Vikrant Gupta 912c6073c5 feat(authz): add resource-level FGA for service accounts (#11065) ...

* feat(authz): add resource-level FGA and attach permissions for service accounts

- Add CheckAll middleware (AND of OR groups) for multi-resource authz checks
- Switch SA role routes (SetRole, DeleteRole) to VerbAttach on ResourceServiceAccount
- Add RoleAttachSelectors on SA module for role-level VerbAttach resolution
- DeleteRole uses CheckAll (both checks at middleware from URL params)
- SetRole uses Check (entity) at middleware + module-level role attach check
- Add migration 078 to backfill FGA tuples for existing organizations
- Add authz contributing guide (docs/contributing/go/authz.md)
- Regenerate OpenAPI spec with scoped security schemes

* feat(authz): fix openapi spec

* feat(authz): add attach permissions to migration

* feat(authz): role details page fixes

* fix(openapi): openapi changes for attach

* fix(openapi): openapi changes for attach

* fix(types): move types to middleware to remove http import from types

* test(integration): add integration tests

* test(integration): fix test lint and remove contributing guide

* feat(authz): revert role details changes

* feat(authz): move selectors to handler

* feat(authz): better naming for authz service and authz middleware

* feat(authz): better naming for authz service and authz middleware

2026-05-08 20:33:02 +00:00

..

binding

…

client

…

handler

…

middleware

feat(authz): add resource-level FGA for service accounts (#11065)

2026-05-08 20:33:02 +00:00

render

…

server

…

doc.go

…