ory / ory/docs

Keto example permission model doesn't traverse graph

Open
#1,744 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
161
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

Preflight checklist
Ory Network Project

https://gracious-hypatia-b9te8t22yp.projects.oryapis.com

Describe the bug

Following steps in this guide: https://www.ory.sh/docs/keto/modeling/create-permission-model

Created a bug here as the documentation should make clearer how to the setup relationships to make the permission model work.

Please let me know if I understand something fundamentally wrong about the way the permission model is supposed to work :)

Reproducing the bug
  1. Go the permission model page
  2. Copy code of permissions-v5.ts
  3. Go to https://console.ory.sh/projects/-/permissions/configuration
  4. Paste the code under "Permission Rules"
  5. Click save
  6. Go to relationships: https://console.ory.sh/projects/-/permissions/relationships
  7. Create the following two relationships:
  8. userA is owners of Folder:folderA
  9. folderA is parents of Document:docA
  10. Make the following request: https://-.projects.oryapis.com/relation-tuples/check?namespace=Document&object=docA&relation=share&subject_id=userA&max-depth=100

Expected: /relation-tuples/check returns {"allowed": true}
Actual: /relation-tuples/check returns {"allowed": false}

Relevant log output

No response

Relevant configuration

No response

Version

v0.13.0-alpha.0

On which operating system are you observing this issue?

Ory Network

In which environment are you deploying?

Ory Network

Additional Context

Permission v3 and v4 don't work. Permission v5 works again (which is marked as optional) :D

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with docs/keto/modeling/create-permission-model.mdx, especially the permissions-v5.ts example referenced in lines 315-361, and reproduce the listed relationships and relation-tuples/check request. Compare the documented permission model versions and relationship setup. Done means the guide clearly explains the required relationships and the documented example produces the expected allowed result.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authorization, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.