topaz VS granite-orm

OPA is a great tool for implementing a policy-as-code system. But if you're trying to use it for application authorization (e.g. fine-grained authz for B2B SaaS or a set of internal applications), you may find that its policy story is strong, but it doesn't really have a "data plane": you either store data in a data.json file and rebuild the policy any time that data changes, or make an http.send call out of the policy to fetch dynamic data.

Check out Topaz [0], which uses OPA as its decision engine, but adds a data plane that is based on the ReBAC ideas explored in the Google Zanzibar [1] paper.

Disclaimer: I work on the team [2] that builds and maintains the Topaz project.

[0] https://www.topaz.sh

[1] https://research.google/pubs/zanzibar-googles-consistent-glo...

[2] https://www.aserto.com

You can, simply use the topazd.exe binary from the topaz_windows_x86_64.zip from the GH releases page (https://github.com/aserto-dev/topaz/releases). Note this is currently not a Windows Service, so not net start topaz. Let me know if that would be interesting.

Topaz is an open-source authorization project for cloud-native applications. It uses OPA as the decision engine and supports Rego policy as first-class citizens. It also has an embedded relationship database to support data-centric authorization models like Google Zanzibar's relationship-based access controls (ReBAC).

This project has been half a year in the making. I've learned so much from it, most importantly Crystal and learning to love SQLite and hate Postgres. The journey led me through contributing to several dependencies, including the Granite ORM, Markd, the SQLite3 bindings, and even creating Sanemark implementing it in a fork of Markd!

The 3 Crystal ORMs I've checked out, Granite, Clear, and Jennifer, are all 10k lines or less. Given Crystal's pragmatism-before-purity philosophy compared to Rust, I'd expect them to be a little briefer, but not that much.

The "generate create table SQL from model definition" feature is not usable for my use case because it doesn't treat foreign keys at all, only basic fields and types. It actually doesn't even support NOT NULL columns right now except for the primary key, and my PR to fix that has been hanging for two weeks.