snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

cmd/namespace/.snapshots/TestGenerateOPLConfig-case=empty.json

@@ -0,0 +1 @@
+"import { Namespace, SubjectSet, Context } from '@ory/keto-namespace-types'\n\n// Declare new namespaces as classes that implement `Namespace`"

cmd/namespace/.snapshots/TestGenerateOPLConfig-case=many.json

@@ -0,0 +1 @@
+"import { Namespace, SubjectSet, Context } from '@ory/keto-namespace-types'\n\n// Declare new namespaces as classes that implement `Namespace`\nclass one implements Namespace {\n  related: {\n    // Define relations to other objects here.\n    // Examples:\n    //\n    // parents: (File | Folder)[]\n    // viewers: SubjectSet\u003cGroup, \"members\"\u003e[]\n  }\n\n  permits = {\n    // Define permissions here. These can be derived from the relations above.\n    // Examples:\n    //\n    // view: (ctx: Context): boolean =\u003e\n    //  this.related.viewers.includes(ctx.subject) ||\n    //  this.related.parents.traverse((p) =\u003e p.permits.view(ctx)),\n  }\n}\n\nclass two implements Namespace {\n  related: {\n    // Define relations to other objects here.\n    // Examples:\n    //\n    // parents: (File | Folder)[]\n    // viewers: SubjectSet\u003cGroup, \"members\"\u003e[]\n  }\n\n  permits = {\n    // Define permissions here. These can be derived from the relations above.\n    // Examples:\n    //\n    // view: (ctx: Context): boolean =\u003e\n    //  this.related.viewers.includes(ctx.subject) ||\n    //  this.related.parents.traverse((p) =\u003e p.permits.view(ctx)),\n  }\n}\n\nclass three implements Namespace {\n  related: {\n    // Define relations to other objects here.\n    // Examples:\n    //\n    // parents: (File | Folder)[]\n    // viewers: SubjectSet\u003cGroup, \"members\"\u003e[]\n  }\n\n  permits = {\n    // Define permissions here. These can be derived from the relations above.\n    // Examples:\n    //\n    // view: (ctx: Context): boolean =\u003e\n    //  this.related.viewers.includes(ctx.subject) ||\n    //  this.related.parents.traverse((p) =\u003e p.permits.view(ctx)),\n  }\n}\n"

cmd/namespace/.snapshots/TestGenerateOPLConfig-case=one.json

@@ -0,0 +1 @@
+"import { Namespace, SubjectSet, Context } from '@ory/keto-namespace-types'\n\n// Declare new namespaces as classes that implement `Namespace`\nclass one implements Namespace {\n  related: {\n    // Define relations to other objects here.\n    // Examples:\n    //\n    // parents: (File | Folder)[]\n    // viewers: SubjectSet\u003cGroup, \"members\"\u003e[]\n  }\n\n  permits = {\n    // Define permissions here. These can be derived from the relations above.\n    // Examples:\n    //\n    // view: (ctx: Context): boolean =\u003e\n    //  this.related.viewers.includes(ctx.subject) ||\n    //  this.related.parents.traverse((p) =\u003e p.permits.view(ctx)),\n  }\n}\n"

cmd/namespace/config_template/namespaces.ts.tmpl

@@ -0,0 +1,22 @@
+import { Namespace, SubjectSet, Context } from '@ory/keto-namespace-types'
+
+// Declare new namespaces as classes that implement `Namespace`{{ range .Namespaces }}
+class {{ . }} implements Namespace {
+  related: {
+    // Define relations to other objects here.
+    // Examples:
+    //
+    // parents: (File | Folder)[]
+    // viewers: SubjectSet<Group, "members">[]
+  }
+
+  permits = {
+    // Define permissions here. These can be derived from the relations above.
+    // Examples:
+    //
+    // view: (ctx: Context): boolean =>
+    //  this.related.viewers.includes(ctx.subject) ||
+    //  this.related.parents.traverse((p) => p.permits.view(ctx)),
+  }
+}
+{{ end }}

cmd/namespace/opl_generate.go

@@ -0,0 +1,28 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace
+
+import (
+	"embed"
+	"io"
+	"text/template"
+
+	"github.com/pkg/errors"
+)
+
+//go:embed config_template/*
+var configTemplate embed.FS
+
+// GenerateOPLConfig derives an Ory Permission Language config from the
+// namespaces and writes it to out. The OPL config is functionally equivalent to
+// the list of namespaces.
+func GenerateOPLConfig(namespaces []string, out io.Writer) error {
+	t, err := template.New("config_template").ParseFS(configTemplate, "config_template/*")
+	if err != nil {
+		return errors.WithStack(err)
+	}
+	return errors.WithStack(t.ExecuteTemplate(out,
+		"namespaces.ts.tmpl",
+		struct{ Namespaces []string }{Namespaces: namespaces}))
+}

cmd/namespace/opl_generate_test.go

@@ -0,0 +1,38 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/ory/x/snapshotx"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/keto/cmd/namespace"
+)
+
+func TestGenerateOPLConfig(t *testing.T) {
+	cases := []struct {
+		name       string
+		namespaces []string
+	}{{
+		name:       "empty",
+		namespaces: []string{},
+	}, {
+		name:       "one",
+		namespaces: []string{"one"},
+	}, {
+		name:       "many",
+		namespaces: []string{"one", "two", "three"},
+	}}
+
+	for _, tc := range cases {
+		t.Run("case="+tc.name, func(t *testing.T) {
+			var out bytes.Buffer
+			require.NoError(t, namespace.GenerateOPLConfig(tc.namespaces, &out))
+			snapshotx.SnapshotT(t, out.String())
+		})
+	}
+}

cmd/namespace/root.go

@@ -0,0 +1,24 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/ory/keto/ketoctx"
+)
+
+func NewNamespaceCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "namespace",
+		Short: "Read and manipulate namespaces",
+	}
+}
+
+func RegisterCommandsRecursive(parent *cobra.Command, _ []ketoctx.Option) {
+	rootCmd := NewNamespaceCmd()
+	rootCmd.AddCommand(NewValidateCmd())
+
+	parent.AddCommand(rootCmd)
+}

cmd/namespace/validate.go

@@ -0,0 +1,206 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/segmentio/objconv/yaml"
+	"github.com/spf13/cobra"
+
+	"github.com/ory/jsonschema/v3"
+	"github.com/ory/x/cmdx"
+	"github.com/ory/x/configx"
+	"github.com/ory/x/jsonschemax"
+	"github.com/ory/x/logrusx"
+
+	"github.com/ory/keto/embedx"
+	"github.com/ory/keto/internal/driver/config"
+	"github.com/ory/keto/internal/namespace"
+)
+
+func NewValidateCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Deprecated: "The legacy namespaces are deprecated. Please use the new Ory Permission Language instead.",
+		Aliases:    []string{"validate"},
+		Use:        "validate-legacy <namespace.yml> [<namespace2.yml> ...] | validate -c <config.yaml>",
+		Short:      "Validate legacy namespace definitions",
+		Long: `validate-legacy
+Validates namespace definitions. Parses namespace yaml files or configuration
+files passed via the configuration flag. Returns human readable errors. Useful for
+debugging.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cfFlag := cmd.Flag(configx.FlagConfig)
+			if cfFlag.Changed {
+				cfiles, err := cmd.Flags().GetStringSlice(configx.FlagConfig)
+				if err != nil {
+					_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Failed to read config command line flag\n%+v\n", err)
+					return cmdx.FailSilently(cmd)
+				}
+				for _, fn := range cfiles {
+					err := validateConfigFile(cmd, fn)
+					if err != nil {
+						return err
+					}
+				}
+			}
+
+			// user passed a list of namespace files
+			for _, fn := range args {
+				_, err := validateNamespaceFile(cmd, fn)
+				if err != nil {
+					return err
+				}
+			}
+
+			_, _ = fmt.Fprintln(cmd.OutOrStdout(), "Congrats, all files are valid!")
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+var configSchema *jsonschema.Schema
+
+const schemaPath = "github.com/ory/keto/.schema/config.schema.json"
+
+func getSchema(cmd *cobra.Command) (*jsonschema.Schema, error) {
+	if configSchema == nil {
+		c := jsonschema.NewCompiler()
+		if err := c.AddResource(schemaPath, bytes.NewBuffer(embedx.ConfigSchema)); err != nil {
+			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not add the config schema file to the compiler. This is an internal error that should be reported. Thanks ;)\n%+v\n", err)
+			return nil, cmdx.FailSilently(cmd)
+		}
+
+		var err error
+		configSchema, err = c.Compile(cmd.Context(), schemaPath+"#/definitions/namespace")
+		if err != nil {
+			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not compile the config schema file. This is an internal error that should be reported. Thanks ;)\n%+v\n", err)
+			return nil, cmdx.FailSilently(cmd)
+		}
+	}
+	return configSchema, nil
+}
+
+func validateNamespaceFile(cmd *cobra.Command, fn string) (*namespace.Namespace, error) {
+	cleanName := filepath.Clean(fn)
+	fc, err := os.ReadFile(cleanName)
+	if err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not read file %q: %+v\n", fn, err)
+		return nil, cmdx.FailSilently(cmd)
+	}
+
+	parse, err := config.GetParser(cleanName)
+	if err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Unable to infer file type from %q: %+v\n", fn, err)
+		return nil, cmdx.FailSilently(cmd)
+	}
+
+	return validateNamespaceBytes(cmd, cleanName, fc, parse)
+}
+
+func validateNamespaceBytes(cmd *cobra.Command, name string, b []byte, parser config.Parser) (*namespace.Namespace, error) {
+	schema, err := getSchema(cmd)
+	if err != nil {
+		return nil, err
+	}
+
+	var val map[string]any
+	if err := parser(b, &val); err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Encountered unmarshal error for %q: %+v\n", name, err)
+		return nil, cmdx.FailSilently(cmd)
+	}
+
+	if err := schema.ValidateInterface(val); err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "File %s was not a valid namespace file. Reasons:\n", name)
+		jsonschemax.FormatValidationErrorForCLI(cmd.ErrOrStderr(), embedx.ConfigSchema, err)
+		return nil, cmdx.FailSilently(cmd)
+	}
+
+	var n namespace.Namespace
+	if err := parser(b, &n); err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Encountered unmarshal error for %q: %+v\n", name, err)
+		return nil, cmdx.FailSilently(cmd)
+	}
+
+	return &n, nil
+}
+
+func validateConfigFile(cmd *cobra.Command, fn string) error {
+	cleanName := filepath.Clean(fn)
+	fc, err := os.ReadFile(cleanName)
+	if err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not read file %q: %+v\n", fn, err)
+		return cmdx.FailSilently(cmd)
+	}
+
+	parse, err := config.GetParser(cleanName)
+	if err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Unable to infer file type from %q: %+v\n", fn, err)
+		return cmdx.FailSilently(cmd)
+	}
+
+	var val map[string]any
+	if err := parse(fc, &val); err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Encountered parse error for %q: %+v\n", fn, err)
+		return cmdx.FailSilently(cmd)
+	}
+
+	if ns, ok := val["namespaces"]; ok {
+		// ns can either be a file url or a list of namespace objects
+		switch t := ns.(type) {
+		case string:
+			logger := logrusx.New("cmd", "0")
+			cw, err := config.NewNamespaceWatcher(cmd.Context(), logger, t)
+			if err != nil {
+				_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Encountered error reading config: %+v\n", err)
+				return cmdx.FailSilently(cmd)
+			}
+
+			files := cw.NamespaceFiles()
+			for _, file := range files {
+				_, err := validateNamespaceBytes(cmd, file.Name, file.Contents, file.Parser)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		case []any:
+			for i, obj := range t {
+				fc, err := yaml.Marshal(obj)
+				if err != nil {
+					_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Internal error. Failed to marshal yaml %+v\n", err)
+					return cmdx.FailSilently(cmd)
+				}
+				_, err = validateNamespaceBytes(cmd, fmt.Sprintf("index: %d", i), fc, yaml.Unmarshal)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		case []map[string]any:
+			for i, obj := range t {
+				fc, err := yaml.Marshal(obj)
+				if err != nil {
+					_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Internal error. Failed to marshal yaml %+v\n", err)
+					return cmdx.FailSilently(cmd)
+				}
+				_, err = validateNamespaceBytes(cmd, fmt.Sprintf("index: %d", i), fc, yaml.Unmarshal)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		default:
+			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "unknown type %T for key 'namespaces' in config file: %v\n", t, t)
+			return cmdx.FailSilently(cmd)
+		}
+	} else {
+		return nil
+	}
+}

cmd/namespace/validate_test.go

@@ -0,0 +1,158 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package namespace
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/ory/x/cmdx"
+	"github.com/ory/x/configx"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const fileMode = 0644
+
+const (
+	configEmbeddedYaml = `
+dsn: memory
+namespaces:
+  - name: testns0
+    id: 0
+  - name: testns1
+    id: 1
+`
+
+	configEmbeddedJson = `{"dsn":"memory","namespaces":[{"name":"testns0","id":0}]}`
+
+	configEmbeddedToml = `
+[[namespaces]]
+name = "testns0"
+id = 0
+
+[[namespaces]]
+name = "testns1"
+id = 1
+`
+)
+
+const configReference = `
+dsn: memory
+namespaces: %s
+`
+
+const nsyaml = "name: testns0\nid: 0"
+const nsjson = `{"name": "testns1", "id": 1}`
+
+func TestValidateConfigNamespaces(t *testing.T) {
+	cmd := cmdx.CommandExecuter{New: validateCommand}
+
+	t.Run("case=read valid config with embedded namespaces", func(t *testing.T) {
+		dir := t.TempDir()
+		fnyaml := filepath.Join(dir, "keto.yaml")
+		require.NoError(t, os.WriteFile(fnyaml, []byte(configEmbeddedYaml), fileMode))
+
+		fnjson := filepath.Join(dir, "keto.json")
+		require.NoError(t, os.WriteFile(fnjson, []byte(configEmbeddedJson), fileMode))
+
+		fntoml := filepath.Join(dir, "keto.toml")
+		require.NoError(t, os.WriteFile(fntoml, []byte(configEmbeddedToml), fileMode))
+
+		stdOut := cmd.ExecNoErr(t, "validate", "-c", fnyaml+","+fnjson+","+fntoml)
+		assert.Contains(t, stdOut, "Congrats, all files are valid!\n")
+	})
+
+	t.Run("case=supports 3 namespace file formats", func(t *testing.T) {
+		dir := t.TempDir()
+		nsfiles := map[string]string{
+			filepath.Join(dir, "ns.yaml"): "name: testns0\nid: 0",
+			filepath.Join(dir, "ns.json"): "{\"name\": \"testns0\",\"id\": 0}",
+			filepath.Join(dir, "ns.toml"): "name = \"testns0\"\nid = 0",
+		}
+		for fn, contents := range nsfiles {
+			require.NoError(t, os.WriteFile(fn, []byte(contents), fileMode))
+		}
+
+		params := append([]string{"validate"}, keys(nsfiles)...)
+		cmd.ExecNoErr(t, params...)
+	})
+
+	t.Run("case=unknown namespace format gives error", func(t *testing.T) {
+		fn := filepath.Join(t.TempDir(), "ns.txt")
+		require.NoError(t, os.WriteFile(fn, []byte("name: ns\nid: 0"), fileMode))
+
+		_, stdErr, err := cmd.Exec(nil, "validate", fn)
+		require.ErrorIs(t, err, cmdx.ErrNoPrintButFail)
+		assert.Contains(t, stdErr, "Unable to infer file type")
+	})
+
+	t.Run("case=config passed as varg fails", func(t *testing.T) {
+		fn := filepath.Join(t.TempDir(), "keto.yaml")
+		require.NoError(t, os.WriteFile(fn, []byte(configEmbeddedYaml), fileMode))
+
+		// interprets config file as namespace file when `-c` flag is not passed
+		_, stdErr, err := cmd.Exec(nil, "validate", fn)
+		require.ErrorIs(t, err, cmdx.ErrNoPrintButFail)
+		assert.Regexp(t, "additionalProperties ((\"namespaces\", \"dsn\")|(\"dsn\", \"namespaces\")) not allowed", stdErr)
+	})
+
+	t.Run("case=read config with invalid embedded namespace", func(t *testing.T) {
+		fn := filepath.Join(t.TempDir(), "keto.yaml")
+		require.NoError(t, os.WriteFile(fn, []byte(`{"namespaces":[{"id":"x","name":"x"}]}`), fileMode))
+
+		_, stdErr, err := cmd.Exec(nil, "validate", "--config", fn)
+		require.ErrorIs(t, err, cmdx.ErrNoPrintButFail)
+		assert.Contains(t, stdErr, "not a valid namespace file")
+		assert.Contains(t, stdErr, "id:")
+	})
+
+	t.Run("case=read config with namespace as dir reference", func(t *testing.T) {
+		nsdir := t.TempDir()
+		fn := filepath.Join(t.TempDir(), "config.yaml")
+		require.NoError(t, os.WriteFile(filepath.Join(nsdir, "ns0.yaml"), []byte(nsyaml), fileMode))
+		require.NoError(t, os.WriteFile(filepath.Join(nsdir, "ns1.json"), []byte(nsjson), fileMode))
+		require.NoError(t, os.WriteFile(fn, []byte(fmt.Sprintf(configReference, nsdir)), fileMode))
+
+		cmd.PersistentArgs = []string{}
+		stdOut := cmd.ExecNoErr(t, "validate", "-c", fn)
+		assert.Contains(t, stdOut, "Congrats, all files are valid!\n")
+
+		stdOut = cmd.ExecNoErr(t, "validate", "-c", fmt.Sprintf("%s,%s", fn, fn))
+		assert.Contains(t, stdOut, "Congrats, all files are valid!\n")
+	})
+
+	t.Run("case=read config with dir reference bad namespaces", func(t *testing.T) {
+		nsdir := t.TempDir()
+		fn := filepath.Join(t.TempDir(), "config.yaml")
+		require.NoError(t, os.WriteFile(filepath.Join(nsdir, "ns0.yaml"), []byte("name: badId\nid: foo"), fileMode))
+		require.NoError(t, os.WriteFile(fn, []byte(fmt.Sprintf(configReference, nsdir)), fileMode))
+
+		cmd.PersistentArgs = []string{}
+		_, stdErr, err := cmd.Exec(nil, "validate", "-c", fn)
+		require.ErrorIs(t, err, cmdx.ErrNoPrintButFail)
+		assert.Contains(t, stdErr, "contains values or keys which are invalid")
+	})
+}
+
+func validateCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "keto",
+		Short: "Global and consistent permission and authorization server",
+	}
+	configx.RegisterConfigFlag(cmd.PersistentFlags(), []string{})
+	cmd.AddCommand(NewValidateCmd())
+	return cmd
+}
+
+func keys(m map[string]string) []string {
+	rv := make([]string, 0, len(m))
+	for k := range m {
+		rv = append(rv, k)
+	}
+	return rv
+}