snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

2026-09-16 01:08:34 +05:00
commit 9456a4e922
2560 changed files with 120911 additions and 0 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+*            @aeneasr @ory/product-development
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1,8 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/FUNDING.yml
+
+# These are supported funding model platforms
+
+# github:
+patreon: _ory
+open_collective: ory
--- a/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
+++ b/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
@@ -0,0 +1,122 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/ISSUE_TEMPLATE/BUG-REPORT.yml
+
+description: "Create a bug report"
+labels:
+  - bug
+name: "Bug Report"
+body:
+  - attributes:
+      value: "Thank you for taking the time to fill out this bug report!\n"
+    type: markdown
+  - attributes:
+      label: "Preflight checklist"
+      options:
+        - label:
+            "I could not find a solution in the existing issues, docs, nor
+            discussions."
+          required: true
+        - label:
+            "I agree to follow this project's [Code of
+            Conduct](https://github.com/ory/keto/blob/master/CODE_OF_CONDUCT.md)."
+          required: true
+        - label:
+            "I have read and am following this repository's [Contribution
+            Guidelines](https://github.com/ory/keto/blob/master/CONTRIBUTING.md)."
+          required: true
+        - label:
+            "I have joined the [Ory Community Slack](https://slack.ory.com)."
+        - label:
+            "I am signed up to the [Ory Security Patch
+            Newsletter](https://www.ory.com/l/sign-up-newsletter)."
+    id: checklist
+    type: checkboxes
+  - attributes:
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
+      label: "Ory Network Project"
+      placeholder: "https://<your-project-slug>.projects.oryapis.com"
+    id: ory-network-project
+    type: input
+  - attributes:
+      description: "A clear and concise description of what the bug is."
+      label: "Describe the bug"
+      placeholder: "Tell us what you see!"
+    id: describe-bug
+    type: textarea
+    validations:
+      required: true
+  - attributes:
+      description: |
+        Clear, formatted, and easy to follow steps to reproduce the behavior:
+      placeholder: |
+        Steps to reproduce the behavior:
+
+        1. Run `docker run ....`
+        2. Make API Request to with `curl ...`
+        3. Request fails with response: `{"some": "error"}`
+      label: "Reproducing the bug"
+    id: reproduce-bug
+    type: textarea
+    validations:
+      required: true
+  - attributes:
+      description:
+        "Please copy and paste any relevant log output. This will be
+        automatically formatted into code, so no need for backticks. Please
+        redact any sensitive information"
+      label: "Relevant log output"
+      render: shell
+      placeholder: |
+        log=error ....
+    id: logs
+    type: textarea
+  - attributes:
+      description:
+        "Please copy and paste any relevant configuration. This will be
+        automatically formatted into code, so no need for backticks. Please
+        redact any sensitive information!"
+      label: "Relevant configuration"
+      render: yml
+      placeholder: |
+        server:
+          admin:
+            port: 1234
+    id: config
+    type: textarea
+  - attributes:
+      description: "What version of our software are you running?"
+      label: Version
+    id: version
+    type: input
+    validations:
+      required: true
+  - attributes:
+      label: "On which operating system are you observing this issue?"
+      options:
+        - Ory Network
+        - macOS
+        - Linux
+        - Windows
+        - FreeBSD
+        - Other
+    id: operating-system
+    type: dropdown
+  - attributes:
+      label: "In which environment are you deploying?"
+      options:
+        - Ory Network
+        - Docker
+        - "Docker Compose"
+        - "Kubernetes with Helm"
+        - Kubernetes
+        - Binary
+        - Other
+    id: deployment
+    type: dropdown
+  - attributes:
+      description: "Add any other context about the problem here."
+      label: Additional Context
+    id: additional
+    type: textarea
--- a/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
+++ b/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
@@ -0,0 +1,125 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/ISSUE_TEMPLATE/DESIGN-DOC.yml
+
+description:
+  "A design document is needed for non-trivial changes to the code base."
+labels:
+  - rfc
+name: "Design Document"
+body:
+  - attributes:
+      value: |
+        Thank you for writing this design document. 
+
+        One of the key elements of Ory's software engineering culture is the use of defining software designs through design docs. These are relatively informal documents that the primary author or authors of a software system or application create before they embark on the coding project. The design doc documents the high level implementation strategy and key design decisions with emphasis on the trade-offs that were considered during those decisions.
+
+        Ory is leaning heavily on [Google's design docs process](https://www.industrialempathy.com/posts/design-docs-at-google/)
+        and [Golang Proposals](https://github.com/golang/proposal).
+
+        Writing a design doc before contributing your change ensures that your ideas are checked with
+        the community and maintainers. It will save you a lot of time developing things that might need to be changed
+        after code reviews, and your pull requests will be merged faster.
+    type: markdown
+  - attributes:
+      label: "Preflight checklist"
+      options:
+        - label:
+            "I could not find a solution in the existing issues, docs, nor
+            discussions."
+          required: true
+        - label:
+            "I agree to follow this project's [Code of
+            Conduct](https://github.com/ory/keto/blob/master/CODE_OF_CONDUCT.md)."
+          required: true
+        - label:
+            "I have read and am following this repository's [Contribution
+            Guidelines](https://github.com/ory/keto/blob/master/CONTRIBUTING.md)."
+          required: true
+        - label:
+            "I have joined the [Ory Community Slack](https://slack.ory.com)."
+        - label:
+            "I am signed up to the [Ory Security Patch
+            Newsletter](https://www.ory.com/l/sign-up-newsletter)."
+    id: checklist
+    type: checkboxes
+  - attributes:
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
+      label: "Ory Network Project"
+      placeholder: "https://<your-project-slug>.projects.oryapis.com"
+    id: ory-network-project
+    type: input
+  - attributes:
+      description: |
+        This section gives the reader a very rough overview of the landscape in which the new system is being built and what is actually being built. This isn’t a requirements doc. Keep it succinct! The goal is that readers are brought up to speed but some previous knowledge can be assumed and detailed info can be linked to. This section should be entirely focused on objective background facts.
+      label: "Context and scope"
+    id: scope
+    type: textarea
+    validations:
+      required: true
+
+  - attributes:
+      description: |
+        A short list of bullet points of what the goals of the system are, and, sometimes more importantly, what non-goals are. Note, that non-goals aren’t negated goals like “The system shouldn’t crash”, but rather things that could reasonably be goals, but are explicitly chosen not to be goals. A good example would be “ACID compliance”; when designing a database, you’d certainly want to know whether that is a goal or non-goal. And if it is a non-goal you might still select a solution that provides it, if it doesn’t introduce trade-offs that prevent achieving the goals.
+      label: "Goals and non-goals"
+    id: goals
+    type: textarea
+    validations:
+      required: true
+
+  - attributes:
+      description: |
+        This section should start with an overview and then go into details.
+        The design doc is the place to write down the trade-offs you made in designing your software. Focus on those trade-offs to produce a useful document with long-term value. That is, given the context (facts), goals and non-goals (requirements), the design doc is the place to suggest solutions and show why a particular solution best satisfies those goals.
+
+        The point of writing a document over a more formal medium is to provide the flexibility to express the problem at hand in an appropriate manner. Because of this, there is no explicit guidance on how to actually describe the design.
+      label: "The design"
+    id: design
+    type: textarea
+    validations:
+      required: true
+
+  - attributes:
+      description: |
+        If the system under design exposes an API, then sketching out that API is usually a good idea. In most cases, however, one should withstand the temptation to copy-paste formal interface or data definitions into the doc as these are often verbose, contain unnecessary detail and quickly get out of date. Instead, focus on the parts that are relevant to the design and its trade-offs.
+      label: "APIs"
+    id: apis
+    type: textarea
+
+  - attributes:
+      description: |
+        Systems that store data should likely discuss how and in what rough form this happens. Similar to the advice on APIs, and for the same reasons, copy-pasting complete schema definitions should be avoided. Instead, focus on the parts that are relevant to the design and its trade-offs.
+      label: "Data storage"
+    id: persistence
+    type: textarea
+
+  - attributes:
+      description: |
+        Design docs should rarely contain code, or pseudo-code except in situations where novel algorithms are described. As appropriate, link to prototypes that show the feasibility of the design.
+      label: "Code and pseudo-code"
+    id: pseudocode
+    type: textarea
+
+  - attributes:
+      description: |
+        One of the primary factors that would influence the shape of a software design and hence the design doc, is the degree of constraint of the solution space.
+
+        On one end of the extreme is the “greenfield software project”, where all we know are the goals, and the solution can be whatever makes the most sense. Such a document may be wide-ranging, but it also needs to quickly define a set of rules that allow zooming in on a manageable set of solutions.
+
+        On the other end are systems where the possible solutions are very well defined, but it isn't at all obvious how they could even be combined to achieve the goals. This may be a legacy system that is difficult to change and wasn't designed to do what you want it to do or a library design that needs to operate within the constraints of the host programming language.
+
+        In this situation, you may be able to enumerate all the things you can do relatively easily, but you need to creatively put those things together to achieve the goals. There may be multiple solutions, and none of them are great, and hence such a document should focus on selecting the best way given all identified trade-offs.
+      label: "Degree of constraint"
+    id: constrait
+    type: textarea
+
+  - attributes:
+      description: |
+        This section lists alternative designs that would have reasonably achieved similar outcomes. The focus should be on the trade-offs that each respective design makes and how those trade-offs led to the decision to select the design that is the primary topic of the document.
+
+        While it is fine to be succinct about a solution that ended up not being selected, this section is one of the most important ones as it shows very explicitly why the selected solution is the best given the project goals and how other solutions, that the reader may be wondering about, introduce trade-offs that are less desirable given the goals.
+
+      label: Alternatives considered
+    id: alternatives
+    type: textarea
--- a/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
+++ b/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
@@ -0,0 +1,86 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/ISSUE_TEMPLATE/FEATURE-REQUEST.yml
+
+description:
+  "Suggest an idea for this project without a plan for implementation"
+labels:
+  - feat
+name: "Feature Request"
+body:
+  - attributes:
+      value: |
+        Thank you for suggesting an idea for this project!
+
+        If you already have a plan to implement a feature or a change, please create a [design document](https://github.com/aeneasr/gh-template-test/issues/new?assignees=&labels=rfc&template=DESIGN-DOC.yml) instead if the change is non-trivial!
+    type: markdown
+  - attributes:
+      label: "Preflight checklist"
+      options:
+        - label:
+            "I could not find a solution in the existing issues, docs, nor
+            discussions."
+          required: true
+        - label:
+            "I agree to follow this project's [Code of
+            Conduct](https://github.com/ory/keto/blob/master/CODE_OF_CONDUCT.md)."
+          required: true
+        - label:
+            "I have read and am following this repository's [Contribution
+            Guidelines](https://github.com/ory/keto/blob/master/CONTRIBUTING.md)."
+          required: true
+        - label:
+            "I have joined the [Ory Community Slack](https://slack.ory.com)."
+        - label:
+            "I am signed up to the [Ory Security Patch
+            Newsletter](https://www.ory.com/l/sign-up-newsletter)."
+    id: checklist
+    type: checkboxes
+  - attributes:
+      description:
+        "Enter the slug or API URL of the affected Ory Network project. Leave
+        empty when you are self-hosting."
+      label: "Ory Network Project"
+      placeholder: "https://<your-project-slug>.projects.oryapis.com"
+    id: ory-network-project
+    type: input
+  - attributes:
+      description:
+        "Is your feature request related to a problem? Please describe."
+      label: "Describe your problem"
+      placeholder:
+        "A clear and concise description of what the problem is. Ex. I'm always
+        frustrated when [...]"
+    id: problem
+    type: textarea
+    validations:
+      required: true
+  - attributes:
+      description: |
+        Describe the solution you'd like
+      placeholder: |
+        A clear and concise description of what you want to happen.
+      label: "Describe your ideal solution"
+    id: solution
+    type: textarea
+    validations:
+      required: true
+  - attributes:
+      description: "Describe alternatives you've considered"
+      label: "Workarounds or alternatives"
+    id: alternatives
+    type: textarea
+    validations:
+      required: true
+  - attributes:
+      description: "What version of our software are you running?"
+      label: Version
+    id: version
+    type: input
+    validations:
+      required: true
+  - attributes:
+      description:
+        "Add any other context or screenshots about the feature request here."
+      label: Additional Context
+    id: additional
+    type: textarea
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,14 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/ISSUE_TEMPLATE/config.yml
+
+blank_issues_enabled: false
+contact_links:
+  - name: Ory Keto Forum
+    url: https://github.com/ory/keto/discussions
+    about:
+      Please ask and answer questions here, show your implementations and
+      discuss ideas.
+  - name: Ory Chat
+    url: https://www.ory.com/chat
+    about:
+      Hang out with other Ory community members to ask and answer questions.
--- a/.github/auto_assign.yml
+++ b/.github/auto_assign.yml
@@ -0,0 +1,16 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/auto_assign.yml
+
+# Set to true to add reviewers to pull requests
+addReviewers: true
+
+# Set to true to add assignees to pull requests
+addAssignees: true
+
+# A list of reviewers to be added to pull requests (GitHub user name)
+assignees:
+  - ory/maintainers
+
+# A number of reviewers added to the pull request
+# Set 0 to add all the reviewers (default: 0)
+numberOfReviewers: 0
--- a/.github/config.yml
+++ b/.github/config.yml
@@ -0,0 +1,6 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/config.yml
+
+todo:
+  keyword: "@todo"
+  label: todo
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "/gen/go"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "npm"
+    directory: "/gen/es"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "docker"
+    directory: "/.docker"
+    schedule:
+      interval: "daily"
--- a/.github/labels.json
+++ b/.github/labels.json
@@ -0,0 +1,12 @@
+[
+  {
+    "name": "dependencies",
+    "color": "0366d6",
+    "description": "Pull requests that update a dependency file"
+  },
+  {
+    "name": "docker",
+    "color": "21ceff",
+    "description": "Pull requests that update Docker code"
+  }
+]
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -0,0 +1,60 @@
+<!--
+Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request.
+
+This text will be included in the changelog. If applicable, include links to documentation or pieces of code.
+If your change includes breaking changes please add a code block documenting the breaking change:
+
+```
+BREAKING CHANGES: This patch changes the behavior of configuration item `foo` to do bar. To keep the existing
+behavior please do baz.
+```
+-->
+
+## Related issue(s)
+
+<!--
+If this pull request
+
+1. is a fix for a known bug, link the issue where the bug was reported in the format of `#1234`;
+2. is a fix for a previously unknown bug, explain the bug and how to reproduce it in this pull request;
+3. implements a new feature, link the issue containing the design document in the format of `#1234`;
+4. improves the documentation, no issue reference is required.
+
+Pull requests introducing new features, which do not have a design document linked are more likely to be rejected and take on average 2-8 weeks longer to
+get merged.
+
+You can discuss changes with maintainers either in the Github Discussions in this repository or
+join the [Ory Chat](https://www.ory.com/chat).
+-->
+
+## Checklist
+
+<!--
+Put an `x` in the boxes that apply. You can also fill these out after creating the PR.
+
+Please be aware that pull requests must have all boxes ticked in order to be merged.
+
+If you're unsure about any of them, don't hesitate to ask. We're here to help!
+-->
+
+- [ ] I have read the [contributing guidelines](../blob/master/CONTRIBUTING.md).
+- [ ] I have referenced an issue containing the design document if my change
+      introduces a new feature.
+- [ ] I am following the
+      [contributing code guidelines](../blob/master/CONTRIBUTING.md#contributing-code).
+- [ ] I have read the [security policy](../security/policy).
+- [ ] I confirm that this pull request does not address a security
+      vulnerability. If this pull request addresses a security vulnerability, I
+      confirm that I got the approval (please contact
+      [security@ory.com](mailto:security@ory.com)) from the maintainers to push
+      the changes.
+- [ ] I have added tests that prove my fix is effective or that my feature
+      works.
+- [ ] I have added or changed [the documentation](https://github.com/ory/docs).
+
+## Further Comments
+
+<!--
+If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
+you did and what alternatives you considered, etc...
+-->
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,242 @@
+name: CI
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - "*"
+  pull_request:
+  merge_group:
+
+# Cancel in-progress runs in current workflow.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Run lints and checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Update npm to a non-buggy version
+        run: sudo npm i -g npm@9.5.0
+      - name: Lint buf
+        run: make buf-lint
+      - run: go list -json > go.list
+      - name: Run nancy
+        uses: sonatype-nexus-community/nancy-github-action@395e2fb168f674f96502e5652103d112899ea369
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run golangci-lint
+        if: ${{ github.ref_type != 'tag' }}
+        uses: golangci/golangci-lint-action@v9
+        env:
+          GOGC: 100
+        with:
+          version: latest
+          args: --timeout 10m0s
+          only-new-issues: "true"
+      - name: Test documentation examples
+        run: make test-docs-samples
+      - name: Test OPL typelib
+        run: cd contrib/namespace-type-lib && npm ci && npm test
+
+  test:
+    name: Run tests
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_DB: keto
+          POSTGRES_PASSWORD: test
+          POSTGRES_USER: test
+        ports:
+          - 5432:5432
+      mysql:
+        image: mysql:9.6
+        env:
+          MYSQL_ROOT_PASSWORD: test
+        ports:
+          - 3306:3306
+    env:
+      TEST_DATABASE_POSTGRESQL: postgres://test:test@localhost:5432/keto?sslmode=disable
+      TEST_DATABASE_MYSQL: mysql://root:test@(localhost:3306)/mysql?parseTime=true&multiStatements=true
+      TEST_DATABASE_COCKROACHDB: cockroach://root@localhost:26257/defaultdb?sslmode=disable
+    steps:
+      - run: |
+          docker create --name cockroach -p 26257:26257 \
+            cockroachdb/cockroach:latest-v25.4 start-single-node --insecure
+          docker start cockroach
+        name: Start CockroachDB
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Test gen/go package
+        run: go -C gen/go test ./...
+      - name: Test Keto
+        run: |
+          go test -coverprofile coverage.txt  ./...
+          grep -v "ory/keto/internal/httpclient" coverage.txt > coverage_cleared.txt
+          mv coverage_cleared.txt coverage.txt
+      - run: |
+          go tool goveralls -service=github -coverprofile=coverage.txt
+        env:
+          COVERALLS_TOKEN: ${{ github.token }}
+
+  test-race:
+    name: Run race tests
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    steps:
+      - uses: ory/ci/checkout@master
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - run: |
+          go test -race -short ./...
+
+  docs-cli:
+    runs-on: ubuntu-latest
+    name: Build CLI docs
+    needs:
+      - test
+      - test-race
+      - validate
+    steps:
+      - uses: ory/ci/docs/cli-next@master
+        with:
+          token: ${{ secrets.ORY_BOT_PAT }}
+          output-dir: docs/keto/cli
+
+  release:
+    name: Generate release
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - test
+      - test-race
+      - validate
+    steps:
+      - uses: ory/ci/releaser@master
+        with:
+          token: ${{ secrets.ORY_BOT_PAT }}
+          goreleaser_key: ${{ secrets.GORELEASER_KEY }}
+          cosign_pwd: ${{ secrets.COSIGN_PWD }}
+          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+  newsletter-draft:
+    name: Draft newsletter
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - release
+    steps:
+      - uses: ory/ci/newsletter@master
+        with:
+          mailchimp_list_id: f605a41b53
+          mailchmip_segment_id: 6479489
+          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
+          draft: "true"
+          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
+
+  slack-approval-notification:
+    name: Pending approval Slack notification
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    needs:
+      - newsletter-draft
+    steps:
+      - uses: ory/ci/newsletter/slack-notify@master
+        with:
+          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+  newsletter-send:
+    name: Send newsletter
+    runs-on: ubuntu-latest
+    needs:
+      - newsletter-draft
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    environment: production
+    steps:
+      - uses: ory/ci/newsletter@master
+        with:
+          mailchimp_list_id: f605a41b53
+          mailchmip_segment_id: 6479489
+          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
+          draft: "false"
+          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
+
+  buf:
+    name: Run buf actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ory/ci/checkout@master
+        with:
+          path: current-repo
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: current-repo/go.mod
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+      - name: Lint and Build
+        run: |
+          make buf
+        working-directory: current-repo
+      - name: Format Docs (required because buf generates the proto docs)
+        run: |
+          make format
+        working-directory: current-repo
+      - name: Push build
+        run: |
+          git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --local user.name "ory-bot"
+          git add gen
+          git commit -a -m "autogen: build buf" && git push "https://${GITHUB_ACTOR}:${{ secrets.ORY_BOT_PAT }}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF#"refs/heads/"}" || true
+        working-directory: current-repo
+      - if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+        uses: ory/ci/checkout@master
+        with:
+          repository: ory/docs
+          path: docs
+          fetch-depth: 0
+          token: ${{ secrets.ORY_BOT_PAT }}
+      - if: ${{ github.ref_name == 'master' || github.ref_type == 'tag' }}
+        name: Push generated files to ory/docs
+        env:
+          GITHUB_TOKEN: ${{ secrets.ORY_BOT_PAT }}
+        run: |
+          echo "---
+          title: Protocol buffers API
+          ---
+
+          <!-- This file is generated. Please edit the .proto files instead to update the documentation -->" > "docs/docs/keto/reference/proto-api.mdx"
+          cat "current-repo/gen/doc/buf.md" >> "docs/docs/keto/reference/proto-api.mdx"
+          cd docs
+          if git diff --exit-code; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git config --local user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --local user.name "ory-bot"
+
+          git stash
+          git pull --rebase origin master
+          git stash apply
+          git add docs/keto/reference/proto-api.mdx
+          git commit -m "autogen: update Keto protobuf docs"
+          git push origin HEAD:master
+        shell: bash
--- a/.github/workflows/closed_references.yml
+++ b/.github/workflows/closed_references.yml
@@ -0,0 +1,30 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/workflows/closed_references.yml
+
+name: Closed Reference Notifier
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+    inputs:
+      issueLimit:
+        description: Max. number of issues to create
+        required: true
+        default: "5"
+
+jobs:
+  find_closed_references:
+    if: github.repository_owner == 'ory'
+    runs-on: ubuntu-latest
+    name: Find closed references
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+      - uses: ory/closed-reference-notifier@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          issueLabels: upstream,good first issue,help wanted
+          issueLimit: ${{ github.event.inputs.issueLimit || '5' }}
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,72 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master, legacy-0.5]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+  merge_group:
+  schedule:
+    - cron: "39 6 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["go", "javascript"]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
--- a/.github/workflows/conventional_commits.yml
+++ b/.github/workflows/conventional_commits.yml
@@ -0,0 +1,59 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/workflows/conventional_commits.yml
+
+name: Conventional commits
+
+# This GitHub CI Action enforces that pull request titles follow conventional commits.
+# More info at https://www.conventionalcommits.org.
+#
+# The Ory-wide defaults for commit titles and scopes are below.
+# Your repository can add/replace elements via a configuration file at the path below.
+# More info at https://github.com/ory/ci/blob/master/conventional_commit_config/README.md
+
+on:
+  pull_request_target:
+    types:
+      - edited
+      - opened
+      - ready_for_review
+      - reopened
+  # pull_request: # for debugging, uses config in local branch but supports only Pull Requests from this repo
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - id: config
+        uses: ory/ci/conventional_commit_config@master
+        with:
+          config_path: .github/conventional_commits.json
+          default_types: |
+            feat
+            fix
+            revert
+            docs
+            style
+            refactor
+            test
+            build
+            autogen
+            security
+            ci
+            chore
+          default_scopes: |
+            deps
+            docs
+          default_require_scope: false
+      - uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: ${{ steps.config.outputs.types }}
+          scopes: ${{ steps.config.outputs.scopes }}
+          requireScope: ${{ steps.config.outputs.requireScope }}
+          subjectPattern: ^(?![A-Z]).+$
+          subjectPatternError: |
+            The subject should start with a lowercase letter, yours is uppercase:
+            "{subject}"
--- a/.github/workflows/cve-scan.yaml
+++ b/.github/workflows/cve-scan.yaml
@@ -0,0 +1,114 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/server/.github/workflows/cve-scan.yaml
+
+name: Docker Image Scanners
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "master"
+    tags:
+      - "v*.*.*"
+  pull_request:
+    branches:
+      - "master"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scanners:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup Env
+        id: vars
+        shell: bash
+        run: |
+          # Store values in local variables
+          SHA_SHORT=$(git rev-parse --short HEAD)
+          REPO_NAME=${{ github.event.repository.name }}
+
+          IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}"
+
+          # Output values for debugging
+          echo "Values to be set:"
+          echo "SHA_SHORT:  ${SHA_SHORT}"
+          echo "REPO_NAME:  ${REPO_NAME}"
+          echo "IMAGE_NAME: ${IMAGE_NAME}"
+
+          # Set GitHub Environment variables
+          echo "SHA_SHORT=${SHA_SHORT}" >> "${GITHUB_ENV}"
+          echo "IMAGE_NAME=${IMAGE_NAME}" >> "${GITHUB_ENV}"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          driver: docker
+      - name: Build images
+        shell: bash
+        run: |
+          IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Anchore Scanner
+        uses: anchore/scan-action@v7
+        id: grype-scan
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          fail-build: true
+          severity-cutoff: high
+          add-cpes-if-none: true
+      - name: Inspect action SARIF report
+        shell: bash
+        if: ${{ always() }}
+        run: |
+          echo "::group::Anchore Scan Details"
+          jq '.runs[0].results' ${{ steps.grype-scan.outputs.sarif }}
+          echo "::endgroup::"
+      - name: Anchore upload scan SARIF report
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ${{ steps.grype-scan.outputs.sarif }}
+      - name: Kubescape scanner
+        uses: kubescape/github-action@main
+        id: kubescape
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          verbose: true
+          format: pretty-printer
+          # can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
+          severityThreshold: critical
+      - name: Dockle Linter
+        uses: erzz/dockle-action@v1
+        if: ${{ always() }}
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          exit-code: 42
+          failure-threshold: high
+      - name: Hadolint
+        uses: hadolint/hadolint-action@v3.3.0
+        id: hadolint
+        if: ${{ always() }}
+        with:
+          dockerfile: .docker/Dockerfile-build
+          verbose: true
+          format: "json"
+          failure-threshold: "error"
+      - name: View Hadolint results
+        if: ${{ always() }}
+        shell: bash
+        run: |
+          echo "::group::Hadolint Scan Details"
+          echo "${HADOLINT_RESULTS}" | jq '.'
+          echo "::endgroup::"
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -0,0 +1,22 @@
+name: Format
+
+on:
+  pull_request:
+  push:
+  merge_group:
+
+env:
+  CGO_ENABLED: "0"
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - run: make format
+      - name: Indicate formatting issues
+        run: git diff HEAD --exit-code --color
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -0,0 +1,25 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/workflows/labels.yml
+
+name: Synchronize Issue Labels
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+
+jobs:
+  milestone:
+    if: github.repository_owner == 'ory'
+    name: Synchronize Issue Labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Synchronize Issue Labels
+        uses: ory/label-sync-action@v0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          dry: false
+          forced: true
--- a/.github/workflows/milestone.yml
+++ b/.github/workflows/milestone.yml
@@ -0,0 +1,33 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/server/.github/workflows/milestone.yml
+
+name: Generate and Publish Milestone Document
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *"
+
+jobs:
+  milestone:
+    if: github.repository_owner == 'ory'
+    name: Generate and Publish Milestone Document
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          token: ${{ secrets.TOKEN_PRIVILEGED }}
+      - name: Milestone Documentation Generator
+        uses: ory/milestone-action@v0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          outputFile: docs/docs/milestones.md
+      - name: Commit Milestone Documentation
+        uses: EndBug/add-and-commit@v10.0.0
+        with:
+          message: "autogen(docs): update milestone document"
+          author_name: aeneasr
+          author_email: "3372410+aeneasr@users.noreply.github.com"
+        env:
+          GITHUB_TOKEN: ${{ secrets.TOKEN_PRIVILEGED }}
--- a/.github/workflows/npm_publish_grpc_client.yml
+++ b/.github/workflows/npm_publish_grpc_client.yml
@@ -0,0 +1,40 @@
+name: Publish gRPC client to npm
+
+on:
+  release:
+    types:
+      - created
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        description: The version to release
+
+jobs:
+  btp:
+    runs-on: ubuntu-latest
+    name: Publish
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+      - run: sudo npm i -g npm@7
+      - name: Bump version
+        run: |-
+          cd gen/es
+          jq '.version = (env.RELEASE_VERSION | sub("(^refs/tags/v)|(^v)"; ""))' package.json > package.json.tmp \
+             && mv package.json.tmp package.json
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.version || github.ref }}
+      - run: |-
+          git config --global user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --global user.name "ory-bot"
+          git add gen/es/package.json
+          git commit -m "autogen: bump node gRPC client version"
+      - run: |-
+          cd gen/es
+          npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_AENEASR }}
--- a/.github/workflows/npm_publish_typelib.yml
+++ b/.github/workflows/npm_publish_typelib.yml
@@ -0,0 +1,40 @@
+name: Publish OPL typelib to npm
+
+on:
+  release:
+    types:
+      - created
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        description: The version to release
+
+jobs:
+  btp:
+    runs-on: ubuntu-latest
+    name: Publish
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+      - run: sudo npm i -g npm@10
+      - name: Bump version
+        run: |-
+          cd contrib/namespace-type-lib
+          jq '.version = (env.RELEASE_VERSION | sub("(^refs/tags/v)|(^v)"; ""))' package.json > package.json.tmp \
+            && mv package.json.tmp package.json
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.version || github.ref }}
+      - run: |-
+          git config --global user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --global user.name "ory-bot"
+          git add contrib/namespace-type-lib/package.json
+          git commit -m "autogen: bump OPL typelib"
+      - run: |-
+          cd contrib/namespace-type-lib
+          npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_AENEASR }}
--- a/.github/workflows/pm.yml
+++ b/.github/workflows/pm.yml
@@ -0,0 +1,30 @@
+name: Synchronize with product board
+
+on:
+  issues:
+    types:
+      - opened
+  pull_request:
+    types:
+      - opened
+      - ready_for_review
+
+jobs:
+  automate:
+    if: github.event.pull_request.head.repo.fork == false
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: ory-corp/planning-automation-action@v0.2
+        with:
+          organization: ory-corp
+          project: 5
+          token: ${{ secrets.ORY_BOT_PAT }}
+          todoLabel: "Needs Triage"
+          statusName: Status
+          prStatusValue: "Needs Triage"
+          issueStatusValue: "Needs Triage"
+          includeEffort: "false"
+          monthlyMilestoneName: Roadmap Monthly
+          quarterlyMilestoneName: Roadmap
--- a/.github/workflows/release-go-grpc-client.yml
+++ b/.github/workflows/release-go-grpc-client.yml
@@ -0,0 +1,41 @@
+name: Release the go gRPC client as `gen/go/$VERSION`
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description:
+          The version to release. Should be a patch of the latest Keto release.
+        required: true
+  release:
+    types:
+      - created
+
+env:
+  CGO_ENABLED: "0"
+
+jobs:
+  tag:
+    #   this is set on dispatch        this should prevent the action from triggering itself
+    if: github.event.inputs.version || !startsWith(github.ref, 'gen/go/')
+    runs-on: ubuntu-latest
+    name: Publish
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Download dependencies
+        run: go -C gen/go mod tidy
+      - name: Test
+        run: go -C gen/go test ./...
+      - name: Create git tag
+        run: |
+          git config --global user.email "60093411+ory-bot@users.noreply.github.com"
+          git config --global user.name "ory-bot"
+          RELEASE_VERSION="$(sed 's#^refs/tags/##' <(echo "$RELEASE_REF"))"
+          git tag -a "gen/go/$RELEASE_VERSION" -m "Release $RELEASE_VERSION of the go gRPC Client. See CHANGELOG.md for more info."
+          git push origin "gen/go/$RELEASE_VERSION"
+        env:
+          RELEASE_REF: ${{ github.event.inputs.version || github.ref }}
--- a/.github/workflows/single-table-migration-e2e.yml
+++ b/.github/workflows/single-table-migration-e2e.yml
@@ -0,0 +1,30 @@
+name:
+  Run full e2e test of the migration to single table persister (see
+  https://github.com/ory/keto/issues/628)
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - feat/persistence-migration-path
+
+env:
+  CGO_ENABLED: "0"
+
+jobs:
+  test-migration:
+    runs-on: ubuntu-latest
+    name: Test Migration
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          check-latest: true
+          go-version-file: go.mod
+      - name: Run test script
+        run: ./scripts/single-table-migration-e2e.sh
+      - uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: sqlite-db
+          path: migrate_e2e.sqlite
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -0,0 +1,47 @@
+# AUTO-GENERATED, DO NOT EDIT!
+# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/common/.github/workflows/stale.yml
+
+name: "Close Stale Issues"
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *"
+
+jobs:
+  stale:
+    if: github.repository_owner == 'ory'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          stale-issue-message: |
+            Hello contributors!
+
+            I am marking this issue as stale as it has not received any engagement from the community or maintainers for a year. That does not imply that the issue has no merit! If you feel strongly about this issue
+
+            - open a PR referencing and resolving the issue;
+            - leave a comment on it and discuss ideas on how you could contribute towards resolving it;
+            - leave a comment and describe in detail why this issue is critical for your use case;
+            - open a new issue with updated details and a plan for resolving the issue.
+
+            Throughout its lifetime, Ory has received over 10.000 issues and PRs. To sustain that growth, we need to prioritize and focus on issues that are important to the community. A good indication of importance, and thus priority, is activity on a topic.
+
+            Unfortunately, [burnout](https://www.jeffgeerling.com/blog/2016/why-i-close-prs-oss-project-maintainer-notes) has become a [topic](https://opensource.guide/best-practices/#its-okay-to-hit-pause) of [concern](https://docs.brew.sh/Maintainers-Avoiding-Burnout) amongst open-source projects.
+
+            It can lead to severe personal and health issues as well as [opening](https://haacked.com/archive/2019/05/28/maintainer-burnout/) catastrophic [attack vectors](https://www.gradiant.org/en/blog/open-source-maintainer-burnout-as-an-attack-surface/).
+
+            The motivation for this automation is to help prioritize issues in the backlog and not ignore, reject, or belittle anyone.
+
+            If this issue was marked as stale erroneously you can exempt it by adding the `backlog` label, assigning someone, or setting a milestone for it.
+
+            Thank you for your understanding and to anyone who participated in the conversation! And as written above, please do participate in the conversation if this topic is important to you!
+
+            Thank you 🙏✌️
+          stale-issue-label: "stale"
+          exempt-issue-labels: "bug,blocking,docs,backlog"
+          days-before-stale: 365
+          days-before-close: 30
+          exempt-milestones: true
+          exempt-assignees: true
+          only-pr-labels: "stale"