initAuthzEngine initializes the embedded OpenFGA authorization engine from the --fga-store / --fga-store-url config, shared by the server (root) and the MCP subcommand. OpenFGA migrations run on boot for SQL stores (idempotent); the in-memory store needs none. Engine-init failure is deliberately NO
(cfg *config.Config, log *zerolog.Logger)
| 23 | // The returned cleanup func is always non-nil and safe to defer; it closes |
| 24 | // the engine when one was created. |
| 25 | func initAuthzEngine(cfg *config.Config, log *zerolog.Logger) (engine.AuthorizationEngine, func()) { |
| 26 | cleanup := func() {} |
| 27 | fgaStore, fgaStoreURL, fgaEnabled := cfg.FGAStoreConfig() |
| 28 | if !fgaEnabled { |
| 29 | return nil, cleanup |
| 30 | } |
| 31 | runMigrations := !strings.EqualFold(fgaStore, fgaengine.StoreMemory) |
| 32 | fgaEngine, err := fgaengine.New( |
| 33 | &fgaengine.Config{ |
| 34 | Store: fgaStore, |
| 35 | StoreURL: fgaStoreURL, |
| 36 | StoreName: cfg.OrganizationName, |
| 37 | RunMigrations: runMigrations, |
| 38 | }, |
| 39 | &fgaengine.Dependencies{Log: log}, |
| 40 | ) |
| 41 | if err != nil { |
| 42 | log.Error().Err(err). |
| 43 | Str("fga_store", fgaStore). |
| 44 | Msg("failed to initialize OpenFGA authorization engine; fine-grained authorization is DISABLED (fail-closed) — core auth continues") |
| 45 | return nil, cleanup |
| 46 | } |
| 47 | if closer, ok := fgaEngine.(interface{ Close() }); ok { |
| 48 | cleanup = closer.Close |
| 49 | } |
| 50 | log.Info(). |
| 51 | Str("fga_store", fgaStore). |
| 52 | Bool("reused_main_db", strings.TrimSpace(cfg.FGAStore) == ""). |
| 53 | Msg("OpenFGA authorization engine initialized (embedded)") |
| 54 | return fgaEngine, cleanup |
| 55 | } |
no test coverage detected