snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

scripts/.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

scripts/create-many-tuples.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for i in {1..500} ; do
+  d="$(mktemp -d)"
+  for j in {1..20} ; do
+    echo "[" > "$d/$j.json"
+    for k in {1..100}; do
+      echo '{"namespace": "default", "object": "'$i'", "subject_id": "'$j'", "relation": "'$k'"},' >> "$d/$j.json"
+    done
+    echo '{"namespace": "default", "object": "'$i'", "subject_id": "'$j'", "relation": "last"}]' >> "$d/$j.json"
+  done
+  ./keto relation-tuple create -f "$d"
+done

scripts/install-grype.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source ./scripts/install-helpers.sh
+
+BINDIR=${BINDIR:-./.bin}
+GRYPE_VERSION="0.50.2"
+
+OS=$(uname_os)
+BINNAME="grype"
+if [ "${OS}" = "windows" ]; then
+    BINNAME="grype.exe"
+fi
+
+if [[ "$("$BINDIR/$BINNAME" version)" == *"$GRYPE_VERSION"* ]]; then
+    echo "grype ${GRYPE_VERSION} already installed"
+    exit 0
+fi
+
+curl --retry 7 --retry-connrefused -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | bash -s -- -b "$BINDIR" "v$GRYPE_VERSION"

scripts/install-helpers.sh

@@ -0,0 +1,93 @@
+#!/bin/env bash
+set -euo pipefail
+
+is_command() {
+	command -v "$1" >/dev/null
+}
+uname_os() {
+	os=$(uname -s | tr '[:upper:]' '[:lower:]')
+	case "$os" in
+	cygwin_nt*) os="windows" ;;
+	mingw*) os="windows" ;;
+	msys_nt*) os="windows" ;;
+  darwin) os="osx" ;;
+	esac
+	echo "$os"
+}
+uname_arch() {
+	arch=$(uname -m)
+	case $arch in
+	x86_64) arch="amd64" ;;
+	x86) arch="386" ;;
+	i686) arch="386" ;;
+	i386) arch="386" ;;
+	aarch64) arch="arm64" ;;
+	armv5*) arch="armv5" ;;
+	armv6*) arch="armv6" ;;
+	armv7*) arch="armv7" ;;
+	esac
+	echo ${arch}
+}
+untar() {
+	tarball=$1
+	case "${tarball}" in
+	*.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+	*.tar) tar --no-same-owner -xf "${tarball}" ;;
+	*.zip) unzip "${tarball}" ;;
+	*)
+		echo "untar unknown archive format for ${tarball}"
+		return 1
+		;;
+	esac
+}
+http_download_curl() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		code=$(curl --retry 7 --retry-connrefused -w '%{http_code}' -sL -o "$local_file" "$source_url")
+	else
+		code=$(curl --retry 7 --retry-connrefused -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+	fi
+	if [ "$code" != "200" ]; then
+		echo "http_download_curl received HTTP status $code"
+		return 1
+	fi
+	return 0
+}
+http_download_wget() {
+	local_file=$1
+	source_url=$2
+	header=$3
+	if [ -z "$header" ]; then
+		wget -q -O "$local_file" "$source_url"
+	else
+		wget -q --header "$header" -O "$local_file" "$source_url"
+	fi
+}
+http_download() {
+	echo "downloading $2"
+	if is_command curl; then
+		http_download_curl "$@"
+		return
+	elif is_command wget; then
+		http_download_wget "$@"
+		return
+	fi
+	echo "http_download unable to find wget or curl"
+	return 1
+}
+update_binary_version() {
+  bindir=$1
+  binname=$2
+  version=$3
+  echo "updating binary version to ${version}"
+  echo "${version}" > "${bindir}/.${binname}.version"
+}
+check_binary_version() {
+  bindir=$1
+  binname=$2
+  version=$3
+  echo "checking binary version"
+  [ "$(cat "${bindir}/.${binname}.version")" = "${version}" ]
+}

scripts/install-licenses.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source ./scripts/install-helpers.sh
+
+BINDIR=${BINDIR:-./.bin}
+LICENCES_VERSION="0.1.48"
+
+OS=$(uname_os)
+BINNAME="licences"
+if [ "${OS}" = "windows" ]; then
+    BINNAME="licences.exe"
+fi
+
+if [[ "$("$BINDIR/$BINNAME" version)" == *"$LICENCES_VERSION"* ]]; then
+    echo "licences ${LICENCES_VERSION} already installed"
+    exit 0
+fi
+
+curl --retry 7 --retry-connrefused -sSfL https://raw.githubusercontent.com/ory/ci/master/licenses/install | bash -s -- -b "$BINDIR" licences "v$LICENCES_VERSION"

scripts/install-ory.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source ./scripts/install-helpers.sh
+
+BINDIR=${BINDIR:-./.bin}
+ORY_VERSION="0.3.1"
+
+OS=$(uname_os)
+BINNAME="ory"
+if [ "${OS}" = "windows" ]; then
+    BINNAME="ory.exe"
+fi
+
+if [[ "$("$BINDIR/$BINNAME" version)" == *"$ORY_VERSION"* ]]; then
+    echo "ory ${ORY_VERSION} already installed"
+    exit 0
+fi
+
+curl --retry 7 --retry-connrefused -sSfL https://raw.githubusercontent.com/ory/meta/master/install.sh | bash -s -- -b "$BINDIR" ory "v$ORY_VERSION"

scripts/render-schemas.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+schema_version="${1:-$(git rev-parse --short HEAD)}"
+
+sed "s!ory://tracing-config!https://raw.githubusercontent.com/ory/keto/$schema_version/oryx/otelx/config.schema.json!g;
+s!ory://logging-config!https://raw.githubusercontent.com/ory/keto/$schema_version/oryx/logrusx/config.schema.json!g" embedx/config.schema.json > .schema/config.schema.json
+
+git add .schema/config.schema.json
+
+if ! git diff --exit-code .schema/config.schema.json
+then
+  git commit -m "autogen: render config schema"
+  git push
+fi

scripts/run-configuration.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -Eeuxo pipefail
+
+cd "$( dirname "${BASH_SOURCE[0]}" )/.."
+
+cat > configuration.md << EOF
+---
+id: configuration
+title: Configuration
+---
+
+\`\`\`yaml
+`cat ./docs/config.yaml`
+\`\`\`
+
+EOF

scripts/run-deploy.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+set -euo pipefail
+
+gox -ldflags "-X github.com/ory/keto/cmd.Version=`git describe --tags` -X github.com/ory/keto/cmd.BuildTime=`TZ=UTC date -u '+%Y-%m-%dT%H:%M:%SZ'` -X github.com/ory/keto/cmd.GitHash=`git rev-parse HEAD`" -output "dist/{{.Dir}}-{{.OS}}-{{.Arch}}";
+npm version -f --no-git-tag-version $(git describe --tag);

scripts/single-table-migration-e2e.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+set -euxo pipefail
+
+rm migrate_e2e.sqlite || true
+
+bash <(curl --retry 7 --retry-connrefused https://raw.githubusercontent.com/ory/keto/master/install.sh) -b . v0.6.0-alpha.3
+
+export DSN="sqlite://./migrate_e2e.sqlite?_fk=true"
+export KETO_READ_REMOTE="127.0.0.1:4466"
+export KETO_WRITE_REMOTE="127.0.0.1:4467"
+
+config="$(mktemp --tmpdir keto.XXXXXX.yml)"
+echo "
+log:
+  level: debug
+
+namespaces:
+  - id: 0
+    name: a
+  - id: 1
+    name: b
+" >> "$config"
+
+./keto migrate up -y -c "$config" --all-namespaces
+
+./keto serve all -c "$config" &
+keto_server_pid=$!
+
+function teardown() {
+    kill $keto_server_pid || true
+}
+trap teardown EXIT
+
+jq '[range(300)] | map({namespace: (if . % 2 == 0 then "a" else "b" end), object: . | tostring, relation: "view", subject: "user"})' <(echo '{}') \
+  | ./keto relation-tuple create -q -f -
+
+kill $keto_server_pid
+
+go build  -o keto_new .
+
+./keto_new migrate up -y -c "$config"
+./keto_new namespace migrate legacy -y -c "$config"
+
+./keto_new serve all -c "$config" &
+keto_server_pid=$!
+
+for i in {0..300..24} ; do
+    diff <(echo 'Allowed') <(./keto_new check user view a "$i")
+done
+
+for i in {1..300..24} ; do
+    diff <(echo 'Allowed') <(./keto_new check user view b "$i")
+done

scripts/test-resetdb.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+docker rm -f test_keto_postgres || true
+docker rm -f test_keto_mysql || true
+docker rm -f test_keto_cockroach || true
+
+postgres_port="$(docker port "$(docker run --name test_keto_postgres -e "POSTGRES_PASSWORD=secret" -e "POSTGRES_DB=postgres" -p 0.0.0.0:0:5432 -d postgres:16)" 5432 | sed 's/.*:\([0-9]*\)/\1/')"
+mysql_port="$(docker port "$(docker run --name test_keto_mysql -e "MYSQL_ROOT_PASSWORD=secret" -p 0.0.0.0:0:3306 -d mysql:8.0)" 3306 | sed 's/.*:\([0-9]*\)/\1/')"
+cockroach_port="$(docker port "$(docker run --name test_keto_cockroach -p 0.0.0.0:0:26257 -d cockroachdb/cockroach:latest-v25.4 start-single-node --insecure)" 26257 | sed 's/.*:\([0-9]*\)/\1/')"
+
+TEST_DATABASE_POSTGRESQL=$(printf "postgres://postgres:secret@localhost:%s/postgres?sslmode=disable" "$postgres_port")
+TEST_DATABASE_MYSQL=$(printf "mysql://root:secret@(localhost:%s)/mysql?parseTime=true&multiStatements=true" "$mysql_port")
+TEST_DATABASE_COCKROACHDB=$(printf "cockroach://root@localhost:%s/defaultdb?sslmode=disable" "$cockroach_port")
+
+export TEST_DATABASE_POSTGRESQL
+export TEST_DATABASE_MYSQL
+export TEST_DATABASE_COCKROACHDB
+
+# undo set from above
+set +e
+set +u
+set +x
+set +o pipefail

scripts/test-sdk.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -euo pipefail
+
+cd "$( dirname "${BASH_SOURCE[0]}" )/.."
+
+scripts/run-genswag.sh
+git add -A
+git diff --exit-code
+
+./scripts/run-gensdk.sh
+git add -A
+git diff --exit-code