[LFXV2-707] Update authorization model for OpenFGA to include meeting and past meeting attachment types #77
Conversation
…eting attachment types This commit adds two new types to the OpenFGA authorization model: - meeting_attachment: Represents attachments for meetings - past_meeting_attachment: Represents attachments for past meetings Both types include appropriate relations for writer, auditor, participant, and viewer permissions, following the same pattern as their parent meeting types. The model version has been bumped from 5.3.2 to 6.0.0 to reflect this change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughBumps Helm chart version to 0.3.6 and updates the OpenFGA model to 6.0.0; adds Changes
Sequence Diagram(s)(No sequence diagrams — model/schema-only changes.) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (1)
🧰 Additional context used🧠 Learnings (2)📓 Common learnings📚 Learning: 2025-08-08T21:57:43.678ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🔇 Additional comments (4)
Comment |
There was a problem hiding this comment.
Pull Request Overview
This pull request updates the OpenFGA authorization model to version 6.0.0 and adds support for meeting and past meeting attachments. The changes introduce new resource types with appropriate access control relations that inherit permissions from their parent meeting objects.
- Bumped authorization model version from 5.3.2 to 6.0.0
- Added
meeting_attachmenttype with relations for meeting attachments - Added
past_meeting_attachmenttype with relations for past meeting attachments
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Andres Tobon <[email protected]>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
charts/lfx-platform/Chart.yaml(1 hunks)charts/lfx-platform/templates/openfga/model.yaml(3 hunks)
🧰 Additional context used
🧠 Learnings (3)
📓 Common learnings
Learnt from: andrest50
Repo: linuxfoundation/lfx-v2-helm PR: 30
File: charts/lfx-platform/templates/openfga/model.yaml:66-69
Timestamp: 2025-08-08T21:57:43.678Z
Learning: In the lfx-platform OpenFGA authorization model for the meeting type, the viewer relation is intentionally defined as `[user:*] or participant or organizer or auditor from project`, which allows any user to view meetings by default. This is the correct and intended behavior for this system.
Learnt from: prabodhcs
Repo: linuxfoundation/lfx-v2-helm PR: 52
File: charts/lfx-platform/templates/openfga/model.yaml:73-80
Timestamp: 2025-09-09T15:09:56.135Z
Learning: In the OpenFGA authorization model for the lfx-platform Helm chart, the type for GroupsIO members is named "groupsio_member" rather than "groupsio_mailing_list_member", as preferred by the maintainers for brevity.
📚 Learning: 2025-08-08T21:57:43.678Z
Learnt from: andrest50
Repo: linuxfoundation/lfx-v2-helm PR: 30
File: charts/lfx-platform/templates/openfga/model.yaml:66-69
Timestamp: 2025-08-08T21:57:43.678Z
Learning: In the lfx-platform OpenFGA authorization model for the meeting type, the viewer relation is intentionally defined as `[user:*] or participant or organizer or auditor from project`, which allows any user to view meetings by default. This is the correct and intended behavior for this system.
Applied to files:
charts/lfx-platform/templates/openfga/model.yaml
📚 Learning: 2025-08-29T16:53:12.710Z
Learnt from: mauriciozanettisalomao
Repo: linuxfoundation/lfx-v2-helm PR: 49
File: charts/lfx-platform/Chart.yaml:8-8
Timestamp: 2025-08-29T16:53:12.710Z
Learning: The maintainer mauriciozanettisalomao prefers to keep chart version increments conservative, choosing 0.2.7 over suggested 0.3.0 even for changes that could be considered behavior-altering (like new middleware and JSON Content-Type enforcement in Heimdall).
Applied to files:
charts/lfx-platform/Chart.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: MegaLinter
🔇 Additional comments (3)
charts/lfx-platform/Chart.yaml (1)
8-8: Conservative versioning approach aligns with maintainer preference.The patch-level Helm chart bump (0.3.5 → 0.3.6) is proportional to the additive nature of the authorization model changes and follows the conservative versioning pattern noted in previous reviews.
charts/lfx-platform/templates/openfga/model.yaml (2)
22-24: Version bump follows documented guidelines for type additions.The major version increment (5.3.2 → 6.0.0) correctly applies the versioning guideline at lines 15-20 for "additions of type."
108-108: Confirm viewer permission is intentional for attachments.Both attachment types define
viewer: [user:*] or participant or writer or auditor, which allows any authenticated user to view any attachment by default. This matches the retrieved learning that confirms the same pattern formeetingtype is intentional. Please verify this permissive default is also the intended behavior for meeting and past-meeting attachments.Also applies to: 141-141
Signed-off-by: Andres Tobon <[email protected]>
| relations | ||
| define meeting: [meeting] | ||
| define writer: organizer from meeting | ||
| define auditor: auditor from meeting |
There was a problem hiding this comment.
writer should also have audit permissions (if they differ from viewer). If auditor is only used as a kind of viewer, then perhaps leave a note since this differs from the other style of models where auditor has access to read things that viewers don't, typically.
There was a problem hiding this comment.
Alright I can add the writer as a passthrough to the auditor relation. Technically auditor via meeting means organizer via meeting has auditor permission, but to be more explicit I'll just include it on this line.
… relation for meeting and past meeting attachments Signed-off-by: Andres Tobon <[email protected]>
Summary
This PR updates the OpenFGA authorization model to include two new attachment types:
meeting_attachment: Represents attachments for meetingspast_meeting_attachment: Represents attachments for past meetingsBoth types include appropriate relations for writer, auditor, participant, and viewer permissions, following the same pattern as their parent meeting types.
Changes
meeting_attachmenttype with relations: meeting, writer, auditor, participant, and viewerpast_meeting_attachmenttype with relations: past_meeting, writer, auditor, participant, and viewerTicket
LFXV2-707
🤖 Generated with Claude Code