Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release stytch-go v12 with new RBAC features #158

Merged
merged 9 commits into from
Dec 13, 2023
Merged

Conversation

logan-stytch
Copy link
Contributor

@logan-stytch logan-stytch commented Dec 8, 2023

RBAC

  • The Stytch product will soon support role-based access control (RBAC)! See our RBAC guide at https://stytch.com/docs/b2b/guides/rbac/overview for more detailed explanations of our RBAC product.
  • RBAC policies must be set through the dashboard, but you can use various endpoints to assign Roles to Members and add implicit role assignments to Organizations and SSO connections (more details in the guide at https://stytch.com/docs/b2b/guides/rbac/role-assignment).
  • You can perform an RBAC authorization check when authenticating a JWT. This will use a locally cached version of the RBAC policy.
  • Some endpoints, such as Create Member, offer out-of-the-box handling of RBAC authorization checks if a session token or session JWT is passed in.

Other changes

  • The inner HTTP handler (not intended to be exposed as a public interface, but currently is just by virtue of Go packaging) has a required headers field now. As a note, in the future if we change this interface, we will not count it as a MAJOR version update. This class should be considered an implementation detail to any external users of the library. This refers to stytch.Client, not stytchapi.API or b2bstytchapi.API.
  • Many "product struct" constructors (like b2b.SessionsClient, for example) have updated fields in their New methods to make creation more obvious (and remove requirements around doing things like setting a JWKS after the struct has been instantiated). This shouldn't affect any user of the library, but is technically a breaking change. Like the previous point, in the future if we change this interface, we will not count it as a MAJOR version update. This class should be considered an implementation detail to any external users of the library. The expected entry point for consumers of this library is via stytchapi.API or b2bstytchapi.API and instantiating something like a b2b.OrganizationsClient directly is not supported.
  • Some methods will now have a new optional $METHODRequestOptions field – this is used to supply authorization data for RBAC (see previous point).
  • AuthenticateJWT and AuthenticateJWTLocal now accept an optional AuthorizationCheck parameter for performing RBAC checks. These will use a cached version of the project's RBAC policy in order to make an authZ verdict.
  • Built a LazyCache (which is intended to only be exposed internally) that is used for fetching the project's RBAC policy only when needed – by default this expires every 5 minutes, but only refreshes upon receiving a request that will use the value. This means that if your project does not use RBAC, the cache will never fetch the policy.
  • Additionally, this update features a large amount of documentation updates which should better reflect what you can find at https://stytch.com/docs.

@logan-stytch logan-stytch requested a review from a team as a code owner December 8, 2023 02:36
@logan-stytch logan-stytch changed the title [DNM] Release stytch-go v12 with new RBAC features Release stytch-go v12 with new RBAC features Dec 13, 2023
Copy link
Contributor

@nikhil-stytch nikhil-stytch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving code and release notes 👍

@logan-stytch logan-stytch merged commit 2a252dd into main Dec 13, 2023
5 checks passed
@logan-stytch logan-stytch deleted the v12-prerelease branch December 13, 2023 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants