refactor: remove OPA/Cedar/permit.io stubs from engine#176
Conversation
These will be reimplemented as external plugins (workflow-plugin-policy-opa, workflow-plugin-policy-cedar) consistent with the plugin architecture. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR refactors the policy engine to remove stub implementations of OPA and Cedar backends that had no real functionality, along with the permit.io RBAC provider stub. These will be reimplemented as external plugins following the plugin architecture pattern.
Changes:
- Removed non-functional OPA and Cedar policy backend stubs from the core engine
- Removed permit.io RBAC provider stub that only returned errors
- Updated error messages to direct users to external plugins for OPA/Cedar backends
- Retained the mock policy backend and all policy pipeline steps for testing
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| module/policy_engine.go | Removed OPA/Cedar backend implementations and isTruthy helper; added clear error messages directing users to external plugins |
| plugins/policy/plugin.go | Removed policy.opa and policy.cedar module factories and schemas; updated documentation to reflect mock-only core support |
| cmd/wfctl/type_registry.go | Removed policy.opa and policy.cedar from known module types registry |
| plugin/rbac/permit.go | Deleted permit.io stub provider that returned errors for all operations |
| plugin/rbac/builtin_test.go | Removed permit.io stub tests; retained AWS IAM provider name check test |
| m.engine = newOPAPolicyEngine(endpoint, allowStub) | ||
| slog.Warn("WARNING: using stub policy engine — all requests will be DENIED. Set allow_stub_backends: true in config to use stub backends for testing.", | ||
| "module", m.name, "backend", "opa", "allow_stub_backends", allowStub) | ||
| return fmt.Errorf("opa backend not built-in; use the workflow-plugin-policy-opa external plugin") |
There was a problem hiding this comment.
The error message could be more actionable by including a brief instruction on how to use the external plugin. Consider: "opa backend not built-in; install and load the workflow-plugin-policy-opa external plugin, then use backend: 'mock' or configure the OPA module type from the plugin"
| m.engine = newCedarPolicyEngine(allowStub) | ||
| slog.Warn("WARNING: using stub policy engine — all requests will be DENIED. Set allow_stub_backends: true in config to use stub backends for testing.", | ||
| "module", m.name, "backend", "cedar", "allow_stub_backends", allowStub) | ||
| return fmt.Errorf("cedar backend not built-in; use the workflow-plugin-policy-cedar external plugin") |
There was a problem hiding this comment.
The error message could be more actionable by including a brief instruction on how to use the external plugin. Consider: "cedar backend not built-in; install and load the workflow-plugin-policy-cedar external plugin, then use backend: 'mock' or configure the Cedar module type from the plugin"
| return fmt.Errorf("cedar backend not built-in; use the workflow-plugin-policy-cedar external plugin") | |
| return fmt.Errorf("cedar backend not built-in; install and load the workflow-plugin-policy-cedar external plugin, then use backend: 'mock' or configure the Cedar module type from the plugin") |
Summary
PolicyEngineinterface,PolicyDecision, mock backend, and allstep.policy_*pipeline stepsworkflow-plugin-policy-opa,workflow-plugin-policy-cedar) consistent with the plugin architecturebackend: opaorbackend: cedarnow get a clear error directing them to the external pluginFiles Changed
module/policy_engine.go— removed OPA/Cedar structs, updated Init() to return helpful errorsplugins/policy/plugin.go— removed OPA/Cedar module type registrationscmd/wfctl/type_registry.go— removed OPA/Cedar from known module typesplugin/rbac/permit.go— deleted (stub that returned errors)plugin/rbac/builtin_test.go— updated testsTest plan
go build ./...passesgo vet ./...passesgo test ./module/... ./plugins/policy/...passes🤖 Generated with Claude Code