support for rel and namespace deprecation

Signed-off-by: Kartikay <[email protected]>

Author: kartikaysaxena

internal/relationships/validation.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authzed/spicedb/internal/namespace"
+	"github.com/authzed/spicedb/internal/services/shared"
 	"github.com/authzed/spicedb/pkg/caveats"
 	caveattypes "github.com/authzed/spicedb/pkg/caveats/types"
 	"github.com/authzed/spicedb/pkg/datastore"
@@ -52,6 +53,19 @@ func ValidateRelationshipUpdates(
 		}
 	}
 
+	ts := schema.NewTypeSystem(schema.ResolverForDatastoreReader(reader))
+
+	// check if the relation is deprecated for create or touch operations
+	var relsToCheck []tuple.Relationship
+	for _, update := range updates {
+		if update.Operation == tuple.UpdateOperationTouch || update.Operation == tuple.UpdateOperationCreate {
+			relsToCheck = append(relsToCheck, update.Relationship)
+		}
+	}
+	if err := CheckDeprecationsOnRelationships(ctx, relsToCheck, ts); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -84,6 +98,13 @@ func ValidateRelationshipsForCreateOrTouch(
 		}
 	}
 
+	ts := schema.NewTypeSystem(schema.ResolverForDatastoreReader(reader))
+
+	// Validate if the resource, relation or subject is deprecated
+	if err := CheckDeprecationsOnRelationships(ctx, rels, ts); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -277,3 +298,23 @@ func hasNonEmptyCaveatContext(relationship tuple.Relationship) bool {
 		relationship.OptionalCaveat.Context != nil &&
 		len(relationship.OptionalCaveat.Context.GetFields()) > 0
 }
+
+func CheckDeprecationsOnRelationships(
+	ctx context.Context,
+	relationships []tuple.Relationship,
+	ts *schema.TypeSystem,
+) error {
+	for _, rel := range relationships {
+		if err := checkForDeprecatedRelationsAndObjects(ctx, rel, ts); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func checkForDeprecatedRelationsAndObjects(ctx context.Context, rel tuple.Relationship, ts *schema.TypeSystem) error {
+	if err := ts.CheckRelationshipDeprecation(ctx, rel); err != nil {
+		return shared.NewDeprecationError(err)
+	}
+	return nil
+}

internal/relationships/validation_test.go

@@ -306,6 +306,200 @@ func TestValidateRelationshipOperations(t *testing.T) {
 			core.RelationTupleUpdate_CREATE,
 			"subjects of type `user with somecaveat and expiration` are not allowed on relation `resource#viewer`",
 		},
+		{
+			"deprecation relation test",
+			`use deprecation
+			definition testuser {}
+			definition user {}
+
+			definition document {
+				@deprecated(error,"deprecated, migrate away")
+				relation editor: testuser
+				relation viewer: user
+			}`,
+			"document:foo#editor@testuser:tom",
+			core.RelationTupleUpdate_CREATE,
+			"relation document#editor is deprecated: deprecated, migrate away",
+		},
+		{
+			"deprecated namespace test",
+			`use deprecation
+			@deprecated(error, "deprecated, migrate away")
+			definition testuser {}
+			definition user {}
+
+			definition document {
+				relation editor: testuser
+			}`,
+			"document:foo#editor@testuser:tom",
+			core.RelationTupleUpdate_CREATE,
+			"object type testuser is deprecated: deprecated, migrate away",
+		},
+		{
+			"deprecated relation subject type",
+			`use deprecation
+			definition user {}
+			definition testuser {}
+
+			definition platform {
+				relation viewer: user | @deprecated(warn, "comments") testuser
+				relation auditor: user | @deprecated(error, "test") testuser
+			}`,
+			"platform:foo#auditor@testuser:test",
+			core.RelationTupleUpdate_CREATE,
+			"object type testuser is deprecated: test",
+		},
+		{
+			"deprecated relation same subject type with wildcard",
+			`use deprecation
+			definition user {}
+			definition testuser {}
+
+			definition platform {
+				relation viewer: user | @deprecated(warn, "comments") testuser
+				relation auditor: testuser | @deprecated(error, "no wildcard please") testuser:*
+			}`,
+			"platform:foo#auditor@testuser:*",
+			core.RelationTupleUpdate_CREATE,
+			"wildcard allowed type testuser:* is deprecated: no wildcard please",
+		},
+		{
+			"deprecated subject without expiration when expiration required",
+			`use expiration
+			use deprecation
+
+			@deprecated(error, "do not use testuser")
+			definition testuser {}
+
+			definition document {
+				relation viewer: testuser with expiration
+			}`,
+			"document:foo#viewer@testuser:tom",
+			core.RelationTupleUpdate_CREATE,
+			"subjects of type `testuser` are not allowed on relation `document#viewer`; did you mean `testuser with expiration`?",
+		},
+		{
+			"deprecated subject with expiration",
+			`use expiration
+			use deprecation
+
+			@deprecated(error, "do not use testuser")
+			definition testuser {}
+
+			definition document {
+				relation viewer: testuser with expiration
+			}`,
+			"document:foo#viewer@testuser:tom[expiration:2021-01-01T00:00:00Z]",
+			core.RelationTupleUpdate_CREATE,
+			"object type testuser is deprecated: do not use testuser",
+		},
+		{
+			"deprecated subject with wrong caveat",
+			`use deprecation
+
+			caveat somecaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			caveat anothercaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			@deprecated(error, "do not use testuser")
+			definition testuser {}
+
+			definition document {
+				relation viewer: testuser with somecaveat
+			}`,
+			"document:foo#viewer@testuser:tom[anothercaveat]",
+			core.RelationTupleUpdate_CREATE,
+			"subjects of type `testuser with anothercaveat` are not allowed on relation `document#viewer`",
+		},
+		{
+			"deprecated subject with correct caveat",
+			`use deprecation
+
+			caveat somecaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			@deprecated(error, "do not use testuser")
+			definition testuser {}
+
+			definition document {
+				relation viewer: testuser with somecaveat
+			}`,
+			"document:foo#viewer@testuser:tom[somecaveat]",
+			core.RelationTupleUpdate_CREATE,
+			"object type testuser is deprecated: do not use testuser",
+		},
+		{
+			"deprecated subject without caveat when required",
+			`use deprecation
+
+			caveat somecaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			@deprecated(error, "do not use testuser")
+			definition testuser {}
+
+			definition document {
+				relation viewer: testuser with somecaveat
+			}`,
+			"document:foo#viewer@testuser:tom",
+			core.RelationTupleUpdate_CREATE,
+			"subjects of type `testuser` are not allowed on relation `document#viewer` without one of the following caveats: somecaveat",
+		},
+		{
+			"deprecated user with caveat and expiration",
+			`use expiration
+			use deprecation
+
+			caveat somecaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			definition user {}
+
+			definition document {
+				relation viewer: user | @deprecated(error, "don't use this") user with somecaveat and expiration
+			}`,
+			"document:foo#viewer@user:tom[somecaveat][expiration:2021-01-01T00:00:00Z]",
+			core.RelationTupleUpdate_CREATE,
+			"object type user with caveat `somecaveat` and expiration is deprecated: don't use this",
+		},
+		{
+			"deprecated user with caveat only",
+			`use deprecation
+
+			caveat somecaveat(somecondition int) {
+				somecondition == 42
+			}
+
+			definition user {}
+
+			definition document {
+				relation viewer: user | @deprecated(error, "caveated access deprecated") user with somecaveat
+			}`,
+			"document:foo#viewer@user:tom[somecaveat]",
+			core.RelationTupleUpdate_CREATE,
+			"object type user with caveat `somecaveat` is deprecated: caveated access deprecated",
+		},
+		{
+			"deprecated user with expiration only",
+			`use expiration
+			use deprecation
+
+			definition user {}
+
+			definition document {
+				relation viewer: user | @deprecated(error, "expiring access deprecated") user with expiration
+			}`,
+			"document:foo#viewer@user:tom[expiration:2021-01-01T00:00:00Z]",
+			core.RelationTupleUpdate_CREATE,
+			"object type user with expiration is deprecated: expiring access deprecated",
+		},
 	}
 
 	for _, tc := range tcs {

internal/services/server.go

@@ -73,6 +73,7 @@ func RegisterGrpcServices(
 			CaveatTypeSet:                    permSysConfig.CaveatTypeSet,
 			AdditiveOnly:                     schemaServiceOption == V1SchemaServiceAdditiveOnly,
 			ExpiringRelsEnabled:              permSysConfig.ExpiringRelationshipsEnabled,
+			FeatureDeprecationEnabled:        permSysConfig.DeprecatedRelationshipsAndObjectsEnabled,
 			PerformanceInsightMetricsEnabled: permSysConfig.PerformanceInsightMetricsEnabled,
 		}
 		v1.RegisterSchemaServiceServer(srv, v1svc.NewSchemaServer(schemaConfig))

internal/services/shared/errors.go

@@ -47,6 +47,29 @@ func NewSchemaWriteDataValidationError(message string, args ...any) SchemaWriteD
 	}
 }
 
+// DeprecationError is an error returned when a schema object or relation is deprecated.
+type DeprecationError struct {
+	error
+}
+
+func (err DeprecationError) GRPCStatus() *status.Status {
+	return spiceerrors.WithCodeAndDetails(
+		err,
+		codes.Aborted,
+		spiceerrors.ForReason(
+			// TODO: replace with a deprecation type error reason
+			v1.ErrorReason_ERROR_REASON_SCHEMA_TYPE_ERROR,
+			map[string]string{},
+		),
+	)
+}
+
+func NewDeprecationError(err error) DeprecationError {
+	return DeprecationError{
+		error: err,
+	}
+}
+
 // SchemaWriteDataValidationError occurs when a schema cannot be applied due to leaving data unreferenced.
 type SchemaWriteDataValidationError struct {
 	error

internal/services/v1/relationships.go

@@ -104,6 +104,9 @@ type PermissionsServerConfig struct {
 	// ExpiringRelationshipsEnabled defines whether or not expiring relationships are enabled.
 	ExpiringRelationshipsEnabled bool
 
+	// DeprecatedRelationshipsEnabled defines whether or not deprecated relationships are enabled.
+	DeprecatedRelationshipsAndObjectsEnabled bool
+
 	// CaveatTypeSet is the set of caveat types to use for caveats. If not specified,
 	// the default type set is used.
 	CaveatTypeSet *caveattypes.TypeSet
@@ -118,22 +121,23 @@ func NewPermissionsServer(
 	config PermissionsServerConfig,
 ) v1.PermissionsServiceServer {
 	configWithDefaults := PermissionsServerConfig{
-		MaxPreconditionsCount:            defaultIfZero(config.MaxPreconditionsCount, 1000),
-		MaxUpdatesPerWrite:               defaultIfZero(config.MaxUpdatesPerWrite, 1000),
-		MaximumAPIDepth:                  defaultIfZero(config.MaximumAPIDepth, 50),
-		StreamingAPITimeout:              defaultIfZero(config.StreamingAPITimeout, 30*time.Second),
-		MaxCaveatContextSize:             defaultIfZero(config.MaxCaveatContextSize, 4096),
-		MaxRelationshipContextSize:       defaultIfZero(config.MaxRelationshipContextSize, 25_000),
-		MaxDatastoreReadPageSize:         defaultIfZero(config.MaxDatastoreReadPageSize, 1_000),
-		MaxReadRelationshipsLimit:        defaultIfZero(config.MaxReadRelationshipsLimit, 1_000),
-		MaxDeleteRelationshipsLimit:      defaultIfZero(config.MaxDeleteRelationshipsLimit, 1_000),
-		MaxLookupResourcesLimit:          defaultIfZero(config.MaxLookupResourcesLimit, 1_000),
-		MaxBulkExportRelationshipsLimit:  defaultIfZero(config.MaxBulkExportRelationshipsLimit, 100_000),
-		DispatchChunkSize:                defaultIfZero(config.DispatchChunkSize, 100),
-		MaxCheckBulkConcurrency:          defaultIfZero(config.MaxCheckBulkConcurrency, 50),
-		CaveatTypeSet:                    caveattypes.TypeSetOrDefault(config.CaveatTypeSet),
-		ExpiringRelationshipsEnabled:     config.ExpiringRelationshipsEnabled,
-		PerformanceInsightMetricsEnabled: config.PerformanceInsightMetricsEnabled,
+		MaxPreconditionsCount:                    defaultIfZero(config.MaxPreconditionsCount, 1000),
+		MaxUpdatesPerWrite:                       defaultIfZero(config.MaxUpdatesPerWrite, 1000),
+		MaximumAPIDepth:                          defaultIfZero(config.MaximumAPIDepth, 50),
+		StreamingAPITimeout:                      defaultIfZero(config.StreamingAPITimeout, 30*time.Second),
+		MaxCaveatContextSize:                     defaultIfZero(config.MaxCaveatContextSize, 4096),
+		MaxRelationshipContextSize:               defaultIfZero(config.MaxRelationshipContextSize, 25_000),
+		MaxDatastoreReadPageSize:                 defaultIfZero(config.MaxDatastoreReadPageSize, 1_000),
+		MaxReadRelationshipsLimit:                defaultIfZero(config.MaxReadRelationshipsLimit, 1_000),
+		MaxDeleteRelationshipsLimit:              defaultIfZero(config.MaxDeleteRelationshipsLimit, 1_000),
+		MaxLookupResourcesLimit:                  defaultIfZero(config.MaxLookupResourcesLimit, 1_000),
+		MaxBulkExportRelationshipsLimit:          defaultIfZero(config.MaxBulkExportRelationshipsLimit, 100_000),
+		DispatchChunkSize:                        defaultIfZero(config.DispatchChunkSize, 100),
+		MaxCheckBulkConcurrency:                  defaultIfZero(config.MaxCheckBulkConcurrency, 50),
+		CaveatTypeSet:                            caveattypes.TypeSetOrDefault(config.CaveatTypeSet),
+		ExpiringRelationshipsEnabled:             config.ExpiringRelationshipsEnabled,
+		DeprecatedRelationshipsAndObjectsEnabled: config.DeprecatedRelationshipsAndObjectsEnabled,
+		PerformanceInsightMetricsEnabled:         config.PerformanceInsightMetricsEnabled,
 	}
 
 	return &permissionServer{
@@ -324,6 +328,7 @@ func (ps *permissionServer) WriteRelationships(ctx context.Context, req *v1.Writ
 	updateRelationshipSet := mapz.NewSet[string]()
 	for _, update := range req.Updates {
 		// TODO(jschorr): Change to struct-based keys.
+
 		tupleStr := tuple.V1StringRelationshipWithoutCaveatOrExpiration(update.Relationship)
 		if !updateRelationshipSet.Add(tupleStr) {
 			return nil, ps.rewriteError(