[License Exception Request] [OpenFGA] [Apache 2.0] for NPM package that is not OSS

[aaguiarz]

For which CNCF project are you requesting exceptions?

OpenFGA

Are you an official maintainer of this project?

Yes

List of components requiring an exception

Component	Upstream URL	Project Usage URL	License(s)	Purpose
OpenFGA Playground	https://www.npmjs.com/package/@auth0/quantum-product	Not used yet	Apache 2.0	UI widgets for open sourcing play.fga.dev

Are all of the components mandatory dependencies for the project to function as intended?

Yes

If no, please explain

We currently provide a way for customers to leverage play.fga.dev when using OpenFGA. The project is closed source, and we'd want to open source it.

However, it has a hard dependency on an NPM project that is licensed with an Apache 2.0 license.

https://www.npmjs.com/package/@auth0/quantum-product

The JS code is available as part of the NPM package, but given it's written in Typescript, it includes transpiled JS code that is not designed to be modified.

How will the components be included in or with the project's code and distributions?

• Incorporated code
• Vendored component
• Build-time dependency
• Build and test tooling
• Install-time dependency
• Required upstream dependencies
• Other (please describe below)

If any of the above selections don't apply to all of the components listed in the table above, please explain

When the OSS version of play.fga.dev, the Quantum NPM package will be downloaded, and distributed as part of the play.fga.dev bundle.

Which of the following best describes how the components interact with the project's own code?

• Static linking: e.g., compiled together with project code into a single binary
• Dynamic linking: e.g., compiled into a separate binary, running together with project code in a single address space at run-time
• Separate process: e.g., separate executable running in a different process space, interacting with project code only via mechanisms such as pipes, sockets, etc.
• Network interaction only: e.g., logically separated over a network and communicating only via mechanisms such as network API call, exchanging JSON data, etc.
• Other (please describe below)

If any of the above selections don't apply to all of the components listed in the table above, please explain

The above don't describe precisely how Web Apps using Javascript and NPM packages work, as there's no binary, but the closest would be dynamic linking.

Will any of the components be modified?

No

If yes, please specify which components will be modified, and briefly describe the purpose and nature of the modifications.

No response

Will the project be seeking to contribute the modifications back to the upstream project?

None

[joannalee333]

This will be reviewed at the next CNCF Legal Committee meeting, which will be either mid-December or early January depending on committee members' availability.