From dd0f81ecb0612c993c6d7e5518ab5fe9082b7151 Mon Sep 17 00:00:00 2001
From: Darren Rambaud <225436867+debtquity@users.noreply.github.com>
Date: Sat, 21 Mar 2026 15:41:18 -0500
Subject: [PATCH] keto: run upstream test suite

* fix test suite not running as part of build, use default `checkPhase`
* fix ldflag by prepending `v` to version
* add versionCheckPhase and define meta.mainProgram
* add `postInstall` to add shell completions
* add __darwinAllowLocalNetworking, __structuredAttrs
* simplify comment
  (https://github.com/NixOS/nixpkgs/pull/502025#discussion_r3016679780)
* use `src.tag` (https://github.com/NixOS/nixpkgs/pull/502025#discussion_r3016680715)
* update `meta` attrs
---
 pkgs/by-name/ke/keto/package.nix | 64 +++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/ke/keto/package.nix b/pkgs/by-name/ke/keto/package.nix
index 2c65e602a957..19bf5849239f 100644
--- a/pkgs/by-name/ke/keto/package.nix
+++ b/pkgs/by-name/ke/keto/package.nix
@@ -1,48 +1,84 @@
 {
+  lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
-  lib,
+  versionCheckHook,
+  installShellFiles,
 }:
-let
+buildGoModule (finalAttrs: {
   pname = "keto";
   version = "26.2.0";
-  commit = "e4393662cd2e744deeb79de77669e07b6ccf51f3";
-in
-buildGoModule {
-  inherit pname version commit;
 
   src = fetchFromGitHub {
     owner = "ory";
     repo = "keto";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-wRtz4RvJ7LxVnSLmXVZFGa9QXjcPnDNJxHKosbyTed0=";
   };
 
   vendorHash = "sha256-B27aC4yXS36eOoq53+RWp0vq1Oqw2aR+gOjv0m+b/I4=";
 
+  __structuredAttrs = true;
+
   tags = [
     "sqlite"
     "json1"
     "hsm"
   ];
 
-  subPackages = [ "." ];
+  subPackages = [ "..." ];
 
   # Pass versioning information via ldflags
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/ory/keto/internal/driver/config.Version=${version}"
-    "-X github.com/ory/keto/internal/driver/config.Commit=${commit}"
+    "-X github.com/ory/keto/internal/driver/config.Version=${finalAttrs.src.tag}"
+    "-X github.com/ory/keto/internal/driver/config.Commit=${finalAttrs.src.rev}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+  # tests use dynamic port assignment via port `0`
+  __darwinAllowLocalNetworking = true;
+
+  preCheck = ''
+    export version='${finalAttrs.src.tag}'
+  '';
+  checkFlags = [
+    "-short"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd keto \
+      --bash <($out/bin/keto completion bash) \
+      --fish <($out/bin/keto completion fish) \
+      --zsh <($out/bin/keto completion zsh)
+  '';
+
   meta = {
-    description = "ORY Keto, the open source access control server";
-    homepage = "https://www.ory.sh/keto/";
+    description = "Scalable and customizable permission server ";
+    longDescription = ''
+      Open source implementation of "Zanzibar: Google's Consistent, Global Authorization System". It follows
+      [cloud architecture best practices](https://www.ory.com/docs/ecosystem/software-architecture-philosophy)
+      and focuses on:
+
+      - Scalable permission checks based on the Zanzibar model
+      - The Ory Permission Language for defining access control policies
+      - Relationship-based access control (ReBAC)
+      - Low latency permission checks (sub-10ms)
+      - Horizontal scaling to billions of relationships
+      - Consistency and high availability
+    '';
+    homepage = "https://github.com/ory/keto";
+    changelog = "https://github.com/ory/keto/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       mrmebelman
       debtquity
     ];
+    mainProgram = "keto";
   };
-}
+})