{"id":15610970,"url":"https://github.com/umbrellaassociates/opa-spicedb","last_synced_at":"2025-10-13T16:30:29.830Z","repository":{"id":257807668,"uuid":"856083345","full_name":"umbrellaassociates/opa-spicedb","owner":"umbrellaassociates","description":"Open Policy Agent extension for Authzed SpiceDB","archived":false,"fork":false,"pushed_at":"2024-10-23T15:16:24.000Z","size":536,"stargazers_count":12,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-10-23T19:41:36.963Z","etag":null,"topics":["open-policy-agent","spicedb"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/umbrellaassociates.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-09-12T00:46:38.000Z","updated_at":"2024-10-23T15:16:29.000Z","dependencies_parsed_at":"2024-11-27T06:48:47.171Z","dependency_job_id":null,"html_url":"https://github.com/umbrellaassociates/opa-spicedb","commit_stats":null,"previous_names":["umbrellaassociates/opa-spicedb"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umbrellaassociates%2Fopa-spicedb","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umbrellaassociates%2Fopa-spicedb/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umbrellaassociates%2Fopa-spicedb/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umbrellaassociates%2Fopa-spicedb/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/umbrellaassociates","download_url":"https://codeload.github.com/umbrellaassociates/opa-spicedb/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":236364871,"owners_count":19137423,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["open-policy-agent","spicedb"],"created_at":"2024-10-03T06:02:16.039Z","updated_at":"2025-10-13T16:30:29.823Z","avatar_url":"https://github.com/umbrellaassociates.png","language":"Go","funding_links":[],"categories":["Developer Tools","Datasource Integrations"],"sub_categories":["Third-party Tools","Blogs and Articles"],"readme":"Open Policy Agent with support for Authzed SpiceDB\n---\n\nThis plugin adds support for querying and manipulating relations from [Authzed](https://authzed.com/) [SpiceDB](https://github.com/authzed/spicedb) via gRPC as custom builtin commands for [Open Policy Agent](https://www.openpolicyagent.org/).\n\n\n\u003cbr /\u003e\n\u003cimg src=\"doc/opa-spicedb-demo.gif\" alt=\"topaz model visualization\"\u003e\n\n\n## Why use OPA?\n\n[OPA (Open Policy Agent)](https://www.openpolicyagent.org/) decouples policy from code in a highly-performant and elegant way, which makes it perfect for use as an external PDP (Policy Decision Point) for applictions in your stack, implementing a Policy-Based Access Control scheme (PBAC).\n\n## Why use Authzed SpiceDB?\n\n[Authzed SpiceDB](https://authzed.com/spicedb) is an open source authorization system for Relationship-Based Access Control (ReBAC), originally inspired by [Google's Zanzibar paper](https://www.usenix.org/conference/atc19/presentation/pang) and one of the most advanced implementation of it.\n\n\n## Policy 📃 + Relations 🧠 = 💪 fine-grained access control\n\nPBAC and ReBAC are both strong models for fine-grained access control, while OPA and SpiceDB are award winning solutions and the best-of-breed products for their respective categories.\n\nCombining PBAC and ReBAC results in a flexible and powerful authorizer that can effectively used to protect millions of objects.\n\u003cbr /\u003e\n\n\n## Supported methods and features\n\n - SpiceDB gRPC interface available in Rego\n - automatic schema-prefix removal\n\nCurrently implemented methods:\n - check_permission\n - lookup_resources\n - lookup_subjects\n - read_relationships\n - write_relationships\n - delete_relationships\n - read_schema\n\n\n### Builtin rego functions for SpiceDB\n\n#### Check permission:\n\n```\n\nspicedb.check_permission(\"resourceType\", \"resourceId\", \"permission\", \"subjectType\", \"subjectId\")\n\n## result:\n{\n  \"lookedUpAt\": \"\u003ctoken\u003e\",\n  \"result\": true\n}\n\n```\n\n#### Resource lookup\n\n```\nspicedb.lookup_resources(\"resourceType\", \"permission\", \"subjectType\", \"subjectId\") \n\n## result:\n{\n  \"lookedUpAt\": \"\u003ctoken\u003e\",\n  \"permission\": \"\u003cpermission\u003e\",\n  \"resourceObjectIds\": [\n    \"\u003cresourceId 1\u003e\",\n    \"\u003cresourceId n\u003e\"\n  ],\n  \"resourceObjectType\": \"\u003cresourceType\u003e\",\n  \"result\": true,\n  \"subjectId\": \"\u003csubjectId\u003e\",\n  \"subjectType\": \"\u003csubjectType\u003e\"\n}\n\n```\n\n#### Subject lookup\n\n```\nspicedb.lookup_subjects(\"\u003cresourceType\u003e\", \"\u003cresourceId\u003e\", \"\u003cpermission\u003e\", \"\u003csubjectType\u003e\")\n## result:\n{\n  \"lookedUpAt\": \"\u003ctoken\u003e\",\n  \"permission\": \"\u003cpermission\u003e\",\n  \"resourceObjectId\": \"\u003cresourceId\u003e\",\n  \"resourceObjectType\": \"\u003cresourceType\u003e\",\n  \"result\": true,\n  \"subjectIds\": [\n    \"\u003csubjectId 1\u003e\",\n    \"\u003csubjectId n\u003e\"\n  ],\n  \"subjectType\": \"\u003csubjectType\u003e\"\n}\n\n```\n\n#### Write, touch and delete relationships in a single request\n\n```\nwrite_relations := [\n  {\"resourceType\": \"\u003cresourceType\u003e\", \"resourceId\": \"\u003cresourceId\u003e\", \"relationship\": \"\u003crelationship\u003e\", \"subjectType\": \"\u003csubjectType\u003e\", \"subjectId\": \"\u003csubjectId\u003e\"},\n]\n\ntouch_relations := []\ndelete_relations := []\n\nspicedb.write_relationships(write_relations, touch_relations, delete_relations)\n\n## result:\n{\n  \"result\": true,\n  \"writtenAt\": \"\u003ctoken\u003e\"\n}\n\n```\n\n#### Perform read relationships request\n\n```\n\nspicedb.read_relationships(\"\u003cresourceType\u003e\", \"\u003coptional-resourceId\u003e\", \"\u003coptional-permission\u003e\", \"\u003coptional-subjectType\u003e\", \"\u003coptional-subjectId\u003e\")\n\n## result:\n{\n  \"lookedUpAt\": \"\u003ctoken\u003e\",\n  \"result\": true,\n  \"relationships\": [\n    {\n      \"relationship\": \"\u003crelation\u003e\",\n      \"resourceId\": \"\u003cresourceId\u003e\",\n      \"resourceType\": \"\u003cresourceType\u003e\",\n      \"subjectId\": \"\u003csubjectId\u003e\",\n      \"subjectType\": \"\u003csubjectType\u003e\"\n    }\n  ]\n}\n\n\n```\n\n#### Perform delete relationships request\n\n```\nspicedb.delete_relationships(\"\u003cresourceType\u003e\", \"\u003coptional-resourceId\u003e\", \"\u003coptional-permission\u003e\", \"\u003coptional-subjectType\u003e\", \"\u003coptional-subjectId\u003e\")\n\n## result:\n{\n  \"deletedAt\": \"\u003ctoken\u003e\",\n  \"result\": true\n}\n\n```\n\n#### Perform read schema request\n\n```\nspicedb.read_schema()\n\n## result:\n{\n  \"read_at\": {\n    \"token\": \"GgoKCENLcW9BZz09\"\n  },\n  \"schema_text\": \"definition user {}\\n\\ndefinition resource {....}\"\n}\n\n\n```\n\n# Build 🚀\n\nMake sure you have Go 1.24 installed.\n\n```\nmake build\n```\n\nOr building directly:\n\n```\ngo build -o opa-spicedb .\n```\n\n\n# Demo ✨\n\n\u003e Start authzed demo environment\n\n```\ndocker compose -f demo/docker-compose.yaml up -d\n```\n\n\u003e Run Open Policy Agent with spicedb plugin enabled\n\n\n```\n./opa-spicedb run \\\n  --set plugins.spicedb.endpoint=localhost:50051 \\\n  --set plugins.spicedb.token=foobar \\\n  --set plugins.spicedb.insecure=true\n```\n\n\u003e or use a configuration file\n\n```\n./opa-spicedb run -c demo/opa-config-demo.yaml\n\n```\n\n\n\u003e Query relations against authzed\n\u003e See the [example ReBAC schema](./demo/schema-and-data.yaml) for reference.\n\n```\n\u003e spicedb.check_permission(\"document\",\"firstdoc\", \"view\", \"user\",\"alice\")\n{\n  \"lookedUpAt\": \"GhUKEzE3MjYwOTIxNjAwMDAwMDAwMDA=\",\n  \"result\": true\n}\n\n\u003e spicedb.check_permission(\"document\",\"firstdoc\", \"edit\", \"user\",\"bob\")\n{\n  \"lookedUpAt\": \"GhUKEzE3MjY2MTcxMzAwMDAwMDAwMDA=\",\n  \"result\": false\n}\n\u003e exit\n\n```\n\n\u003e Stop demo environment\n\n```\ndocker compose -f demo/docker-compose.yaml down\n```\n\n### Run in docker\n\nFind the docker images on [docker hub](https://hub.docker.com/r/umbrellaassociates/opa-spicedb/).\n\nPull the docker image:\n\n``` \ndocker pull umbrellaassociates/opa-spicedb:latest \n```\n\nOPA configuration to connect to SpiceDB:\n\n* plugins.spicedb.endpoint (endpoint address, eg. spicedb:50052)\n* plugins.spicedb.token (authentication token, eg. secretToken)\n* plugins.spicedb.insecure (disable gRPC security, eg. true)\n* plugins.spicedb.schemaprefix (set a schema prefix, eg. prefix)\n\n\nRun the extended OPA server and expose the server on the host.\n\nSpiceDB endpoint is expected to be reachable under spicedb-host:50051\n\n```\ndocker run -it --rm -p 8181:8181 umbrellaassociates/opa-spicedb:latest run --server --set 'decision_logs.console=true' --log-level=debug --set plugins.spicedb.endpoint=spicedb-host:50051 --set plugins.spicedb.token=foobar --set plugins.spicedb.insecure=true --addr :8181\n```\n\n\n## 🤝 Contributing\n\nThis project is a work in progress.\nIf something is broken or there's a feature that you want, feel free to check [issues page]() and if so inclined submit a PR!\n\nContributions, issues and feature requests are welcome.\u003cbr /\u003e\n\nHere are some general guidelines:\u003cbr\u003e\n\n* File an issue first prior to submitting a PR!\n* Ensure all exported items are properly commented\n* If applicable, submit a test suite against your PR\n\n\n\n## Show your support\n\nPlease ⭐️ this repository if this project helped you!\n\n\n## Authors\n\n👤 **Roland Baum**\n\n- Github: [@tr33](https://github.com/tr33)\n\n👤 **umbrella.associates**\n\n- web: [www.umbrella.associates](https://www.umbrella.associates/)\n\n\n## Credits\n\n- [@thomasdarimont](https://github.com/thomasdarimont/)\n\n\n## 📝 License\n\nCopyright © 2025 [umbrella.associates](https://github.com/umbrellaassociates).\u003cbr /\u003e\nThis project is under [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) licensed.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fumbrellaassociates%2Fopa-spicedb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fumbrellaassociates%2Fopa-spicedb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fumbrellaassociates%2Fopa-spicedb/lists"}