Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add contextual tuples and context to assertions store import and export #452

Open
ewanharris opened this issue Feb 6, 2025 · 0 comments

Comments

@ewanharris
Copy link
Member

Describe the problem you'd like to have solved

We added support to the API for Assertions to support context and contextual tuples, given that these are supported in the store file format we should add support for them in the fga store import and fga store export commands.

Describe the ideal solution

Store Import

When importing the assertions in a store file, we should add the contents of context and tuples/tuple_file in a test definition to every

So the following test definition:

Test definition
tests:
  - name: "folder-document-access"
    tuples:
      - user: folder:5
        relation: parent
        object: folder:product-2021
    check: # Each check test is made of: a user, an object and the expected result for one or more relations
      - user: user:anne
        object: folder:product-2021
        context:
          some: "value"
        assertions:
          can_view: true
          can_edit: true

Should produce the following assertions, note that the tuples and context are present in both assertions

Assertions written
{
  "tuple_key": {
    "object": "user:anne",
    "relation": "can_view",
    "user": "folder:product-2021"
  },
  "expectation": true,
  "contextual_tuples": [
    {
      "object": "folder:5",
      "relation": "parent",
      "user": "folder:product-2021"
    }
  ],
  "context": {
    "some": "value"
  }
}
{
  "tuple_key": {
    "object": "user:anne",
    "relation": "can_edit",
    "user": "folder:product-2021"
  },
  "expectation": true,
  "contextual_tuples": [
    {
      "object": "folder:5",
      "relation": "parent",
      "user": "folder:product-2021"
    }
  ],
  "context": {
    "some": "value"
  }
}

Store Export

Warning

This isn't as clear and needs more definition on the behaviour

When exporting a store, we should each ModelTestCheck should maintain its own context but the contextual_tuples should most likely be merged together into the tuples on the top level ModelTest.

/assertions response
{
  "authorization_model_id": "01G5JAVJ41T49E9TT3SKVS7X1J",
  "assertions": [
    {
      "tuple_key": {
        "object": "user:anne",
        "relation": "can_view",
        "user": "folder:product-2021"
      },
      "expectation": true,
      "contextual_tuples": [
        {
          "object": "folder:5",
          "relation": "parent",
          "user": "folder:product-2021"
        }
      ],
      "context": {
        "some": "value"
      }
    },
    {
      "tuple_key": {
        "object": "user:anne",
        "relation": "can_edit",
        "user": "folder:product-2021"
      },
      "expectation": true,
      "contextual_tuples": [
        {
          "object": "folder:5",
          "relation": "parent",
          "user": "folder:product-2021"
        }
      ],
      "context": {
        "some": "value"
      }
    }
  ]
}
Test definition
tests:
  - name: "folder-document-access"
    tuples:
      - user: folder:5
        relation: parent
        object: folder:product-2021
    check: # Each check test is made of: a user, an object and the expected result for one or more relations
      - user: user:anne
        object: folder:product-2021
        context:
          some: "value"
        assertions:
          can_view: true
          can_edit: true

Should produce the following assertions, note that the tuples and context are present in both assertions

Additional context

This needs this PR in go-sdk to be merged and ship before it can be done.

The playground UI currently does not support adding either of these or sending either of them as part of the Check call if they exist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Backlog
Development

No branches or pull requests

1 participant