generated from coulomb/repo-seed
tegwick
82177d88a9
Closes FLEX-WP-0005 T04. Validates ADR-003's commitment to shape the
standalone core for cheap Topaz adapter work.
Spike output:
- docs/topaz-mapping-spike.md — vocabulary map (subject, group, tenant,
knowledge_base, document, plus parent / owner_team / reader / steward /
member relations), Rego module shape, decision envelope, wire-protocol
ranking (gRPC primary, REST fallback, embedding rejected), schema
restatement recommendation, implications for FLEX-WP-0002 / 0004.
- examples/topaz/ — runnable docker-compose deploying Topaz with the
flex-auth-shaped manifest. seed and probe one-shots cover three
scenarios: alice (steward) allow, bob (group→reader) allow, eve
(outsider) deny. End-to-end green on 2026-05-16:
probe: steward-allow OK (check=true)
probe: reader-allow OK (check=true)
probe: outsider-deny OK (check=false)
probe: all checks passed
Key findings recorded as Implementation Notes in the spike doc:
- Rego input contract bridging (Topaz raw shape ↔ flex-auth canonical
shape) is adapter scope, not core scope.
- Topaz identity objects are a Topaz convention; the adapter
materializes them at directory import time.
- Directory-only permission resolution is sufficient for the common
case; Rego is reserved for context-dependent decisions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
44 lines
1.1 KiB
Bash
Executable File
44 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# Seed the Topaz directory: push the manifest, then objects and relations.
|
|
# Uses Topaz's directory REST gateway. Exits 0 on success.
|
|
|
|
set -eu
|
|
|
|
apk add --no-cache curl jq >/dev/null
|
|
|
|
DIR="${DIRECTORY_REST:-http://topaz:9393}"
|
|
echo "seed: directory REST = $DIR"
|
|
|
|
# 1. Push the directory model (manifest).
|
|
echo "seed: setting model"
|
|
curl -sf -X POST "$DIR/api/v3/directory/manifest" \
|
|
-H 'Content-Type: application/yaml' \
|
|
--data-binary @/manifest.yaml \
|
|
|| curl -sf -X POST "$DIR/api/v3/model" \
|
|
-H 'Content-Type: application/yaml' \
|
|
--data-binary @/manifest.yaml
|
|
|
|
echo
|
|
|
|
# 2. Push objects.
|
|
echo "seed: writing objects"
|
|
jq -c '.objects[]' /data/objects.json | while IFS= read -r obj; do
|
|
curl -sf -X POST "$DIR/api/v3/directory/object" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"object\":$obj}" >/dev/null
|
|
printf '.'
|
|
done
|
|
echo
|
|
|
|
# 3. Push relations.
|
|
echo "seed: writing relations"
|
|
jq -c '.relations[]' /data/relations.json | while IFS= read -r rel; do
|
|
curl -sf -X POST "$DIR/api/v3/directory/relation" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"relation\":$rel}" >/dev/null
|
|
printf '.'
|
|
done
|
|
echo
|
|
|
|
echo "seed: done"
|