Add the Fleet Ops demo: multi-tenant fleet authorization on the Go SDK

.github/dependabot.yml

@@ -35,3 +35,15 @@ updates:
         update-types: [minor, patch]
         patterns:
           - '*'
+  - package-ecosystem: gomod
+    directory: /fleet-ops-demo
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+    groups:
+      go-dependencies:
+        update-types: [minor, patch]
+        patterns:
+          - '*'

.github/workflows/fleet-ops-demo.yaml

@@ -0,0 +1,100 @@
+name: fleet-ops-demo
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'fleet-ops-demo/**'
+      - '.github/workflows/fleet-ops-demo.yaml'
+  pull_request:
+    paths:
+      - 'fleet-ops-demo/**'
+      - '.github/workflows/fleet-ops-demo.yaml'
+
+concurrency:
+  # A new push to a PR cancels that PR's superseded run. Pushes to main get a
+  # group per commit, so no merge's run is cancelled or replaced while queued.
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+    working-directory: fleet-ops-demo
+
+jobs:
+  vuln:
+    name: Go vulnerability check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: fleet-ops-demo/go.mod
+          cache: false
+      # `go run module@version` checks the module against the Go checksum database before running it.
+      - name: Check the code and the toolchain for known vulnerabilities it reaches
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
+
+  go:
+    name: Go format, vet, build and tests
+    needs: vuln
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: fleet-ops-demo/go.mod
+          cache: false
+      - name: Check formatting
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [[ -n "$unformatted" ]]; then
+            printf 'gofmt would change:\n%s\n' "$unformatted"
+            exit 1
+          fi
+      - name: Vet
+        run: go vet ./...
+      - name: Build
+        run: go build ./...
+      - name: Staticcheck
+        run: go run honnef.co/go/tools/cmd/staticcheck@2025.1.1 ./...
+      - name: Test
+        run: go test -race ./...
+
+  rego:
+    name: Custom Rego checks and tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install verified opa binary
+        run: |
+          curl --fail --silent --show-error --location --max-time 60 \
+            https://github.com/open-policy-agent/opa/releases/download/v1.21.1/opa_linux_amd64_static \
+            --output "$RUNNER_TEMP/opa"
+          printf '%s  %s\n' \
+            '668506eb17a2eaa1fce6cc0d1f42ef85125d4ac5bda5fc74d1152d0c77145031' \
+            "$RUNNER_TEMP/opa" | sha256sum --check
+          chmod +x "$RUNNER_TEMP/opa"
+      # The rules are written in the Rego v0 syntax that Permit's generated policy uses.
+      - name: Check and test the custom rules
+        run: |
+          "$RUNNER_TEMP/opa" check --v0-compatible policy/
+          "$RUNNER_TEMP/opa" test --v0-compatible policy/

README.md

@@ -4,9 +4,10 @@ Runnable applications that use [Permit.io](https://www.permit.io) for authorizat
 lives in its own folder, with a README that explains how to run it and a CI workflow that runs only
 when that folder changes.
 
-| Example                                    | What it shows                                                                         | Stack                                         |
-| ------------------------------------------ | ------------------------------------------------------------------------------------- | --------------------------------------------- |
-| [permit-portal-demo](permit-portal-demo)   | A business portal whose every protected action asks Permit first, with five scenarios | TypeScript, Express, React, Docker, local PDP |
+| Example                                  | What it shows                                                                                             | Stack                                         |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------- |
+| [permit-portal-demo](permit-portal-demo) | A business portal whose every protected action asks Permit first, with five scenarios                     | TypeScript, Express, React, Docker, local PDP |
+| [fleet-ops-demo](fleet-ops-demo)         | A multi-tenant fleet app: roles down a 5-level tree, partner grants, attribute rules and tenant isolation | Go, Permit Go SDK, custom Rego, local PDP     |
 
 ## Checks
 

fleet-ops-demo/.env.example

@@ -0,0 +1,12 @@
+# Copy to .env (gitignored) and fill in the key.
+# An environment-scoped API key from the Permit dashboard. The setup, the app and the PDP use it, and
+# only this one: a different PERMIT_API_KEY exported in your shell stops the commands.
+PERMIT_API_KEY=
+PERMIT_API_URL=https://api.permit.io
+# Optional: the project and environment keys. `make setup` and `make reset` stop when the API key
+# belongs to another environment; the app shows them on its start line.
+PERMIT_PROJECT=
+PERMIT_ENV=
+PDP_URL=http://localhost:7766
+OPA_URL=http://localhost:8181
+PORT=3000

fleet-ops-demo/.gitignore

@@ -0,0 +1,4 @@
+.env
+bin/
+# A clone of the Permit GitOps environment branch, for `make apply-policy`.
+policy-repo/

fleet-ops-demo/.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+# prek runs these hooks from this folder, on this folder's files. The repository-wide
+# hooks (secrets, workflows, shell scripts) live in the root .pre-commit-config.yaml.
+repos:
+  - repo: local
+    hooks:
+      - id: gofmt
+        name: gofmt
+        entry: sh -c 'test -z "$(gofmt -l .)" || { gofmt -l .; exit 1; }'
+        language: system
+        pass_filenames: false
+        types: [go]
+      - id: go-vet
+        name: go vet
+        entry: go vet ./...
+        language: system
+        pass_filenames: false
+        types: [go]
+      - id: go-test
+        name: go test
+        entry: go test ./...
+        language: system
+        pass_filenames: false
+        types: [go]
+      - id: opa-test
+        name: Custom Rego tests
+        entry: opa test --v0-compatible policy/
+        language: system
+        pass_filenames: false
+        files: ^policy/.*\.rego$

fleet-ops-demo/Makefile

@@ -0,0 +1,29 @@
+# Fleet Ops: a multi-tenant fleet app on the Permit Go SDK. Needs Docker and Go; `make test` also
+# needs the opa CLI. Every command reads .env in this folder (copy .env.example).
+.PHONY: pdp setup reset build start verify apply-policy test
+
+# Compose lets a PERMIT_API_KEY exported in the shell override .env; the PDP takes the key in .env.
+pdp:           ## start the local container PDP (port 7766)
+	env -u PERMIT_API_KEY docker compose --env-file .env up -d pdp
+
+setup:         ## make Permit's schema match the code, then restore the seed data
+	go run ./cmd/sync
+
+reset:         ## restore the seeded data in Permit; restart the app afterwards
+	go run ./cmd/sync --reset
+
+build:         ## build the server into bin/
+	go build -o bin/fleetops-server ./cmd/server
+
+start: build   ## run the app on http://localhost:3000
+	./bin/fleetops-server
+
+verify:        ## pre-flight: PDP up, custom rules loaded, expected decisions
+	go run ./cmd/verify
+
+apply-policy:  ## install the custom rules in the GitOps branch and restart the PDP
+	go run ./cmd/apply-policy
+
+test:          ## unit tests: Go, and the custom Rego
+	go test ./...
+	opa test --v0-compatible policy/