[LFXV2-603] Add authorization model types for past meeting artifacts #65

andrest50 · 2025-10-02T14:09:49Z

Summary

Added three new OpenFGA authorization model types: past_meeting_recording, past_meeting_transcript, and past_meeting_summary
Each type supports three visibility levels: public (anyone), all participants (invitees and attendees), and only hosts
Write permissions are limited to organizers from the past meeting
Auditors and writers always have viewer access regardless of visibility settings
Bumped authorization model version from 4.3.1 to 5.3.1 (major version bump for new types)

Ticket

🤖 Generated with Claude Code

Added three new OpenFGA authorization model types to support access control for past meeting artifacts: past_meeting_recording, past_meeting_transcript, and past_meeting_summary. Each type supports three visibility levels: - Public (anyone can view) - All participants (invitees and attendees) - Only hosts Write permissions are limited to organizers from the past meeting. Auditors and writers always have viewer access regardless of visibility settings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>

coderabbitai · 2025-10-02T14:09:57Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Adds three new OpenFGA types for past meeting artifacts (recording, transcript, summary) with relations derived from past_meeting and a public viewer rule. Updates the OpenFGA AuthorizationModelRequest major version from 4 to 5 in charts/lfx-platform/templates/openfga/model.yaml.

Changes

Cohort / File(s)	Summary of Changes
OpenFGA model extensions `charts/lfx-platform/templates/openfga/model.yaml`	Added types: past_meeting_recording, past_meeting_transcript, past_meeting_summary. Each defines relations: past_meeting (link), writer/auditor/host (from past_meeting), participant (invitee or attendee from past_meeting), viewer (user:* or writer or auditor).
Auth model versioning `charts/lfx-platform/templates/openfga/model.yaml`	Bumped AuthorizationModelRequest major version from 4 to 5.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor U as User
  participant S as Service/API
  participant FGA as OpenFGA

  Note over S,FGA: Access check for new artifact types (recording/transcript/summary)

  U->>S: Request to view past_meeting_recording:{id}
  S->>FGA: Check(user, past_meeting_recording:{id}, viewer)
  alt viewer direct public
    FGA-->>S: allow (user:* matches)
  else derived via writer/auditor
    FGA->>FGA: Resolve writer/auditor from past_meeting
    FGA-->>S: allow/deny
  else participant path
    FGA->>FGA: Resolve invitee/attendee from past_meeting
    FGA-->>S: allow/deny
  end
  S-->>U: Permit or Deny
  Note over S: Same flow applies to transcript and summary

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

[LFXV2-375] Add a past_meeting type to the openfga authorization model #45 — Also modifies the OpenFGA model to extend past_meeting (adds past_meeting and auditor relation), directly connected to new types deriving auditor from past_meeting.
LFXV2-352 - update the groupsio mailing list object to manage the members #52 — Updates the same OpenFGA model file, bumps major version to 5, and introduces new authorization types; overlaps in model-level change.
add organizer as auditor on past_meeting model #63 — Changes past_meeting’s auditor definition (adds organizer), which affects auditor derivation used by the newly added artifact types.

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title concisely and accurately summarizes the main change – adding authorization model types for past meeting artifacts – matching the changeset.
Linked Issues Check	✅ Passed	The changes introduce distinct FGA types for past_meeting_recording, past_meeting_transcript, and past_meeting_summary with appropriate relations and permissions, fully satisfying the objectives of LFXV2-603.
Out of Scope Changes Check	✅ Passed	All modifications are confined to the OpenFGA model.yaml, adding the specified types and bumping the version, with no unrelated or extraneous changes detected.
Description Check	✅ Passed	The description clearly relates to adding new OpenFGA types, their permissions, and the version bump, matching the changes in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch andrest50/past-meeting-artifacts

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 400334b and 7889019.

📒 Files selected for processing (1)

charts/lfx-platform/templates/openfga/model.yaml (2 hunks)

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-08-08T21:57:43.678Z

Learnt from: andrest50
PR: linuxfoundation/lfx-v2-helm#30
File: charts/lfx-platform/templates/openfga/model.yaml:66-69
Timestamp: 2025-08-08T21:57:43.678Z
Learning: In the lfx-platform OpenFGA authorization model for the meeting type, the viewer relation is intentionally defined as `[user:*] or participant or organizer or auditor from project`, which allows any user to view meetings by default. This is the correct and intended behavior for this system.

Applied to files:

charts/lfx-platform/templates/openfga/model.yaml

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull Request Overview

This PR adds authorization model types for past meeting artifacts including recordings, transcripts, and summaries. The changes implement three visibility levels (public, participants only, and hosts only) with appropriate access controls for each artifact type.

Added three new OpenFGA authorization model types: past_meeting_recording, past_meeting_transcript, and past_meeting_summary
Implemented consistent access control patterns across all artifact types with viewer, writer, and auditor roles
Bumped major version from 4 to 5 to reflect the addition of new authorization model types

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

charts/lfx-platform/templates/openfga/model.yaml

Signed-off-by: Andres Tobon <[email protected]>

coderabbitai

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between cab36c8 and f9b77f0.

📒 Files selected for processing (2)

charts/lfx-platform/Chart.yaml (1 hunks)
charts/lfx-platform/templates/openfga/model.yaml (2 hunks)

charts/lfx-platform/templates/openfga/model.yaml

Changed the viewer relation definition for past_meeting_recording, past_meeting_transcript, and past_meeting_summary types to be managed separately based on visibility settings. The viewer relation now only includes [user:*] by default, with the expectation that the backend service will manage viewer tuples based on the visibility group (public, participants, or hosts only). This simplifies the authorization model and gives the backend more explicit control over who can view artifacts based on the past meeting's visibility settings. Also bumped the patch version from 5.3.1 to 5.3.2. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>

charts/lfx-platform/templates/openfga/model.yaml

Updated the viewer relation for all three past meeting artifact types (recording, transcript, summary) to include writers and auditors by default, regardless of visibility settings. This ensures that: - Organizers (writers) can always view artifacts they manage - Auditors can always audit artifacts without restriction - Other viewers are managed separately based on artifact_visibility Also updated comments to clarify that visibility is based on the artifact_visibility setting rather than the general meeting visibility. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>

charts/lfx-platform/templates/openfga/model.yaml

Updated comments for all three past meeting artifact types to use consistent terminology referencing "artifact_visibility" instead of mixing "past meeting" and "private" terminology. This makes it clearer that visibility is controlled by the artifact_visibility setting, not the general meeting visibility. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>

…nto andrest50/past-meeting-artifacts

andrest50 requested review from a team and emsearcy as code owners October 2, 2025 14:09

Copilot AI review requested due to automatic review settings October 2, 2025 14:09

Copilot AI reviewed Oct 2, 2025

View reviewed changes

charts/lfx-platform/templates/openfga/model.yaml Show resolved Hide resolved

charts/lfx-platform/templates/openfga/model.yaml Show resolved Hide resolved

charts/lfx-platform/templates/openfga/model.yaml Show resolved Hide resolved

andrest50 and others added 2 commits October 2, 2025 07:11

Merge branch 'main' into andrest50/past-meeting-artifacts

8c5216b

Bump chart version to 0.2.21

f9b77f0

Signed-off-by: Andres Tobon <[email protected]>

coderabbitai bot reviewed Oct 2, 2025

View reviewed changes

charts/lfx-platform/templates/openfga/model.yaml Show resolved Hide resolved

andrest50 requested a review from jordane October 2, 2025 15:37

jordane reviewed Oct 2, 2025

View reviewed changes

charts/lfx-platform/templates/openfga/model.yaml Outdated Show resolved Hide resolved

charts/lfx-platform/templates/openfga/model.yaml Outdated Show resolved Hide resolved

jordane reviewed Oct 2, 2025

View reviewed changes

charts/lfx-platform/templates/openfga/model.yaml Outdated Show resolved Hide resolved

andrest50 added 2 commits October 2, 2025 13:54

Merge branch 'main' of ssh://github.com/linuxfoundation/lfx-v2-helm i…

7889019

…nto andrest50/past-meeting-artifacts

andrest50 force-pushed the andrest50/past-meeting-artifacts branch from f3c7ca0 to 7889019 Compare October 2, 2025 20:54

jordane approved these changes Oct 2, 2025

View reviewed changes

andrest50 merged commit 46e19d7 into main Oct 2, 2025
4 checks passed

andrest50 deleted the andrest50/past-meeting-artifacts branch October 2, 2025 21:17

coderabbitai bot mentioned this pull request Oct 3, 2025

Fix viewer relation for past meeting artifacts #66

Open

This was referenced Nov 4, 2025

Add "v1" entity relations. #76

Merged

[LFXV2-707] Update authorization model for OpenFGA to include meeting and past meeting attachment types #77

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[LFXV2-603] Add authorization model types for past meeting artifacts #65

[LFXV2-603] Add authorization model types for past meeting artifacts #65

andrest50 commented Oct 2, 2025 •

edited by atlassian bot

Loading

Uh oh!

coderabbitai bot commented Oct 2, 2025 •

edited

Loading

Other AI code review bot(s) detected

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[LFXV2-603] Add authorization model types for past meeting artifacts #65

[LFXV2-603] Add authorization model types for past meeting artifacts #65

Conversation

andrest50 commented Oct 2, 2025 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Ticket

Uh oh!

coderabbitai bot commented Oct 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Pre-merge checks and finishing touches

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andrest50 commented Oct 2, 2025 •

edited by atlassian bot

Loading

coderabbitai bot commented Oct 2, 2025 •

edited

Loading