@jeffs-brain/memory-openfga

OpenFGA authorisation adapter for @jeffs-brain/memory. Implements the AccessControlProvider contract by talking to an OpenFGA server (or any API-compatible proxy) with plain fetch. No SDK dependencies, no bundled HTTP client.

Install

npm i @jeffs-brain/memory @jeffs-brain/memory-openfga
# or
bun add @jeffs-brain/memory @jeffs-brain/memory-openfga

Usage

import { createMemStore } from '@jeffs-brain/memory'
import { withAccessControl } from '@jeffs-brain/memory/acl'
import { createOpenFgaProvider } from '@jeffs-brain/memory-openfga'

const store = createMemStore()

const acl = createOpenFgaProvider({
  apiUrl: 'https://fga.example.com',
  storeId: 'store-1',
  modelId: 'model-42',
  token: process.env.OPENFGA_TOKEN,
})

const guarded = withAccessControl(
  store,
  acl,
  { kind: 'user', id: 'alice' },
  { resource: { type: 'brain', id: 'notes' } },
)

// `guarded` is a `Store`. Use it anywhere the unguarded store would go;
// every read/write/delete now runs through OpenFGA first.

modelId and token are optional. Omit modelId to let the OpenFGA server resolve the latest authorisation model for the store. Omit token when running against an unauthenticated dev server.

See @jeffs-brain/memory/acl for the provider contract and the in-box RBAC alternative. The shared FGA model lives at spec/openfga/schema.fga.

Lifecycle

acl.close?.() is a no-op for this adapter (the fetch transport owns no connection pool). Calling it is still recommended for forward compatibility when you swap providers or move to a transport that holds real state.

Feature support

• AccessControlProvider wire-compatible with withAccessControl and any caller using the contract directly.
• Pure fetch; no FGA SDK dependency.
• Works against any OpenFGA-compatible backend (self-hosted or managed).

Documentation

• Authorisation guide: https://docs.jeffsbrain.com/guides/authorization/
• TypeScript getting started: https://docs.jeffsbrain.com/getting-started/typescript/
• Protocol and storage spec: spec/

License

Apache-2.0. See LICENSE and NOTICE.