openfga / openfga/cli

Add contextual tuples and context to assertions store import and export

Open
#452 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
102
Forks
49
Avg merge
1d 1h
Merged PRs (30d)
16

Description

Describe the problem you'd like to have solved

We added support to the API for Assertions to support context and contextual tuples, given that these are supported in the store file format we should add support for them in the fga store import and fga store export commands.

Describe the ideal solution
Store Import

When importing the assertions in a store file, we should add the contents of context and tuples/tuple_file in a test definition to every

So the following test definition:

Test definition
tests:
  - name: "folder-document-access"
    tuples:
      - user: folder:5
        relation: parent
        object: folder:product-2021
    check: # Each check test is made of: a user, an object and the expected result for one or more relations
      - user: user:anne
        object: folder:product-2021
        context:
          some: "value"
        assertions:
          can_view: true
          can_edit: true

Should produce the following assertions, note that the tuples and context are present in both assertions

Assertions written
{
  "tuple_key": {
    "object": "user:anne",
    "relation": "can_view",
    "user": "folder:product-2021"
  },
  "expectation": true,
  "contextual_tuples": [
    {
      "object": "folder:5",
      "relation": "parent",
      "user": "folder:product-2021"
    }
  ],
  "context": {
    "some": "value"
  }
}
{
  "tuple_key": {
    "object": "user:anne",
    "relation": "can_edit",
    "user": "folder:product-2021"
  },
  "expectation": true,
  "contextual_tuples": [
    {
      "object": "folder:5",
      "relation": "parent",
      "user": "folder:product-2021"
    }
  ],
  "context": {
    "some": "value"
  }
}
Store Export

[!WARNING]
This isn't as clear and needs more definition on the behaviour

When exporting a store, we should each ModelTestCheck should maintain its own context but the contextual_tuples should most likely be merged together into the tuples on the top level ModelTest.

/assertions response
{
  "authorization_model_id": "01G5JAVJ41T49E9TT3SKVS7X1J",
  "assertions": [
    {
      "tuple_key": {
        "object": "user:anne",
        "relation": "can_view",
        "user": "folder:product-2021"
      },
      "expectation": true,
      "contextual_tuples": [
        {
          "object": "folder:5",
          "relation": "parent",
          "user": "folder:product-2021"
        }
      ],
      "context": {
        "some": "value"
      }
    },
    {
      "tuple_key": {
        "object": "user:anne",
        "relation": "can_edit",
        "user": "folder:product-2021"
      },
      "expectation": true,
      "contextual_tuples": [
        {
          "object": "folder:5",
          "relation": "parent",
          "user": "folder:product-2021"
        }
      ],
      "context": {
        "some": "value"
      }
    }
  ]
}
Test definition
tests:
  - name: "folder-document-access"
    tuples:
      - user: folder:5
        relation: parent
        object: folder:product-2021
    check: # Each check test is made of: a user, an object and the expected result for one or more relations
      - user: user:anne
        object: folder:product-2021
        context:
          some: "value"
        assertions:
          can_view: true
          can_edit: true

Should produce the following assertions, note that the tuples and context are present in both assertions

Additional context

This needs this PR in go-sdk to be merged and ship before it can be done.

The playground UI currently does not support adding either of these or sending either of them as part of the Check call if they exist

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the fga store import and fga store export command entry points and trace how ModelTest and ModelTestCheck assertions are converted. Check the go-sdk PR before beginning, then clarify the export behavior with maintainers. Done means import and export preserve context and contextual tuples, with coverage for the shown test definition and assertions.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authorization, cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.