The Cedar authorizer hardcodes `EntityTypeTHVGroup = "THVGroup"` in `pkg/authz/authorizers/cedar/entity.go`. This constant is used at request time to construct `Client.Parents` UIDs from JWT group/role claims:
```go
parentUIDs = append(parentUIDs, cedar.NewEntityUID(EntityTypeTHVGroup, cedar.String(g)))
```
This makes the entity type name for the JWT-derived principal hierarchy impossible to change without a breaking change to existing deployments.
Proposed change
Add a `GroupEntityType` field to `ConfigOptions` in `pkg/authz/authorizers/cedar/core.go`:
```go
// GroupEntityType is the Cedar entity type name used for Client parent UIDs
// synthesised from JWT group/role claims. Defaults to "THVGroup" when empty.
GroupEntityType string `json:"group_entity_type,omitempty" yaml:"group_entity_type,omitempty"`
```
`EntityFactory.CreateEntitiesForRequest` reads `opts.GroupEntityType` and falls back to `"THVGroup"` when empty. No behaviour change for existing deployments.
Note: namespaced names (e.g. `Platform::Group`) are not supported until `parseCedarEntityID` is fixed to handle Cedar's `::` namespace syntax — that is a separate issue. This change enables flat name changes only.
The Cedar authorizer hardcodes `EntityTypeTHVGroup = "THVGroup"` in `pkg/authz/authorizers/cedar/entity.go`. This constant is used at request time to construct `Client.Parents` UIDs from JWT group/role claims:
```go
parentUIDs = append(parentUIDs, cedar.NewEntityUID(EntityTypeTHVGroup, cedar.String(g)))
```
This makes the entity type name for the JWT-derived principal hierarchy impossible to change without a breaking change to existing deployments.
Proposed change
Add a `GroupEntityType` field to `ConfigOptions` in `pkg/authz/authorizers/cedar/core.go`:
```go
// GroupEntityType is the Cedar entity type name used for Client parent UIDs
// synthesised from JWT group/role claims. Defaults to "THVGroup" when empty.
GroupEntityType string `json:"group_entity_type,omitempty" yaml:"group_entity_type,omitempty"`
```
`EntityFactory.CreateEntitiesForRequest` reads `opts.GroupEntityType` and falls back to `"THVGroup"` when empty. No behaviour change for existing deployments.
Note: namespaced names (e.g. `Platform::Group`) are not supported until `parseCedarEntityID` is fixed to handle Cedar's `::` namespace syntax — that is a separate issue. This change enables flat name changes only.