feat: add ory get opl

[alnr]

Closes #321

Problem

Ory Network does not inline the Ory Permission Language file in the project config — it stores a pointer to it. So ory get permission-config returns:

{"limit":{},"namespaces":{"location":"https://storage.googleapis.com/bac-gcs-production/xxxxx.bin"}}

The reporter's complaint was accurate on two counts:

1. There was no way to read the file back. ory update opl --file ... could write it, but nothing could retrieve it — the permission config was writable as code but not retrievable as code, which breaks the gitops round-trip.
2. The command's own example was wrong. It advertised inline {"namespaces":[{"name":"files","id":1}]}, which the command never returns for an OPL-based project, and carried a stray 1 in the sample JSON.

Fix

ory get opl resolves the location and writes the file to stdout, so it can be redirected to disk and checked into version control:

ory get opl > namespace_config.ts

The get permission-config example now shows what the command actually returns, and points at ory get opl for the file itself.

Resolution goes through ory/x/fetcher restricted to http, https and base64 — the same fetcher update_namespace_config_test.go already uses. That choice matters for four reasons:

• Status codes are checked. An expired storage link returns a GCS XML error body with err == nil from a plain reader, so ory get opl > namespaces.ts would have written <Error><Code>AccessDenied</Code>... into the file and exited 0 — the user commits an error page as their permission model.
• The download is cancellable, since the fetcher takes cmd.Context().
• base64:// payloads are redacted from errors. ory update opl stores the location as base64://<whole file>; without redaction a decode failure dumps a multi-kilobyte blob to stderr.
• The scheme allowlist states the no-local-files rule positively. The location comes from the API and must never make the CLI read the developer's disk.

Two further fixes found in review:

• The permission service is read through the generated nil-safe accessor. ProjectServices.Permission is a pointer with omitempty, so a project without a permission service panicked — including in the pre-existing get permission-config, which this branch already touched.
• An empty legacy namespace list ("namespaces": []) now reports "nothing configured" rather than sending the user to a command that would show them an empty list.

Tests

• TestOPLLocation covers location extraction: OPL pointer, legacy list, empty legacy list, missing/null/empty location, nil config.
• TestOPLLocationIsReadable pins the loader contract — remote reads work, HTTP error responses are not mistaken for the file (httptest 403 with a GCS-style body), and a real local file is refused. The local-file case writes the file first; the earlier version asserted against a non-existent path and would have passed with the allowlist removed.
• TestUpdateNamespaceConfig gains a round-trip: the OPL uploaded by update opl / patch must come back byte-identical from get opl, for both project-selection modes. This ran against live staging and passes, so the resolve-and-fetch path is verified end to end and not just at the unit level.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JYzGVwAKQ4ormxRHZg1eDu

Summary by CodeRabbit

• New Features

  • Added cloudx get opl to retrieve a project’s Ory Permission Language (OPL) file.
  • Supports OPL locations using HTTPS, HTTP, and base64 sources.
  • Outputs OPL content directly, preserving its format for reuse with update commands.

• Improvements

  • Updated permission configuration output and help text to reflect separately stored OPL files.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Project OPL retrieval

Layer / File(s)	Summary
Permission configuration source cmd/cloudx/project/get_permission_config.go	Updates permission configuration documentation and reads configuration through the permission service accessor.
OPL location resolution and retrieval cmd/cloudx/project/get_namespace_config.go, cmd/cloudx/get.go	Adds the opl command, resolves modern and legacy namespace configuration, fetches OPL from allowed locations, and registers the command under cloudx get.
OPL behavior validation cmd/cloudx/project/get_namespace_config_test.go, cmd/cloudx/project/get_namespace_config_live_test.go	Tests location parsing, base64 and HTTP retrieval, rejected file URLs, HTTP errors, and exact update/get round trips.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: zepatrik

Sequence Diagram(s)

sequenceDiagram
  participant CLI as cloudx get opl
  participant Project as Project permission service
  participant Resolver as oplLocation
  participant Fetcher as fetcher
  CLI->>Project: load permission config
  CLI->>Resolver: resolve namespaces.location
  Resolver-->>CLI: return OPL location
  CLI->>Fetcher: FetchBytes using allowed schemes
  Fetcher-->>CLI: return OPL bytes
  CLI-->>CLI: write bytes to stdout

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding the ory get opl command.
Description check	✅ Passed	The description covers the problem, fix, related issue, and testing, matching the template well enough.
Linked Issues check	✅ Passed	The PR addresses #321 by adding ory get opl and correcting the permission-config example.
Out of Scope Changes check	✅ Passed	The extra hardening changes support the new command and bug fix, so no clear out-of-scope work stands out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/321-get-opl

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[aeneasr]

I think could cause problems when you import it again, will it not? Because the format is not the same?

so "keto get project > config.yaml" and then "keto update project --from config.yaml"

[alnr]

I think could cause problems when you import it again, will it not? Because the format is not the same?

so "keto get project > config.yaml" and then "keto update project --from config.yaml"

This change does not touch keto get project (is that even a command?).

This change only adds ory get opl, which we had already advertised as existing for years 😅

I've added a test that verifies ory get opl | ory update opl --file - round-trips.

Does that make sense?

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/cloudx/project/get_namespace_config.go`:
- Around line 80-83: Replace the .CommandPath placeholder in the Example help
text with the literal command invocation, using “$ ory get opl --project ...” so
Cobra displays the intended command directly in default help output.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cd580244-4eed-4822-a541-1d057a05f03e

📥 Commits

Reviewing files that changed from the base of the PR and between 6b55b72 and d13941f.

📒 Files selected for processing (5)

• cmd/cloudx/get.go
• cmd/cloudx/project/get_namespace_config.go
• cmd/cloudx/project/get_namespace_config_live_test.go
• cmd/cloudx/project/get_namespace_config_test.go
• cmd/cloudx/project/get_permission_config.go