Skip to content

[LFXV2-707] Update authorization model for OpenFGA to include meeting and past meeting attachment types #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 7, 2025
+40 −22
Merged

[LFXV2-707] Update authorization model for OpenFGA to include meeting and past meeting attachment types #77

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4579e84
Update authorization model for OpenFGA to include meeting and past me…
andrest50 Nov 5, 2025
9d42678
Bump chart version to 0.3.6
andrest50 Nov 5, 2025
ad1790f
Realign formatting of authorization model types
andrest50 Nov 5, 2025
abf75a2
Set writer relation as a passthrough on the definition of the auditor…
andrest50 Nov 7, 2025
ec43f39
Merge branch 'main' into andrest50/meeting-attachments
andrest50 Nov 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/lfx-platform/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ apiVersion: v2
name: lfx-platform
description: LFX Platform v2 Helm chart
type: application
version: 0.3.5
version: 0.3.6
icon: https://github.com/linuxfoundation/lfx-v2-helm/raw/main/img/lfx-logo-color.svg
dependencies:
- name: traefik
Expand Down
24 changes: 21 additions & 3 deletions charts/lfx-platform/templates/openfga/model.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ spec:
- patch: Modifications of define
*/}}
- version:
major: 5
minor: 3
patch: 2
major: 6
minor: 0
patch: 0
authorizationModel: |
model
schema 1.1
Expand Down Expand Up @@ -98,6 +98,15 @@ spec:
# only certain privileged users can view it.
define viewer: [user:*] or participant or organizer or auditor

# The meeting_attachment type identifies an attachment of a meeting.
type meeting_attachment
relations
define meeting: [meeting]
define writer: organizer from meeting
define auditor: auditor from meeting
Copy link
Member

@jordane jordane Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

writer should also have audit permissions (if they differ from viewer). If auditor is only used as a kind of viewer, then perhaps leave a note since this differs from the other style of models where auditor has access to read things that viewers don't, typically.

Copy link
Contributor Author

@andrest50 andrest50 Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright I can add the writer as a passthrough to the auditor relation. Technically auditor via meeting means organizer via meeting has auditor permission, but to be more explicit I'll just include it on this line.

define participant: participant from meeting
define viewer: [user:*] or participant or writer or auditor

type past_meeting
relations
define project: [project]
Expand All @@ -122,6 +131,15 @@ spec:
# only certain privileged users can view it.
define viewer: [user:*] or attendee or invitee or organizer or auditor

# The past_meeting_attachment type identifies an attachment of a past meeting.
type past_meeting_attachment
relations
define past_meeting: [past_meeting]
define writer: organizer from past_meeting
define auditor: auditor from past_meeting
define participant: host from past_meeting or invitee from past_meeting or attendee from past_meeting
define viewer: [user:*] or participant or writer or auditor

# The past_meeting_recording type identifies a recording of a past meeting.
# Access to a recording is limited to one of the following groups:
# - Only meeting hosts
Expand Down