https://github.com/theopenlane/core
Core holds the central schema definitions, resolvers, endpoints, and other tooling associated with the Openlane product suite
https://github.com/theopenlane/core
api backend go golang graphql openlane
Last synced: 4 months ago
JSON representation
Core holds the central schema definitions, resolvers, endpoints, and other tooling associated with the Openlane product suite
- Host: GitHub
- URL: https://github.com/theopenlane/core
- Owner: theopenlane
- License: apache-2.0
- Created: 2024-08-24T15:26:59.000Z (9 months ago)
- Default Branch: main
- Last Pushed: 2025-02-05T20:36:27.000Z (4 months ago)
- Last Synced: 2025-02-05T20:57:24.491Z (4 months ago)
- Topics: api, backend, go, golang, graphql, openlane
- Language: Go
- Homepage: https://theopenlane.io
- Size: 26.3 MB
- Stars: 20
- Watchers: 2
- Forks: 7
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- Contributing: .github/CONTRIBUTING.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
[](https://goreportcard.com/report/github.com/theopenlane/core)
[](https://buildkite.com/theopenlane/core)
[](https://pkg.go.dev/github.com/theopenlane/core)
[](https://opensource.org/licenses/Apache-2.0)
[](https://sonarcloud.io/summary/new_code?id=theopenlane_core)
This repository houses the core server and orchestration elements which are at
the heart of the [openlane](https://www.theopenlane.io) cloud service, which is targeted for public beta towards the end of 2024 or early 2025. Our initial featureset includes:
- Creation of new programs that include pre-built templates, controls, risks, etc., from standards like SOC2, ISO27001, NIST800-53, and more
- Automated Task assignments and configurable workflows
- Questionnaire creation, customization, and automation for easier internal and external interactions with your staff, auditors, and vendors
- Notification customizations, channel definitions, comments and histories on all your objects
- Easy to use documentation editors and storage for Policies and Procedures, or whatever documentation is needed
.... and more!
We have our sights set on additional features such as:
- Trust Center and vanity domains
- Automated Evidence collection
- Continuous GRC features
## Features
At it's core, this repo is a collection of services built on top of an entity
framework which allows us to:
- Model database schemas as graph structures
- Define schemas as programmatic go code
- Execute complex database queries and graph traversals easily
- Extend and customize using templates and code generation utilities
- Type-safe resolvers and GraphQL schema stitching
- Code generated audit / history tables for defined schemas
On top of this powerful core we also have an incredible amount of pluggable,
extensible services:
- Authentication: we today support password, OAuth2 / Social login providers
(Github, Google), Passkeys as well as standard OIDC Discovery flows (NOTE: you will need to create your own github or google client secrets and leverage them to take advantage of this capability)
- Multi-factor: built-in 2FA mechanisms, TOTP
- Authorization: extensible and flexible permissions constructs via openFGA
based on Google Zanzibar
- Session Management: built-in session management with JWKS key validation,
encrypted cookies and sessions
- Robust Middleware: cache control, CORS, Rate Limiting, transaction rollbacks,
and more
- Queuing and Scheduling: Task management and scheduling with
[riverqueue](https://github.com/riverqueue/river)
- External Storage Providers: store data in AWS S3, Google GCS, or locally
- External Database Providers: Leverage NeonDB, or other PostgreSQL compatible
vendors and libraries
- Data Isolation and Management: Hierarchal organizations and granular
permissions controls
## Development
### Dependencies
The vast majority of behaviors of the system can be turned on or off by updating
the configuration parameters found in `config`; in some instances, we've made
features or integrations with third party systems which are "always on", but
we're happy to receive PR's wrapping those dependencies if you are interested in
running the software without them!
### Installing Dependencies
Setup [Taskfile](https://taskfile.dev/installation/) by following the
instructions and using one of the various convenient package managers or
installation scripts. After installation, you can then simply run `task install`
to load the associated dependencies. Nearly everything in this repository
assumes you already have a local golang environment setup so this is not
included. Please see the associated documentation.
### Updating Configuration Settings
See the [README](/config/README.md) in the `config` directory.
### Starting the Server
1. Copy the config, this is in .gitignore so you do not have to worry about
accidentally committing secrets
```bash
cp ./config/config-dev.example.yaml ./config/.config.yaml
```
1. Update the configuration with whatever respective settings you desire; the
defaults inside should allow you to run the server without a problem
1. Use the task commands to start the server
Run the core server in development mode with dependencies in docker
```bash
task run-dev
```
Run fully in docker
```bash
task docker:all:up
```
1. In a separate terminal, with the server running, you can create a verified
test user by running:
```bash
task cli:user:all
```
1. Once this command has finished ^, you can login and perform actions as user
`[email protected]` with password `mattisthebest1234`
### Creating Queries in GraphQL
The best method of forming / testing queries against the server is to run
`task docker:rover` which will launch an interactive query UI.
If you are running the queries against your local repo, you will have CORS
issues using the local running apollo. Instead, its recommended to use the
[apollo sandbox](https://studio.apollographql.com/sandbox/explorer) and ensure
the following origin is allowed in your `config/.config.yaml`
```
server:
cors:
allowOrigins:
- https://studio.apollographql.com
```
In the apollo settings you will need to configure your connection settings:
1. Endpoint: `http://localhost:17608/query`
1. Shared Headers: `Authorization` `Bearer tolp_REDCATED`
You can obtain a local personal access token or api token against your local api by running:
```
task cli:token:create
```
```
task cli:pat:create
```
These are also created automatically when you setup the test user using `task cli:user:all`
### OpenFGA Playground
You can load up a local openFGA environment with the compose setup in this
repository; `task fga:up` - this will launch an interactive playground where you
can model permissions model(s) or changes to the models
### Creating a new Schema
To ease the effort required to add additional schemas into the system a
template + task function has been created. This isn't doing anything terribly
complex, but it's attempting to ensure you have the _minimum_ set of required
things needed to create a schema - most notably: you need to ensure the IDMixin
is present (otherwise you will get ID type conflicts) and a standard set of
schema annotations.
NOTE: you still have to make intelligent decisions around things like the
presence / integration of hooks, interceptors, policies, etc. This is saving you
about 10 seconds of copy-paste, so don't over estimate the automation, here.
To generate a new schema, you can run `task newschema -- [yourschemaname]` where
you replace the name within `[]`. Please be sure to note that this isn't a
command line flag so there's a space between `--` and the name.
### Migrations
We use [atlas](https://atlasgo.io/) and
[goose](https://github.com/pressly/goose) to create and manage our DB
migrations - you can trigger one via `task atlas:create` and that will generate
the necessary migrations. There should be a new migration file created in
`db/migrations` and `db/migrations-goose-postgres`. On every PR, the Atlas
integration also creates comments with any issues related to the schema changes
/ migrations.
## Deploying
The only "supported" method of deploying today is locally, but we have a WIP
Helm chart which can be found [here](https://github.com/theopenlane/helm-charts)
## Contributing
See the [contributing](.github/CONTRIBUTING.md) guide for more information.
## UI
We have additionally open-sourced the [Openlane UI](https://github.com/theopenlane/openlane-ui) and you can run / use this technology locally (or host it on your own servers) but we have not undergone efforts to ensure things such as links to our Terms of Service or Privacy policy, or other prioritiary branding or assets owned by theopenlane, Inc., are fully configurable or removable.
## Sponsoring
If any of our code or projects have helped you or you just want to help us out, we massively appreciate a sponsorship on our github project of any level!