Permify integration

[dealloc]

.NET Aspire issue link

No response

Overview

Support for Permify in Aspire

Usage example

var permify = builder.AddPermify()
    .WithDatabase(database);

// using
builder.AddProject<Example>("example")
    .WithReference(permify);

Additional context

No response

Help us help you

Yes, I'd like to be assigned to work on this item

[aaronpowell]

Sounds like a good companion to the auth choices available with Keycloak and the proposed OpenFGA (#1043) integration.

Consider how the config would be managed - is there a .NET object model that exists (maybe the SDK?) for the YAML config file, otherwise, how would the database be effectively provided from the PostgreSQL resource to the Permify container.

[dealloc]

I'm writing a .NET client right now over at dealloc/permify-client, for the Aspire example I'm currently using the following code:

var postgres = builder.AddPostgres("postgres")
    .WithArgs("-c", "track_commit_timestamp=on")
    .AddDatabase("permify-db");

var permify = builder.AddContainer("permify", "permify/permify")
    .WithImageTag("latest")
    .WithImageRegistry("ghcr.io")
    .WithHttpEndpoint(targetPort: 3476, name: "http")
    .WithHttpEndpoint(targetPort: 3478, name: "grpc")
    .WithHttpHealthCheck("/healthz")
    .WithEnvironment("PERMIFY_DATABASE_ENGINE", "postgres")
    .WithEnvironment("PERMIFY_DATABASE_URI", postgres.Resource.UriExpression)
    .WithEnvironment("PERMIFY_SERVICE_WATCH_ENABLED", "true");

The track_commit_timestamp is optional and only required when using the watch service.
If you don't pass in the postgres bit it just runs entirely in-memory (but it won't persist and the watch service doesn't work as it relies on Postgres for notifications).

I think the only thing I'd have to look into (but I'm sure you guys know this off the top of your head) is that Permify exposes 2 endpoints, a HTTP one and gRPC one and preferably I'd inject both with just .WithReference(permify) rather than the WithHttpEndpoint I'm doing now.

My clienta side there's I think around 2 other clients that could be used, though I don't know how well they integrate with Aspire as-is.

[aaronpowell]

What about the config file described here? How much of that can be modelled in the app host or should people be expected to write a YAML file that it consumes?

For providing the endpoints to a client, that's easily done using a connection string and just defining a custom format that you want to consume.

[dealloc]

All YAML configuration can be passed as environment variables by prefixing with PERMIFY_ and uppercasing everything.

so the Yaml path service.watch.enabled would become PERMIFY_SERVICE_WATCH_ENABLED (which I actually have in my previous example).

as far as I'm aware, no yaml required :)

[dealloc]

@aaronpowell when making a PR, do I target main or aspire-13.1 like in #1021 ?

[github-actions]

We have noticed this issue has not been updated within 21 days. If there is no action on this issue in the next 14 days, we will automatically close it. You can use /stale-extend to extend the window.

[dealloc]

/stale-extend

[aaronpowell]

@aaronpowell when making a PR, do I target main or aspire-13.1 like in #1021 ?

Target main, as I will get around to doing a merge of the 13.1 branch and release that soon

[dealloc]

@aaronpowell opened a PR, added some questions regarding potential conflicts and the OTLP integration

[github-actions]

We have noticed this issue has not been updated within 21 days. If there is no action on this issue in the next 14 days, we will automatically close it. You can use /stale-extend to extend the window.

[github-actions]

This issue has been stale for 5 weeks and has been automatically closed.