OpenFGA Integration

[daveads]

Feature: Add OpenFGA Policy Store to OPAL

This PR addresses issue #661 by integrating OpenFGA Policy Store into OPAL.

/claim #661

[netlify]

✅ Deploy Preview for opal-docs canceled.

Name	Link
🔨 Latest commit	f8c3eea
🔍 Latest deploy log	https://app.netlify.com/sites/opal-docs/deploys/6746e5696a54c40008903dfc

[daveads]

OpenFGA OPAL Integration Project Checklist

Week 1: Setup and Core Implementation

Days 1-2: Project Setup and Research

• Set up development environment
• Review OpenFGA documentation and API
• Analyze OPAL's existing policy store implementations

Days 3-5: Core Implementation

• Implement OpenFGA configuration in OPAL
• Develop basic OpenFGA policy store interface
• Begin implementation of auto-sync from git for OpenFGA models/policies

Week 2: Feature Completion and Demo Preparation

Days 1-3: Feature Implementation

• Complete auto-sync from git for OpenFGA models/policies
• Implement data fetching pattern and syncing from external data sources
• Start working on Docker-compose examples

Days 4-5: Demo Preparation

• Develop end-to-end demo with example ReBAC policies and mock data
• Finalize Docker-compose examples for single and multiple OpenFGA clients
• Prepare demonstration environment

Key Milestones:

1. End of Week 1: Basic OpenFGA policy store implementation
2. End of Week 2: Working end-to-end demo
3. End of Week 3: update later*
4. End of Week 4: update later*

[daveads]

Updates ::

Integration into Opal has already begun but is currently on hold. I'm working on the components in isolation from Opal, using the OpenFGA SDK first.
it's been interesting so far.

[daveads]

I've completed the isolation test and also simulated integration with OPAL in isolation. At some point, I had to mix the Python SDK with the raw API, but I'll likely find a fix for that later.

The test that involved missing the Python SDK and accessing via the raw API and stimulating opal integration was successful.

Going start core implementation asap

[daveads]

I've completed the isolation test and also simulated integration with OPAL in isolation. At some point, I had to mix the Python SDK with the raw API, but I'll likely find a fix for that later.

The test that involved missing the Python SDK and accessing via the raw API and stimulating opal integration was successful.

Going start core implementation asap

recording.mp4

[daveads]

@garnerp just push that to show what have been working on locally....

to show my current progress...

[gemanor]

@daveads I bet you meant to tag me. Any updates on this?

[daveads]

@daveads I bet you meant to tag me. Any updates on this?

oh oh... yea i meant to tag... lol

still on it... will give you an update on it soon

[daveads]

currently having issues with the config... buh i should fix it soon.

[daveads]

Demo ready...

just fixing bugs...

opening pr for now...

[daveads]

Based on my discussion with @gemanor, Decided to drop the use of openfga_sdk and use API calls instead, similar to the OPA implementation.

[iwphonedo]

Hi @daveads, here is my initial review to the implementation. Please feel free to contact me with any comment/question.

Best,
Israel

[daveads]

Sure @iwphonedo i will check them out today.

[daveads]

working on the failing pytests...

[daveads]

review.mp4