Zanzana: Use separate store for each org (#96015)

* Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter
2024-11-08 14:54:36 +01:00
parent 86bc087257
commit 910ec7e7dc
22 changed files with 1497 additions and 396 deletions
@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+
+	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+
+	"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
+	authzextv1 "github.com/grafana/grafana/pkg/services/authz/zanzana/proto/v1"
+)
+
+func (s *Server) Write(ctx context.Context, req *authzextv1.WriteRequest) (*authzextv1.WriteResponse, error) {
+	ctx, span := tracer.Start(ctx, "authzServer.Write")
+	defer span.End()
+
+	storeInf, err := s.getNamespaceStore(ctx, req.Namespace)
+	if err != nil {
+		return nil, err
+	}
+	if storeInf.AuthorizationModelId == "" {
+		return nil, errAuthorizationModelNotInitialized
+	}
+
+	writeTuples := make([]*openfgav1.TupleKey, 0)
+	for _, t := range req.GetWrites().GetTupleKeys() {
+		writeTuples = append(writeTuples, common.ToOpenFGATupleKey(t))
+	}
+
+	deleteTuples := make([]*openfgav1.TupleKeyWithoutCondition, 0)
+	for _, t := range req.GetDeletes().GetTupleKeys() {
+		deleteTuples = append(deleteTuples, common.ToOpenFGATupleKeyWithoutCondition(t))
+	}
+
+	writeReq := &openfgav1.WriteRequest{
+		StoreId:              storeInf.Id,
+		AuthorizationModelId: storeInf.AuthorizationModelId,
+	}
+	if len(writeTuples) > 0 {
+		writeReq.Writes = &openfgav1.WriteRequestWrites{
+			TupleKeys: writeTuples,
+		}
+	}
+	if len(deleteTuples) > 0 {
+		writeReq.Deletes = &openfgav1.WriteRequestDeletes{
+			TupleKeys: deleteTuples,
+		}
+	}
+
+	_, err = s.openfga.Write(ctx, writeReq)
+	if err != nil {
+		return nil, err
+	}
+
+	return &authzextv1.WriteResponse{}, nil
+}