Repository navigation
ateapi: [Part 2] Runtime Authorization check for Actor and ActorTemplate CRUD - #1980
Merged
Benjamin Elder (BenTheElder) merged 4 commits intoOct 7, 2026
Conversation
Shruti Nair (SHRUTI6991)
changed the title
Shruti Nair (SHRUTI6991)
marked this pull request as ready for review
September 29, 2026 16:31
Maya Wang (mayawang)
added
area/api
Shruti Nair (SHRUTI6991)
force-pushed
the
authz_actor_and_template_checks
branch
from
September 30, 2026 17:24
4a9ff16 to
ded45ff
Compare
Shruti Nair (SHRUTI6991)
force-pushed
the
authz_actor_and_template_checks
branch
from
October 2, 2026 21:50
c459548 to
ad5a0d9
Compare
Max Thompson (thompsonmax)
approved these changes
Oct 3, 2026
This was referenced Oct 5, 2026
Merged
2 tasks
Actor and ActorTemplate RPCs were not covered by the authz interceptor, so with --experimental-enable-authz set, callers could read and modify them in any atespace. The registry now maps each RPC to a list of checks, all of which must pass. CreateActor needs can_create_actor on the atespace and UpdateActor needs can_update on the actor; both also need can_use on the referenced actor template, which may live in another atespace. Get and Delete check the resource, and List checks the atespace, or global:root when the atespace is empty. Actors and templates are identified as actor:<atespace>/<name> and actor_template:<atespace>/<name>. Their parent atespace is derived from the ID and sent as contextual tuples, so no tuples are written on create or delete. '/' is escaped in each component so every ID names exactly one resource.
The check extractors used to leave out a check whose atespace or name was missing and rely on the handler to reject the request. For UpdateActor, whose request validation does not descend into the actor, that left the template check to validation run deep inside the store transaction. Names OpenFGA cannot accept in an object ID also surfaced as Internal. Extractors now require every identifier a check needs to be present and a valid resource name, and return InvalidArgument with the field path otherwise, so no check is skipped and OpenFGA never sees a malformed ID. The interceptor authenticates before extracting, so unauthenticated callers still get Unauthenticated.
Actor and actor template checks reach global:root only through the contextual actor -> atespace -> global:root links. Cover a global owner and a bootstrap owner, which has no stored tuples, on get, update, and delete, and a global viewer being denied the writes.
The actor_template relation that gates running actors from a template is now can_use_template, so the permission name says what is being used.
Shruti Nair (SHRUTI6991)
force-pushed
the
authz_actor_and_template_checks
branch
from
October 7, 2026 18:37
0f54ab7 to
5d3e2ea
Compare
Taahir Ahmed (ahmedtd)
approved these changes
Oct 7, 2026
| // tuples in PostgreSQL. | ||
| // | ||
| // Why contextual tuples are used instead of storing `parent_global` in the database: | ||
| // Why contextual tuples are used instead of storing parent links in the database: |
Collaborator
There was a problem hiding this comment.
(This is a longer-term comment we should think about, but doesn't block submitting this PR).
Why not do everything with contextual tuples? Why do we need to to use OpenFGA's relation table at all, if all of the information in it is redundant with information stored in the Substrate tables.
I think the answer (if there is one) is that OpenFGA should be doing its graph search during retrieval from the relation table, rather than loading everything into memory and doing the graph search there. So are we harming the ability for that to happen by using contextual tuples for things that OpenFGA expects to be concrete in the relation table?)
(My mental model of contextual tuples is that they are for things that are inherently request-scoped, for example, the fact that a user authenticated with a client cert or a JWT, or the geolocation of their calling IP)
Collaborator
Author
There was a problem hiding this comment.
+1,
May be I am over abusing contextual tuples. Let me create a task to think through if we should store the structural links during creation of the resource.
Collaborator
Author
There was a problem hiding this comment.
Julian Gutierrez Oschmann (juli4n)
approved these changes
Oct 7, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Working on #1563
Fixes #1699
Adds OpenFGA authorization checks for
ActorandActorTemplateCRUD RPCs, enforced when--experimental-enable-authzis set. AccessPolicy RPCs are still always enforced.Checks
CreateActorTemplatecan_create_actor_templateonatespaceGet/DeleteActorTemplatecan_get/can_deleteonactor_templateListActorTemplatescan_list_actor_templatesonatespace(orglobal:root)CreateActorcan_create_actoronatespace+can_use_templateon templateUpdateActorcan_updateonactor+can_use_templateon templateGet/DeleteActorcan_get/can_deleteonactorListActorscan_list_actorsonatespace(orglobal:root)Notes
InvalidArgumentand the field path. No check is skipped, so this does not depend on handler validation.actor/actor_template→atespace→global:root) are passed as contextual tuples, so creating or deleting a resource writes no tuples. Global owners, stored or bootstrap, reach actors and templates through these links.UpdateActoralways checkscan_use_templateon the template. Checking only when the template changes is left for a follow-up.Testing