parents []string, ownerRelation string, skipCreateUse

 			var addTuples []fgax.TupleKey

-			if skip := skipCreateUserPermissions(ctx, m); !skip {


is something changing with the order of operations that allows us to safely remove this?

matoszz · 2026-05-21T20:55:08Z

+			).
+			Order(
+				// order by personal orgs last so that if there is another org available it will be set as the default instead of the personal org
+				organization.ByPersonalOrg(sql.OrderAsc()),


why would we need to perform ordering when the Where condition already precludes the previously set organization ID ?

matoszz · 2026-05-21T21:06:09Z

-		caller, ok := auth.CallerFromContext(ctx)
-		if !ok || caller == nil || caller.IsAnonymous() {
-			logx.FromContext(ctx).Info().Msg("unable to get caller from context")
+	caller, ok := auth.CallerFromContext(ctx)


it might be easier to do GetAuthzSubjectType or one of the other helpers here

matoszz · 2026-05-21T21:08:20Z

-	// allow member to invite members
-	if strings.EqualFold(role.String(), fgax.MemberRelation) {
+	switch strings.ToLower(role.String()) {
+	case strings.ToLower(fgax.MemberRelation):


the fgax constants are all already lower, no real reason to have strings.ToLower prefixing all these

matoszz · 2026-05-21T21:56:03Z

+		expected   string
+	}{
+		{name: "view query", objectType: "Control", relation: "can_view", expected: "can_view_control"},
+		{name: "update op", objectType: "Task", relation: "can_view", op: ent.OpUpdate, expected: "can_edit_task"},


update operation checks can_view but on OpUpdate and expected can edit?

matoszz · 2026-05-21T21:56:20Z

+		{name: "view query", objectType: "Control", relation: "can_view", expected: "can_view_control"},
+		{name: "update op", objectType: "Task", relation: "can_view", op: ent.OpUpdate, expected: "can_edit_task"},
+		{name: "edit relation", objectType: "Evidence", relation: "can_edit", expected: "can_edit_evidence"},
+		{name: "delete op", objectType: "File", relation: "can_edit", op: ent.OpDeleteOne, expected: "can_delete_file"},


shouldn't this be can_delete?

matoszz · 2026-05-21T21:57:11Z

+		return privacy.Allow
+	}
+
+	if auth.IsAPITokenAuthentication(ctx) {


isn't this duplicative of the check that's at the top of the function already?

matoszz · 2026-05-21T22:00:07Z

+
+// scopedRelation returns the scoped relation based on the object type, relation, and operation. A operation is checked for for create, update, delete. If instead a specific relation should be checked, that should be passed instead of the operation
+func scopedRelation(objectType string, relation string, op *ent.Op) string {
+	object := strcase.SnakeCase(objectType)


why manipulate the object type input like this?

matoszz · 2026-05-21T22:04:09Z

+func AllowIfTokenHasMutationScope() privacy.MutationRuleFunc {
+	return privacy.MutationRuleFunc(func(ctx context.Context, m ent.Mutation) error {
+		objectType := m.Type()
+		if objectType == "" {


is it possible for m.Type() to return empty?

github-actions Bot added enhancement New feature or request mixin dbschema graphqlschema migrations local-development cli authorization httpserve graphapi privacy common labels May 14, 2026

golanglemonade mentioned this pull request May 14, 2026

feat: organization tuples as contextual checks theopenlane/iam#462

Merged

github-actions Bot added the config label May 15, 2026

golanglemonade mentioned this pull request May 18, 2026

deps: iam update to keep current setup #2404

Closed

golanglemonade changed the title ~~Feat permsissions revamp~~ feat: premissions revamp May 19, 2026

github-actions Bot removed the migrations label May 19, 2026

golanglemonade added 3 commits May 19, 2026 00:07

feat: perm revamp

4421339

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

regen after rebase

2213868

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

cleanup

de58a11

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

golanglemonade force-pushed the feat-permsissions-revamp branch from b0b52b4 to de58a11 Compare May 19, 2026 15:58

golanglemonade added 4 commits May 19, 2026 10:05

remove can_create_email_branding

eac02ca

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

config generate, remove old model

0b50d6c

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

linter

0427d3c

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

some updates

8de1e95

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

github-actions Bot added the migrations label May 19, 2026

golanglemonade added 3 commits May 19, 2026 13:28

config:Gen

3651406

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

timeout

5dcbde6

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

cleanup, fix auditor role

7d0f141

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

golanglemonade added 2 commits May 20, 2026 12:45

db

29eee3e

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

linter

102e285

Signed-off-by: Sarah Funkhouser <147884153+golanglemonade@users.noreply.github.com>

golanglemonade marked this pull request as ready for review May 20, 2026 19:01

golanglemonade requested a review from a team as a code owner May 20, 2026 19:01

golanglemonade requested review from LemonAid711, adelowo and theopenlane-bender May 20, 2026 19:01

matoszz reviewed May 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: premissions revamp#2398

feat: premissions revamp#2398
golanglemonade wants to merge 12 commits into
mainfrom
feat-permsissions-revamp

golanglemonade commented May 14, 2026 •

edited

Loading

Uh oh!

theopenlane-bender commented May 15, 2026

Uh oh!

sonarqubecloud Bot commented May 20, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

matoszz May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -39,7 +37,9 @@ func HookObjectOwnedTuples(parents []string, ownerRelation string, skipCreateUse

		var addTuples []fgax.TupleKey

		if skip := skipCreateUserPermissions(ctx, m); !skip {

Conversation

golanglemonade commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

theopenlane-bender commented May 15, 2026

🔧 Configuration Changes Detected

Changes Preview:

Uh oh!

sonarqubecloud Bot commented May 20, 2026

Quality Gate failed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

golanglemonade commented May 14, 2026 •

edited

Loading