Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Policy: resource mappings GET/LIST should provide attribute value FQNs in response #1580

Closed
jakedoublev opened this issue Sep 26, 2024 · 4 comments · Fixed by #1622 or #1602
Closed

Policy: resource mappings GET/LIST should provide attribute value FQNs in response #1580

jakedoublev opened this issue Sep 26, 2024 · 4 comments · Fixed by #1622 or #1602
Labels
comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry)

Comments

@jakedoublev
Copy link
Contributor

Background

LIST of resource mappings is a known service to service API for PDPs and should therefore provide the FQN in response of mapped attribute values to avoid PEPs/PDPs receiving the value id and having to do a roundtrip.

Acceptance Criteria

  1. resource mappings return fqns of attribute values they map to in response
  2. integration tests
@jakedoublev jakedoublev added the comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry) label Sep 26, 2024
@jakedoublev jakedoublev mentioned this issue Sep 26, 2024
Open
@ryanulit ryanulit linked a pull request Oct 8, 2024 that will close this issue
feat(policy): 1580 Resource Mappings GET/LIST should provide attribute value FQNs in response #1622
Merged
@ryanulit ryanulit mentioned this issue Oct 8, 2024
Merged
@ryanulit
Copy link
Contributor

ryanulit commented Oct 9, 2024

@jakedoublev does this include the ListResourceMappingsByFullyQualifiedGroup query as well or just the base GET/LIST queries?

https://github.com/opentdf/platform/blob/main/service/policy/db/query.sql#L530-L545

@jakedoublev
Copy link
Contributor Author

@ryanulit I think we probably want the FQN of the Resource Mapping in each read RPC because the mappings are used by services downstream (not admins alone) and therefore should not rely on UUIDs.

@ryanulit
Copy link
Contributor

ryanulit commented Oct 9, 2024

You meant FQN of the Attribute Value right? This also just made me think that we might want to return the FQN of the Resource Mapping Group (i.e. https://<namespace>/resm/<group_name>) in its Get/List queries as well, but I can make a separate ticket for that if you agree.

@jakedoublev
Copy link
Contributor Author

Sorry for the confusion. I agree we need the below for read actions (get/list):

  1. attribute value FQN when returning resource mappings
  2. resource mapping group FQN when returning resource mapping groups
  3. after requirement change that resource mappings must be in a group is implemented, a get/list of a resource mapping should also include the relevant RM group FQN

@ryanulit ryanulit mentioned this issue Oct 9, 2024
Open
github-merge-queue bot pushed a commit that referenced this issue Oct 9, 2024
@ryanulit
feat(policy): 1580 Resource Mappings GET/LIST should provide attribut…
e33bcc0 
…e value FQNs in response (#1622)

fix #1580
@opentdf-automation opentdf-automation bot mentioned this issue Oct 9, 2024
Merged
github-merge-queue bot pushed a commit that referenced this issue Oct 15, 2024
@opentdf-automation
chore(main): release service 0.4.25 (#1602)
99da3e2 
🤖 I have created a release *beep* *boop*
---


##
[0.4.25](service/v0.4.24...service/v0.4.25)
(2024-10-15)


### Features

* **authz:** Add name to entity id when retrieved from token
([#1616](#1616))
([5304204](5304204))
* **core:** Add entity category to audit logs
([#1614](#1614))
([871878c](871878c))
* **core:** Change log level from Debug to Trace for readiness checks
([#1544](#1544))
([0af1269](0af1269)),
closes [#1545](#1545)
* **policy:** 1004 add audit support for unsafe actions
([#1620](#1620))
([4b64e5b](4b64e5b))
* **policy:** 1357 policy GetAttributeByFqn db query should employ fewer
roundtrips ([#1633](#1633))
([0bdb7e5](0bdb7e5)),
closes [#1357](#1357)
* **policy:** 1421 tech debt migrate Resource Mappings object queries to
sqlc ([#1422](#1422))
([cd74bcf](cd74bcf))
* **policy:** 1426 tech debt migrate Namespace object queries to sqlc -
PART 2 ([#1617](#1617))
([b914350](b914350))
* **policy:** 1434 tech debt migrate attribute value object queries to
sqlc ([#1444](#1444))
([0a7998e](0a7998e)),
closes [#1434](#1434)
* **policy:** 1435 tech debt migrate attribute definition object queries
to sqlc ([#1450](#1450))
([c36624c](c36624c))
* **policy:** 1436 tech debt migrate subject mapping and condition set
object queries to sqlc
([#1606](#1606))
([ec60c9f](ec60c9f))
* **policy:** 1438 tech debt migrate attribute fqn indexing queries to
sqlc ([#1445](#1445))
([617aa91](617aa91)),
closes [#1438](#1438)
* **policy:** 1580 Resource Mappings GET/LIST should provide attribute
value FQNs in response
([#1622](#1622))
([e33bcc0](e33bcc0)),
closes [#1580](#1580)
* **policy:** 1618 update KAS CRUD to align with ADR decisions
([#1619](#1619))
([379f980](379f980)),
closes [#1618](#1618)
* **policy:** DSP-51 - deprecate PublicKey local field
([#1590](#1590))
([e3ed0b5](e3ed0b5))
* **sdk:** Improve KAS key lookup and caching
([#1556](#1556))
([fb6c47a](fb6c47a))


### Bug Fixes

* allow standard users to get authorization decisions
([#1634](#1634))
([718f5e3](718f5e3))
* **authz:** Move logs containing subject mappings to trace level
([#1635](#1635))
([80c117c](80c117c)),
closes [#1503](#1503)
* **core:** Autobump service
([#1611](#1611))
([2567052](2567052))
* **core:** Autobump service
([#1624](#1624))
([9468479](9468479))
* **core:** Autobump service
([#1639](#1639))
([0551247](0551247))
* **core:** Autobump service
([#1654](#1654))
([ecf41e9](ecf41e9))
* **core:** log audit object as json
([#1612](#1612))
([c519ffb](c519ffb))
* Simplify request ID extraction from context for AUDIT
([#1626](#1626))
([2f7518c](2f7518c))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
comp:policy Policy Configuration ( attributes, subject mappings, resource mappings, kas registry)
Projects
None yet
Milestone
No milestone
2 participants
@ryanulit @jakedoublev