Skip to content

feat(spicedb): logs #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ShakedSol merged 7 commits into from
Dec 31, 2025
Merged

feat(spicedb): logs #64

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4954ac1
feat(spicedb): release
ShakedSol Dec 30, 2025
ca1c761
enhance(spicedb): integrate logging client into query methods for imp…
ShakedSol Dec 31, 2025
2801e1f
Merge branch 'next' into FR-23027
ShakedSol Dec 31, 2025
b582c14
refactor(spicedb): optimize logging format in checkBulkPermissions me…
ShakedSol Dec 31, 2025
4e3279e
Merge branch 'FR-23027' of github.com:frontegg/entitlements-client in…
ShakedSol Dec 31, 2025
a70fc11
refactor(spicedb): conditionally log requests and responses in isEnti…
ShakedSol Dec 31, 2025
08601b6
refactor(spicedb): add logResults parameter to query classes for cond…
ShakedSol Dec 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion src/spicedb/spicedb-entitlements.client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ export class SpiceDBEntitlementsClient {
v1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALS
).promises;

this.spiceDBQueryClient = new SpiceDBQueryClient(this.spiceClient);
this.spiceDBQueryClient = new SpiceDBQueryClient(this.spiceClient, this.loggingClient);
} catch (initError) {
void this.loggingClient.error({
action: 'SpiceDBClient:init:error',
Expand All @@ -55,7 +55,18 @@ export class SpiceDBEntitlementsClient {
requestContext: RequestContext
): Promise<EntitlementsResult> {
try {
await this.loggingClient.logRequest(
{ action: 'SpiceDB:isEntitledTo:request', subjectContext, requestContext },
null
);

const res = await this.spiceDBQueryClient.spiceDBQuery(subjectContext, requestContext);

await this.loggingClient.logRequest(
{ action: 'SpiceDB:isEntitledTo:response', subjectContext, requestContext },
res
);
Comment thread
cursor[bot] marked this conversation as resolved.
Outdated

if (res.result.monitoring || this.logResults) {
await this.loggingClient.log(subjectContext, requestContext, res);
}
Expand Down
18 changes: 17 additions & 1 deletion src/spicedb/spicedb-queries/entitlements-spicedb.query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,18 @@ import {
import { SpiceDBResponse } from '../../types/spicedb.dto';
import { SpiceDBEntities } from '../../types/spicedb-consts';
import { encodeObjectId } from './base64.utils';
import { LoggingClient } from '../../logging';

export interface HashOptions {
hashResourceId: boolean;
hashSubjectId: boolean;
}

export abstract class EntitlementsSpiceDBQuery {
protected constructor(protected readonly client: v1.ZedPromiseClientInterface) {}
protected constructor(
protected readonly client: v1.ZedPromiseClientInterface,
protected readonly loggingClient?: LoggingClient
) {}

abstract query(
entitlementsQuery: EntitlementsDynamicQuery<RequestContextType>
Expand Down Expand Up @@ -128,7 +132,19 @@ export abstract class EntitlementsSpiceDBQuery {
const context = subjectContext;
const caveatContext = this.createCaveatContext(context);
const request = this.createBulkPermissionsRequest(objectType, objectId, context, caveatContext);

await this.loggingClient?.logRequest(
{ action: 'SpiceDB:checkBulkPermissions:request', objectType, objectId, subjectContext },
{ request: JSON.stringify(request, null, 2) }
);

const res = await this.client.checkBulkPermissions(request);

await this.loggingClient?.logRequest(
{ action: 'SpiceDB:checkBulkPermissions:response', objectType, objectId },
{ response: JSON.stringify(res, null, 2) }
);
Comment thread
cursor[bot] marked this conversation as resolved.
Outdated
Comment thread
cursor[bot] marked this conversation as resolved.
Outdated

const result = this.processCheckBulkPermissionsResponse(res);

return {
Expand Down
8 changes: 6 additions & 2 deletions src/spicedb/spicedb-queries/features-spicedb.query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@ import { EntitlementsDynamicQuery, EntitlementsResult, RequestContextType, UserS
import { SpiceDBResponse } from '../../types/spicedb.dto';
import { v1 } from '@authzed/authzed-node';
import { SpiceDBEntities } from '../../types/spicedb-consts';
import { LoggingClient } from '../../logging';

export class FeaturesSpiceDBQuery extends EntitlementsSpiceDBQuery {
constructor(protected readonly client: v1.ZedPromiseClientInterface) {
super(client);
constructor(
protected readonly client: v1.ZedPromiseClientInterface,
loggingClient?: LoggingClient
) {
super(client, loggingClient);
}

async query({
Expand Down
8 changes: 6 additions & 2 deletions src/spicedb/spicedb-queries/fga-spicedb.query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@ import { EntitlementsDynamicQuery, EntitlementsResult, FGASubjectContext, Reques
import { SpiceDBResponse } from '../../types/spicedb.dto';
import { v1 } from '@authzed/authzed-node';
import { encodeObjectId } from './base64.utils';
import { LoggingClient } from '../../logging';

export class FgaSpiceDBQuery extends EntitlementsSpiceDBQuery {
constructor(protected readonly client: v1.ZedPromiseClientInterface) {
super(client);
constructor(
protected readonly client: v1.ZedPromiseClientInterface,
loggingClient?: LoggingClient
) {
super(client, loggingClient);
}

async query({
Expand Down
8 changes: 6 additions & 2 deletions src/spicedb/spicedb-queries/permission-spicedb.query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@ import { EntitlementsDynamicQuery, EntitlementsResult, RequestContextType, UserS
import { SpiceDBResponse } from '../../types/spicedb.dto';
import { v1 } from '@authzed/authzed-node';
import { SpiceDBEntities } from '../../types/spicedb-consts';
import { LoggingClient } from '../../logging';

export class PermissionSpiceDBQuery extends EntitlementsSpiceDBQuery {
constructor(protected readonly client: v1.ZedPromiseClientInterface) {
super(client);
constructor(
protected readonly client: v1.ZedPromiseClientInterface,
loggingClient?: LoggingClient
) {
super(client, loggingClient);
}

public async query({
Expand Down
8 changes: 6 additions & 2 deletions src/spicedb/spicedb-queries/route-spicedb.query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,17 @@ import { v1 } from '@authzed/authzed-node';
import { LRUCache } from 'lru-cache';
import { SpiceDBEntities } from '../../types/spicedb-consts';
import { encodeObjectId } from './base64.utils';
import { LoggingClient } from '../../logging';

export class RouteSpiceDBQuery extends EntitlementsSpiceDBQuery {
private readonly cache: LRUCache<string, any>;
private static readonly CACHE_TTL = 30 * 1000;

constructor(protected readonly client: v1.ZedPromiseClientInterface) {
super(client);
constructor(
protected readonly client: v1.ZedPromiseClientInterface,
loggingClient?: LoggingClient
) {
super(client, loggingClient);
this.cache = new LRUCache({ max: 100, ttl: RouteSpiceDBQuery.CACHE_TTL });
}

Expand Down
14 changes: 9 additions & 5 deletions src/spicedb/spicedb-queries/spicedb-query.client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,20 @@ import { FeaturesSpiceDBQuery } from './features-spicedb.query';
import { FgaSpiceDBQuery } from './fga-spicedb.query';
import { RouteSpiceDBQuery } from './route-spicedb.query';
import { v1 } from '@authzed/authzed-node';
import { LoggingClient } from '../../logging';

export class SpiceDBQueryClient {
private readonly strategy: Record<RequestContextType, EntitlementsSpiceDBQuery>;

constructor(private readonly client: v1.ZedPromiseClientInterface) {
constructor(
private readonly client: v1.ZedPromiseClientInterface,
loggingClient?: LoggingClient
) {
this.strategy = {
[RequestContextType.Permission]: new PermissionSpiceDBQuery(client),
[RequestContextType.Feature]: new FeaturesSpiceDBQuery(client),
[RequestContextType.Entity]: new FgaSpiceDBQuery(client),
[RequestContextType.Route]: new RouteSpiceDBQuery(client)
[RequestContextType.Permission]: new PermissionSpiceDBQuery(client, loggingClient),
[RequestContextType.Feature]: new FeaturesSpiceDBQuery(client, loggingClient),
[RequestContextType.Entity]: new FgaSpiceDBQuery(client, loggingClient),
[RequestContextType.Route]: new RouteSpiceDBQuery(client, loggingClient)
};
}

Expand Down
Loading