feat: RBAC/OPA authorization with Regorus policy engine#993
Open
serene-kitfisto-8899 wants to merge 2 commits into
Open
feat: RBAC/OPA authorization with Regorus policy engine#993serene-kitfisto-8899 wants to merge 2 commits into
serene-kitfisto-8899 wants to merge 2 commits into
Conversation
- CONTEXT.md: problem statement, user stories, implementation decisions, OPA input contract, default Rego policy skeleton, and NIST/KMIP references - docs/adr/0001: Regorus chosen as sole in-process Rego engine (OPA WASM rejected) - docs/adr/0002: OPA is sole gatekeeper in RBAC mode; DB ACL checks bypassed - docs/diagrams/: module architecture, role hierarchy, request flow, and bundle loading diagrams (SVG source + PNG renders) - docs/rbac-design.pdf: full design document (TOC, intro, diagrams, references) - docs/rbac-design.odt: OpenDocument version for editing in LibreOffice - docs/rbac-design.pptx: 27-slide PowerPoint presentation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implement opt-in NIST-compatible RBAC with in-process Rego policy evaluation via the Regorus engine. The system supports a 4-level role hierarchy (super-admin > admin > operator > auditor), tenant isolation, JWT-based role assignment, and auditable policy decisions. Key components: - RbacConfig/RbacParams with startup cross-validation - Policy Bundle Manager (load, validate, hash .rego bundles) - Policy Evaluator (ArcSwap-backed, fail-closed, atomic hot-reload) - Policy Input Builder (OPA input contract structs) - Three-tier enforcement: dispatch (Tier 1), retrieve (Tier 2), access endpoints (Tier 3) - RBAC Audit Logger (structured tracing events for OTEL) - Default policies: algorithm-only (non-RBAC) and full RBAC bundle - Hot-reload file watcher (notify crate, cross-platform) - Remote bundle polling with JSON manifest support - CLI: ckms server migrate-tenants command - Server: POST /admin/migrate-tenants endpoint - Config wizard: interactive RBAC setup step - Legacy algorithm_policy.rs bypassed when Rego evaluator is active - JWT UserClaim extended with dynamic claim extraction (dot-notation) - Database: tenant_id column added to objects table (migration) Design decisions documented in CONTEXT.md (16 resolved decisions). ADRs: 0003 (always-Rego algorithm enforcement), 0004 (super-admin role). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implement opt-in NIST-compatible RBAC with in-process Rego policy evaluation via the Regorus engine (pure-Rust, no external OPA dependency).
Key Features
WHERE tenant_id = ?)dispatch.rspre-dispatch for non-object opsretrieve_object_utils.rsfor object-targeting ops/access/grantand/access/revokeendpointsnotifycrate file watcher + remote URL pollingckms server migrate-tenantsCLI + REST endpointDesign Decisions
16 design decisions documented in
CONTEXT.mdvia structured design review:is_privilegedflag to policyADRs
Testing
--all-features)Files Changed
crate/server/src/core/rbac/(8 modules + 2 Rego policies)crate/server/src/config/command_line/rbac_config.rscrate/server/src/config/params/rbac_params.rscrate/server/src/config/wizard/rbac_wizard.rscrate/server/src/routes/admin.rscrate/clients/clap/src/actions/migrate_tenants.rs