Skip to content

feat: RBAC/OPA authorization with Regorus policy engine #993

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
serene-kitfisto-8899 wants to merge 2 commits into from
Closed

feat: RBAC/OPA authorization with Regorus policy engine #993

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5cf4691
docs: add RBAC/OPA design — CONTEXT, ADRs, diagrams, and deliverables
Jun 8, 2026
ad4da4c
feat: implement RBAC/OPA authorization with Regorus policy engine
Jun 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file added .github/scripts/benchmarks/run_benchmarks_load_tests_flamegraph.sh
View file
Open in desktop
Empty file.
Empty file added .github/scripts/ci.sh
View file
Open in desktop
Empty file.
Empty file added CHANGELOG/develop.md
View file
Open in desktop
Empty file.
Empty file added CHANGELOG/feat_perfs_aws.md
View file
Open in desktop
Empty file.
34 changes: 34 additions & 0 deletions CHANGELOG/rbac_design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Changelog — branch `rbac_design`

## Features

- Add `RbacConfig` and `RbacParams` configuration structs for RBAC/OPA authorization
- Add `tenant_id` column to `objects` table (schema migration for SQLite/PostgreSQL/MySQL)
- Add startup cross-validation: RBAC mode requires IdP auth, bundle path/URL, and non-empty claim paths
- Implement Policy Bundle Manager: load, validate (strict Regorus compilation), and hash `.rego` bundles
- Implement Policy Evaluator: `ArcSwap`-backed Regorus engine with atomic hot-reload and fail-closed semantics
- Implement Policy Input Builder: `PolicyInput` struct matching OPA input contract
- Implement RBAC Audit Logger: structured `tracing::info!` events with typed fields
- Ship default policy bundles: algorithm-only (non-RBAC) and full RBAC (super-admin/admin/operator/auditor)
- Wire `PolicyEvaluator` into the `KMS` struct with automatic initialization at startup
- Add `ckms server migrate-tenants` CLI command for tenant_id backfill before RBAC enablement
- Add `regorus`, `arc-swap`, `notify` workspace dependencies
- Implement three-tier RBAC enforcement:
- Tier 1: `dispatch.rs` pre-dispatch hook for non-object operations
- Tier 2: `retrieve_object_utils.rs` object-level authorization via policy
- Tier 3: `/access/grant` and `/access/revoke` inline enforcement
- Extend JWT `UserClaim` with dynamic claim extraction (dot-notation paths for roles/tenant)
- Bypass legacy `algorithm_policy.rs` when Rego evaluator is active
- Implement hot-reload file watcher (notify crate, cross-platform)
- Implement remote bundle polling with JSON manifest support
- Add `POST /admin/migrate-tenants` server-side REST endpoint
- Add RBAC step to interactive configuration wizard

## Documentation

- Update `CONTEXT.md` with 16 resolved design decisions from grilling session
- Add ADR 0003: Always-Rego algorithm enforcement
- Add ADR 0004: Super-admin role for cross-tenant access
- Add `documentation/docs/configuration/rbac.md` RBAC documentation page
- Register RBAC page in `documentation/mkdocs.yml`
- Add `test_data/vectors/rbac/README.md` documenting planned integration test vectors
500 changes: 500 additions & 0 deletions CONTEXT.md
View file
Open in desktop

Large diffs are not rendered by default.

Loading
Loading