raystack · AmanGIT07 · Mar 6, 2026 · Feb 20, 2026 · Feb 20, 2026 · Feb 20, 2026
diff --git a/Makefile b/Makefile
@@ -4,7 +4,7 @@ TAG := $(shell git rev-list --tags --max-count=1)
 VERSION := $(shell git describe --tags ${TAG})
 .PHONY: build check fmt lint test test-race vet test-cover-html help install proto admin-app compose-up-dev
 .DEFAULT_GOAL := build
-PROTON_COMMIT := "f8f6cd5b271d387cb99847a87b02a873df5b00ea"
+PROTON_COMMIT := "e5878c3542f056400593735a448925a2e6ea6116"
 
 admin-app:
 	@echo " > generating admin build"

diff --git a/cmd/serve.go b/cmd/serve.go
@@ -25,6 +25,7 @@ import (
 
 	"github.com/raystack/frontier/core/kyc"
 	"github.com/raystack/frontier/core/prospect"
+	"github.com/raystack/frontier/core/userpat"
 
 	"golang.org/x/exp/slices"
 
@@ -372,6 +373,8 @@ func buildAPIDependencies(
 	prospectRepository := postgres.NewProspectRepository(dbc)
 	prospectService := prospect.NewService(prospectRepository)
 
+	userPATRepo := postgres.NewUserPATRepository(dbc)
+
 	svUserRepo := postgres.NewServiceUserRepository(dbc)
 	scUserCredRepo := postgres.NewServiceUserCredentialRepository(dbc)
 	serviceUserService := serviceuser.NewService(svUserRepo, scUserCredRepo, relationService)
@@ -406,7 +409,7 @@ func buildAPIDependencies(
 	groupRepository := postgres.NewGroupRepository(dbc)
 	organizationRepository := postgres.NewOrganizationRepository(dbc)
 
-	roleService := role.NewService(roleRepository, relationService, permissionService, auditRecordRepository)
+	roleService := role.NewService(roleRepository, relationService, permissionService, auditRecordRepository, cfg.App.PAT.DeniedPermissionsSet())
 	policyService := policy.NewService(policyPGRepository, relationService, roleService)
 	userService := user.NewService(userRepository, relationService, policyService, roleService)
 	authnService := authenticate.NewService(logger, cfg.App.Authentication,
@@ -415,6 +418,8 @@ func buildAPIDependencies(
 	organizationService := organization.NewService(organizationRepository, relationService, userService,
 		authnService, policyService, preferenceService, auditRecordRepository)
 
+	userPATService := userpat.NewService(logger, userPATRepo, cfg.App.PAT, organizationService, roleService, policyService, auditRecordRepository)
+
 	auditRecordService := auditrecord.NewService(auditRecordRepository, userService, serviceUserService, sessionService)
 
 	orgKycRepository := postgres.NewOrgKycRepository(dbc)
@@ -528,6 +533,8 @@ func buildAPIDependencies(
 		permissionService,
 		userService,
 		authzSchemaRepository,
+		relationService,
+		cfg.App.PAT.DeniedPermissionsSet(),
 		planService,
 		planBlobRepository,
 	)
@@ -606,6 +613,7 @@ func buildAPIDependencies(
 		UserOrgsService:                  userOrgsService,
 		UserProjectsService:              userProjectsService,
 		AuditRecordService:               auditRecordService,
+		UserPATService:                   userPATService,
 	}
 	return dependencies, nil
 }

diff --git a/core/policy/policy.go b/core/policy/policy.go
@@ -25,6 +25,7 @@ type Policy struct {
 	ResourceType  string `json:"resource_type"`
 	PrincipalID   string `json:"principal_id"`
 	PrincipalType string `json:"principal_type"`
+	GrantRelation string `json:"grant_relation"`
 	Metadata      metadata.Metadata
 
 	CreatedAt time.Time

diff --git a/core/policy/service.go b/core/policy/service.go
@@ -2,6 +2,7 @@ package policy
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/raystack/frontier/pkg/utils"
 
@@ -54,6 +55,16 @@ func (s Service) Create(ctx context.Context, policy Policy) (Policy, error) {
 		return Policy{}, err
 	}
 	policy.RoleID = policyRole.ID
+	if policy.GrantRelation == "" {
+		policy.GrantRelation = schema.RoleGrantRelationName
+	}
+	if policy.GrantRelation != schema.RoleGrantRelationName && policy.GrantRelation != schema.PATGrantRelationName {
+		return Policy{}, fmt.Errorf("invalid grant_relation value: %q", policy.GrantRelation)
+	}
+	if policy.GrantRelation == schema.PATGrantRelationName && policy.PrincipalType != schema.PATPrincipal {
+		return Policy{}, fmt.Errorf("%q relation requires principal type %q, got %q",
+			schema.PATGrantRelationName, schema.PATPrincipal, policy.PrincipalType)
+	}
 
 	createdPolicy, err := s.repository.Upsert(ctx, policy)
 	if err != nil {
@@ -126,7 +137,7 @@ func (s Service) AssignRole(ctx context.Context, pol Policy) error {
 			ID:        pol.ID,
 			Namespace: schema.RoleBindingNamespace,
 		},
-		RelationName: schema.RoleGrantRelationName,
+		RelationName: pol.GrantRelation,
 	})
 	if err != nil {
 		return err

diff --git a/core/policy/service_test.go b/core/policy/service_test.go
@@ -92,6 +92,33 @@ func TestService_Create(t *testing.T) {
 				return policy.NewService(repo, relationService, roleService)
 			},
 		},
+		{
+			name: "reject invalid grant_relation value",
+			policy: policy.Policy{
+				RoleID:        "role-id",
+				GrantRelation: "invalid_relation",
+			},
+			wantErr: true,
+			setup: func() *policy.Service {
+				repo, roleService, relationService := mockService(t)
+				roleService.On("Get", ctx, "role-id").Return(role.Role{ID: "role-id"}, nil)
+				return policy.NewService(repo, relationService, roleService)
+			},
+		},
+		{
+			name: "reject pat_granted for non-PAT principal",
+			policy: policy.Policy{
+				RoleID:        "role-id",
+				PrincipalType: schema.UserPrincipal,
+				GrantRelation: schema.PATGrantRelationName,
+			},
+			wantErr: true,
+			setup: func() *policy.Service {
+				repo, roleService, relationService := mockService(t)
+				roleService.On("Get", ctx, "role-id").Return(role.Role{ID: "role-id"}, nil)
+				return policy.NewService(repo, relationService, roleService)
+			},
+		},
 		{
 			name: "create policy successfully",
 			policy: policy.Policy{
@@ -109,6 +136,7 @@ func TestService_Create(t *testing.T) {
 				ResourceType:  schema.ProjectNamespace,
 				PrincipalID:   "user-id",
 				PrincipalType: schema.UserPrincipal,
+				GrantRelation: schema.RoleGrantRelationName,
 			},
 			setup: func() *policy.Service {
 				repo, roleService, relationService := mockService(t)
@@ -120,13 +148,15 @@ func TestService_Create(t *testing.T) {
 					ResourceType:  schema.ProjectNamespace,
 					PrincipalID:   "user-id",
 					PrincipalType: schema.UserPrincipal,
+					GrantRelation: schema.RoleGrantRelationName,
 				}).Return(policy.Policy{
 					ID:            "policy-id",
 					RoleID:        "role-id",
 					ResourceID:    "resource-id",
 					ResourceType:  schema.ProjectNamespace,
 					PrincipalID:   "user-id",
 					PrincipalType: schema.UserPrincipal,
+					GrantRelation: schema.RoleGrantRelationName,
 				}, nil)
 
 				// assign role
@@ -184,6 +214,7 @@ func TestService_Create(t *testing.T) {
 				ResourceType:  schema.ProjectNamespace,
 				PrincipalID:   "group-id",
 				PrincipalType: schema.GroupPrincipal,
+				GrantRelation: schema.RoleGrantRelationName,
 			},
 			setup: func() *policy.Service {
 				repo, roleService, relationService := mockService(t)
@@ -195,13 +226,15 @@ func TestService_Create(t *testing.T) {
 					ResourceType:  schema.ProjectNamespace,
 					PrincipalID:   "group-id",
 					PrincipalType: schema.GroupPrincipal,
+					GrantRelation: schema.RoleGrantRelationName,
 				}).Return(policy.Policy{
 					ID:            "policy-id",
 					RoleID:        "role-id",
 					ResourceID:    "resource-id",
 					ResourceType:  schema.ProjectNamespace,
 					PrincipalID:   "group-id",
 					PrincipalType: schema.GroupPrincipal,
+					GrantRelation: schema.RoleGrantRelationName,
 				}, nil)
 
 				// assign role

diff --git a/core/role/service.go b/core/role/service.go
@@ -31,14 +31,17 @@ type Service struct {
 	relationService       RelationService
 	permissionService     PermissionService
 	auditRecordRepository AuditRecordRepository
+	patDeniedPerms        map[string]struct{}
 }
 
-func NewService(repository Repository, relationService RelationService, permissionService PermissionService, auditRecordRepository AuditRecordRepository) *Service {
+func NewService(repository Repository, relationService RelationService, permissionService PermissionService,
+	auditRecordRepository AuditRecordRepository, patDeniedPerms map[string]struct{}) *Service {
 	return &Service{
 		repository:            repository,
 		relationService:       relationService,
 		permissionService:     permissionService,
 		auditRecordRepository: auditRecordRepository,
+		patDeniedPerms:        patDeniedPerms,
 	}
 }
 
@@ -112,7 +115,7 @@ func (s Service) createRolePermissionRelation(ctx context.Context, roleID string
 				Namespace: schema.RoleNamespace,
 			},
 			Subject: relation.Subject{
-				ID:        "*", // all principles who have role will have access
+				ID:        "*", // all principals who have role will have access
 				Namespace: schema.UserPrincipal,
 			},
 			RelationName: perm,
@@ -127,14 +130,31 @@ func (s Service) createRolePermissionRelation(ctx context.Context, roleID string
 				Namespace: schema.RoleNamespace,
 			},
 			Subject: relation.Subject{
-				ID:        "*", // all principles who have role will have access
+				ID:        "*", // all principals who have role will have access
 				Namespace: schema.ServiceUserPrincipal,
 			},
 			RelationName: perm,
 		})
 		if err != nil {
 			return err
 		}
+		// do the same with PAT (skip denied permissions)
+		if _, denied := s.patDeniedPerms[perm]; !denied {
+			_, err = s.relationService.Create(ctx, relation.Relation{
+				Object: relation.Object{
+					ID:        roleID,
+					Namespace: schema.RoleNamespace,
+				},
+				Subject: relation.Subject{
+					ID:        "*", // all principals who have role will have access
+					Namespace: schema.PATPrincipal,
+				},
+				RelationName: perm,
+			})
+			if err != nil {
+				return err
+			}
+		}
 	}
 	return nil
 }
@@ -151,7 +171,7 @@ func (s Service) deleteRolePermissionRelations(ctx context.Context, roleID strin
 			Namespace: schema.RoleNamespace,
 		},
 		Subject: relation.Subject{
-			ID:        "*", // all principles who have role will have access
+			ID:        "*", // all principals who have role will have access
 			Namespace: schema.UserPrincipal,
 		},
 	})
@@ -165,13 +185,27 @@ func (s Service) deleteRolePermissionRelations(ctx context.Context, roleID strin
 			Namespace: schema.RoleNamespace,
 		},
 		Subject: relation.Subject{
-			ID:        "*", // all principles who have role will have access
+			ID:        "*", // all principals who have role will have access
 			Namespace: schema.ServiceUserPrincipal,
 		},
 	})
 	if err != nil {
 		return err
 	}
+	// do the same with PAT
+	err = s.relationService.Delete(ctx, relation.Relation{
+		Object: relation.Object{
+			ID:        roleID,
+			Namespace: schema.RoleNamespace,
+		},
+		Subject: relation.Subject{
+			ID:        "*",
+			Namespace: schema.PATPrincipal,
+		},
+	})
+	if err != nil {
+		return err
+	}
 	return nil
 }