feat: add ory get opl

[alnr]

Closes #321

Problem

Ory Network does not inline the Ory Permission Language file in the project config — it stores a pointer to it. So ory get permission-config returns:

{"limit":{},"namespaces":{"location":"https://storage.googleapis.com/bac-gcs-production/xxxxx.bin"}}

The reporter's complaint was accurate on two counts:

1. There was no way to read the file back. ory update opl --file ... could write it, but nothing could retrieve it — the permission config was writable as code but not retrievable as code, which breaks the gitops round-trip.
2. The command's own example was wrong. It advertised inline {"namespaces":[{"name":"files","id":1}]}, which the command never returns for an OPL-based project, and carried a stray 1 in the sample JSON.

Fix

ory get opl resolves the location and writes the file to stdout, so it can be redirected to disk and checked into version control:

ory get opl > namespace_config.ts

The get permission-config example now shows what the command actually returns, and points at ory get opl for the file itself.

Resolution goes through ory/x/fetcher restricted to http, https and base64 — the same fetcher update_namespace_config_test.go already uses. That choice matters for four reasons:

• Status codes are checked. An expired storage link returns a GCS XML error body with err == nil from a plain reader, so ory get opl > namespaces.ts would have written <Error><Code>AccessDenied</Code>... into the file and exited 0 — the user commits an error page as their permission model.
• The download is cancellable, since the fetcher takes cmd.Context().
• base64:// payloads are redacted from errors. ory update opl stores the location as base64://<whole file>; without redaction a decode failure dumps a multi-kilobyte blob to stderr.
• The scheme allowlist states the no-local-files rule positively. The location comes from the API and must never make the CLI read the developer's disk.

Two further fixes found in review:

• The permission service is read through the generated nil-safe accessor. ProjectServices.Permission is a pointer with omitempty, so a project without a permission service panicked — including in the pre-existing get permission-config, which this branch already touched.
• An empty legacy namespace list ("namespaces": []) now reports "nothing configured" rather than sending the user to a command that would show them an empty list.

Tests

• TestOPLLocation covers location extraction: OPL pointer, legacy list, empty legacy list, missing/null/empty location, nil config.
• TestOPLLocationIsReadable pins the loader contract — remote reads work, HTTP error responses are not mistaken for the file (httptest 403 with a GCS-style body), and a real local file is refused. The local-file case writes the file first; the earlier version asserted against a non-existent path and would have passed with the allowlist removed.
• TestUpdateNamespaceConfig gains a round-trip: the OPL uploaded by update opl / patch must come back byte-identical from get opl, for both project-selection modes. This ran against live staging and passes, so the resolve-and-fetch path is verified end to end and not just at the unit level.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JYzGVwAKQ4ormxRHZg1eDu

Summary by CodeRabbit

• New Features

  • Added cloudx get opl to retrieve a project’s Ory Permission Language (OPL) file.
  • Supports OPL locations using HTTPS, HTTP, and base64 sources.
  • Outputs OPL content unchanged for reuse with update commands.

• Improvements

  • Updated permission configuration output and help text to reflect separately stored OPL files.
  • Improved configuration access consistency across identity, permission, and OAuth2 services.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 189e884b-2412-4ffe-902d-1dbb20090337

📥 Commits

Reviewing files that changed from the base of the PR and between d13941f and 5dbabb2.

📒 Files selected for processing (7)

• cmd/cloudx/project/get_identity_config.go
• cmd/cloudx/project/get_namespace_config.go
• cmd/cloudx/project/get_namespace_config_live_test.go
• cmd/cloudx/project/get_namespace_config_test.go
• cmd/cloudx/project/get_oauth2_config.go
• cmd/cloudx/project/update_namespace_config.go
• cmd/cloudx/project/utils.go

🚧 Files skipped from review as they are similar to previous changes (2)

• cmd/cloudx/project/get_namespace_config_test.go
• cmd/cloudx/project/get_namespace_config_live_test.go

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Project OPL retrieval

Layer / File(s)	Summary
Permission configuration source cmd/cloudx/project/get_permission_config.go, cmd/cloudx/project/get_identity_config.go, cmd/cloudx/project/get_oauth2_config.go, cmd/cloudx/project/update_namespace_config.go, cmd/cloudx/project/utils.go	Updates permission configuration documentation and uses service accessor methods for configuration output and update paths.
OPL location resolution and retrieval cmd/cloudx/project/get_namespace_config.go, cmd/cloudx/get.go	Adds the opl command, resolves namespace configuration, fetches OPL content from supported locations, writes it to stdout, and registers the command under cloudx get.
OPL behavior validation cmd/cloudx/project/get_namespace_config_test.go, cmd/cloudx/project/get_namespace_config_live_test.go	Tests location parsing, base64 and HTTP retrieval, rejected file URLs, HTTP errors, and exact update/get round trips.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 5dbab

This adds retrieval of Ory Permission Language files and updates related configuration handling; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant CLI as cloudx get opl
  participant Project as project services
  participant Resolver as oplLocation
  participant Fetcher as fetcher
  CLI->>Project: load permission configuration
  CLI->>Resolver: resolve namespaces.location
  Resolver-->>CLI: return OPL location
  CLI->>Fetcher: fetch bytes from allowed scheme
  Fetcher-->>CLI: return OPL bytes
  CLI-->>CLI: write bytes to stdout

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding the ory get opl command.
Description check	✅ Passed	The description explains the problem, implementation, tests, related issue, and user-facing behavior; omitted template checklist items are non-critical.
Linked Issues check	✅ Passed	The PR addresses issue #321 by adding ory get opl, correcting the permission-config example, and providing retrieval and round-trip coverage.
Out of Scope Changes check	✅ Passed	The accessor updates, documentation changes, validation rules, error handling, and tests directly support the linked issue and stated objectives.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/321-get-opl

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[aeneasr]

I think could cause problems when you import it again, will it not? Because the format is not the same?

so "keto get project > config.yaml" and then "keto update project --from config.yaml"

[alnr]

I think could cause problems when you import it again, will it not? Because the format is not the same?

so "keto get project > config.yaml" and then "keto update project --from config.yaml"

This change does not touch keto get project (is that even a command?).

This change only adds ory get opl, which we had already advertised as existing for years 😅

I've added a test that verifies ory get opl | ory update opl --file - round-trips.

Does that make sense?

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/cloudx/project/get_namespace_config.go`:
- Around line 80-83: Replace the .CommandPath placeholder in the Example help
text with the literal command invocation, using “$ ory get opl --project ...” so
Cobra displays the intended command directly in default help output.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cd580244-4eed-4822-a541-1d057a05f03e

📥 Commits

Reviewing files that changed from the base of the PR and between 6b55b72 and d13941f.

📒 Files selected for processing (5)

• cmd/cloudx/get.go
• cmd/cloudx/project/get_namespace_config.go
• cmd/cloudx/project/get_namespace_config_live_test.go
• cmd/cloudx/project/get_namespace_config_test.go
• cmd/cloudx/project/get_permission_config.go