signoz

mirror of https://github.com/SigNoz/signoz.git synced 2026-09-07 03:50:41 +01:00

Files

Vikrant Gupta 7faab60ea7 feat(authz): enable FGA for ingestion keys and limits (#12626 )

#### Description

- Moves all ingestion key and limit routes from the legacy `EditAccess`
gate to `CheckResources` + `ResourceDef`s (kinds `ingestion-key` /
`ingestion-limit`) with scoped security schemes.
- Limit create checks `create` on the limit plus `attach` on the parent
key; limit delete checks `delete` plus `detach`, resolving the parent
key via the new upstream get-limit call.
- Grants `attach`/`detach` on `ingestion-key` to the admin and editor
managed roles; migration 120 backfills all ingestion tuples for existing
organizations and refreshes the managed roles' `transaction_groups`.

Stacked on #12625.

#### Issues closed by this PR

Closes SigNoz/platform-pod#2651

#### Additional Information

- Wiremock fixtures now use UUID key/limit IDs — the metaresource FGA
selector only accepts UUIDs.
- Delete requests make one extra upstream GET (parent-key resolution)
before the authz verdict, mirroring the serviceaccount extractor
pattern.

2026-09-03 09:34:15 +00:00