Skip to content

Commit 33ea993

Browse files
committed
Fix OpenTDF Authorization SDK documentation with accurate v1/v2 API examples
- Add both v1 and v2 API examples for Go SDK throughout documentation - Fix v2 API usage patterns: Resource nesting, EntityIdentifier wrappers, EphemeralId fields - Update JavaScript examples to use proper PlatformClient and token-based authentication - Standardize all platform endpoints to http://localhost:8080 - Add comprehensive v1 vs v2 API distinction and guidance - Ensure all Go code examples compile and work correctly - Add manual_tests/ to .gitignore
1 parent 8257d8b commit 33ea993

File tree

3 files changed

+451
-131
lines changed

3 files changed

+451
-131
lines changed

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,6 @@ node_modules
3838
.github/vale-styles/*
3939
# Except for the config directory where we keep the vocab
4040
!.github/vale-styles/config/
41+
42+
# Ignore manual test scripts
43+
manual_tests/

code_samples/authorization/get_decision.mdx

Lines changed: 137 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -6,66 +6,137 @@ import TabItem from '@theme/TabItem';
66
<Tabs>
77
<TabItem value="go" label="Go">
88

9+
#### V2 API (Recommended)
10+
911
```go
1012
package main
1113

1214
import (
1315
"context"
1416
"log"
1517

16-
"github.com/opentdf/platform/protocol/go/authorization"
18+
authorizationv2 "github.com/opentdf/platform/protocol/go/authorization/v2"
1719
"github.com/opentdf/platform/protocol/go/entity"
1820
"github.com/opentdf/platform/protocol/go/policy"
1921
"github.com/opentdf/platform/sdk"
2022
)
2123

2224
func main() {
23-
2425
platformEndpoint := "http://localhost:8080"
2526

2627
// Create a new client
2728
client, err := sdk.New(
2829
platformEndpoint,
2930
sdk.WithClientCredentials("opentdf", "secret", nil),
3031
)
31-
3232
if err != nil {
3333
log.Fatal(err)
3434
}
3535

3636
// Get Decision using v2 API
37-
decisionReq := &authorization.GetDecisionRequest{
38-
EntityIdentifier: &authorization.EntityIdentifier{
39-
EntityChain: &entity.EntityChain{
40-
Entities: []*entity.Entity{
41-
{
42-
Id: "entity-1",
43-
EntityType: &entity.Entity_ClientId{
44-
ClientId: "opentdf",
37+
decisionReq := &authorizationv2.GetDecisionRequest{
38+
EntityIdentifier: &authorizationv2.EntityIdentifier{
39+
Identifier: &authorizationv2.EntityIdentifier_EntityChain{
40+
EntityChain: &entity.EntityChain{
41+
Entities: []*entity.Entity{
42+
{
43+
EphemeralId: "entity-1",
44+
EntityType: &entity.Entity_ClientId{
45+
ClientId: "opentdf",
46+
},
47+
},
4548
},
4649
},
47-
},
4850
},
4951
},
5052
Action: &policy.Action{
5153
Name: "decrypt",
5254
},
53-
Resource: &authorization.Resource{
54-
AttributeValues: &authorization.Resource_AttributeValues{
55-
Fqns: []string{"https://opentdf.io/attr/role/value/developer"},
55+
Resource: &authorizationv2.Resource{
56+
Resource: &authorizationv2.Resource_AttributeValues_{
57+
AttributeValues: &authorizationv2.Resource_AttributeValues{
58+
Fqns: []string{"https://opentdf.io/attr/role/value/developer"},
59+
},
5660
},
5761
},
5862
}
5963

60-
decision, err := client.Authorization.GetDecision(context.Background(), decisionReq)
64+
decision, err := client.AuthorizationV2.GetDecision(context.Background(), decisionReq)
6165
if err != nil {
6266
log.Fatal(err)
6367
}
6468

6569
decisionResult := decision.GetDecision()
6670
log.Printf("Decision: %v", decisionResult.GetDecision())
67-
if decisionResult.GetDecision() == authorization.Decision_DECISION_PERMIT && len(decisionResult.GetObligations()) > 0 {
68-
log.Printf("Obligations: %v", decisionResult.GetObligations())
71+
if decisionResult.GetDecision() == authorizationv2.Decision_DECISION_PERMIT {
72+
log.Printf("✓ Access GRANTED")
73+
// Note: ResourceDecision doesn't have obligations in v2 API
74+
}
75+
}
76+
```
77+
78+
#### V1 API (Legacy)
79+
80+
```go
81+
package main
82+
83+
import (
84+
"context"
85+
"log"
86+
87+
"github.com/opentdf/platform/protocol/go/authorization"
88+
"github.com/opentdf/platform/protocol/go/policy"
89+
"github.com/opentdf/platform/sdk"
90+
)
91+
92+
func main() {
93+
platformEndpoint := "http://localhost:8080"
94+
95+
// Create a new client
96+
client, err := sdk.New(
97+
platformEndpoint,
98+
sdk.WithClientCredentials("opentdf", "secret", nil),
99+
)
100+
if err != nil {
101+
log.Fatal(err)
102+
}
103+
104+
// Get Decision using v1 API (bulk decisions)
105+
decisionRequests := []*authorization.DecisionRequest{{
106+
Actions: []*policy.Action{{
107+
Name: "decrypt",
108+
}},
109+
EntityChains: []*authorization.EntityChain{{
110+
Id: "ec1",
111+
Entities: []*authorization.Entity{{
112+
EntityType: &authorization.Entity_ClientId{
113+
ClientId: "opentdf",
114+
},
115+
Category: authorization.Entity_CATEGORY_SUBJECT,
116+
}},
117+
}},
118+
ResourceAttributes: []*authorization.ResourceAttribute{{
119+
AttributeValueFqns: []string{"https://opentdf.io/attr/role/value/developer"},
120+
}},
121+
}}
122+
123+
decisionRequest := &authorization.GetDecisionsRequest{
124+
DecisionRequests: decisionRequests,
125+
}
126+
127+
decisionResponse, err := client.Authorization.GetDecisions(context.Background(), decisionRequest)
128+
if err != nil {
129+
log.Fatal(err)
130+
}
131+
132+
for _, dr := range decisionResponse.GetDecisionResponses() {
133+
log.Printf("Decision for entity chain %s: %v", dr.GetEntityChainId(), dr.GetDecision())
134+
if dr.GetDecision() == authorization.DecisionResponse_DECISION_PERMIT {
135+
log.Printf("✓ Access GRANTED")
136+
if len(dr.GetObligations()) > 0 {
137+
log.Printf("Obligations: %v", dr.GetObligations())
138+
}
139+
}
69140
}
70141
}
71142
```
@@ -136,49 +207,63 @@ public class GetDecision {
136207
<TabItem value="js" label="Javascript">
137208

138209
```javascript
139-
const { AuthzClient } = require('@opentdf/client');
210+
import { PlatformClient } from '@opentdf/sdk/platform';
211+
import { AuthProviders } from '@opentdf/sdk';
212+
import { create } from '@bufbuild/protobuf';
213+
import { GetDecisionsRequestSchema, DecisionRequestSchema } from '@opentdf/sdk/platform';
140214

141215
async function main() {
142216
const platformEndpoint = 'http://localhost:8080';
143-
const clientId = 'opentdf';
144-
const clientSecret = 'secret';
145-
146-
// Create a new client
147-
const client = new AuthzClient({
148-
endpoint: platformEndpoint,
149-
auth: {
150-
clientId,
151-
clientSecret
152-
}
217+
218+
// Assume you have an existing access token
219+
const accessToken = 'your-access-token-here';
220+
221+
// Create auth provider with existing token
222+
const authProvider = await AuthProviders.accessTokenAuthProvider({
223+
accessToken: accessToken
224+
});
225+
226+
// Create platform client
227+
const platformClient = new PlatformClient({
228+
platformUrl: platformEndpoint,
229+
authProvider
153230
});
154231

155-
// Get Decision using v2 API
156-
const request = {
157-
entityIdentifier: {
158-
entityChain: {
159-
entities: [{
160-
id: 'entity-1',
161-
clientId: 'opentdf'
232+
// Get Decision using v1 API (bulk decisions)
233+
const request = create(GetDecisionsRequestSchema, {
234+
decisionRequests: [
235+
create(DecisionRequestSchema, {
236+
entityChains: [{
237+
id: 'ec1',
238+
entities: [{
239+
id: 'entity-1',
240+
entityType: {
241+
case: 'clientId',
242+
value: 'opentdf'
243+
},
244+
category: Entity_CategorySchema.SUBJECT
245+
}]
246+
}],
247+
actions: [{
248+
name: 'decrypt'
249+
}],
250+
resourceAttributes: [{
251+
resourceAttributesId: 'resource-1',
252+
attributeValueFqns: ['https://opentdf.io/attr/role/value/developer']
162253
}]
163-
}
164-
},
165-
action: {
166-
name: 'decrypt'
167-
},
168-
resource: {
169-
attributeValues: {
170-
fqns: ['https://opentdf.io/attr/role/value/developer']
171-
}
172-
}
173-
};
254+
})
255+
]
256+
});
174257

175258
try {
176-
const response = await client.getDecision(request);
259+
const response = await platformClient.v1.authorization.getDecisions(request);
177260

178-
console.log('Decision:', response.decision.decision);
179-
if (response.decision.decision === 'DECISION_PERMIT' && response.decision.obligations?.length > 0) {
180-
console.log('Obligations:', response.decision.obligations);
181-
}
261+
response.decisionResponses.forEach(decision => {
262+
console.log('Decision:', decision.decision);
263+
if (decision.decision === 'DECISION_PERMIT' && decision.obligations?.length > 0) {
264+
console.log('Obligations:', decision.obligations);
265+
}
266+
});
182267
} catch (error) {
183268
console.error('Error:', error);
184269
}

0 commit comments

Comments
 (0)