跳到主要内容

Partner launch checklist

Governed policies, public OpenAPI, and Analytical Packs are previews. Require an affirmative capability response; dev configuration is not production enablement.

1. Establish the server boundary​

  • Create a Project and Environment; keep management/runtime keys server-side.
  • Authenticate the host user before policy, access, or token calls.
  • Use read-only database/API credentials and an allowlisted network destination.
  • Choose a track: service-credential OpenAPI now; partner JWT or delegated token exchange later. GraphQL persisted operations are later transport, not auth.

2. Create a deny-by-default policy​

Use dataira.dataPolicies.create() with a scoped key carrying embed.access.manage. Name each table unless all share one scope column.

{
  "name": "Customer analytics",
  "document": {
    "version": 1,
    "actions": ["queries.read", "dashboards.read", "conversations.read", "conversations.write"],
    "datasourceIds": ["ds_123"],
    "rowRules": [{ "table": "orders", "column": "customer_id", "operator": "eq", "claim": "attributes.customerId" }],
    "columnRules": [
      { "table": "orders", "column": "amount", "action": "allow" },
      { "table": "orders", "column": "customer_id", "action": "allow" }
    ],
    "defaultColumnAction": "deny"
  }
}

3. Bind, mint, and render​

Call dataira.setUserAccess() from trusted server state, then mint a short-lived token. Never let the browser choose identity, organization, datasource, policy, role, attribute, scope column, or scope value.

await dataira.setUserAccess({ endUserOrgId: user.orgId, endUserId: user.id,
  datasourceIds: [source.id], policyId: policy.id, roles: ["customer"],
  attributes: { customerId: user.customerId } });
const { token } = await dataira.createToken({ endUserOrgId: user.orgId,
  endUserId: user.id, datasourceId: source.id,
  scopeColumn: "customer_id", scopeValue: user.customerId });

Return only this token to @dataira/react or @dataira/client.

4. Review and publish the analytical contract​

  • Preflight/register exact OpenAPI JSON/YAML, review operations, and pin its generation/spec hash.
  • Create a draft; import exact preset digest plus bounded JSON/YAML, Markdown, or agent proposals.
  • Resolve conflicts explicitly; validate, review, and publish with idempotency and both CAS checks.
  • Confirm embed, @dataira/node, REST, and MCP resolve the same active context hash.
  • Exercise deterministic partner computation, inspect its receipt, then prove drift and rollback.

Use the reproducible FretGuard OpenAPI pilot.

5. Prove isolation and operate it​

Run pnpm --filter @dataira/node example:conformance with two users against the same schema, then follow the isolation test. Test cross-scope overrides, revocation, rotation, SSRF, secret leakage, budget limits, caches, concurrent publication, incompatible drift, and rollback.

Known gates before production​

  • Publish the versioned packages and migration/upgrade guidance.
  • Add an approved server principal for live post-publish conformance; current publication evaluation is structural.
  • Implement and enable delegated auth/GraphQL separately; async analytical execution is unsupported.
  • Promote through canaries, meet coverage/RLS gates, and complete an independent penetration test.