Help modeling

[pelmato]

Hi, I have written the following authorization model:

model
  schema 1.1

type user

type organization
  relations
    define parent: [organization]
    define directMember: [user]
    define directAdmin: [user]
    define isMember: directMember or directAdmin or isMember from parent
    define isAdmin: directAdmin or isAdmin from parent
    define canReadOrg: isMember
    define canWriteOrg: isAdmin

To summarize:

• There is a hierarchy of organizations (only the root organization has no parent).
• Users are bound to organizations using directMember or directAdmin relation.
• Users of parents organizations have access to children organizations.

So far, so good. Now I’m stuck with the following: I’d like to allow user to read/write other users the following way:

• Any user who has the isMember relation with organization:A can read any directMember/directAdmin of organization:A.
• Any user who has the ìsAdmin relation with organization:B can write any directMember/directAdmin of organization:B.

Its seems to me that the current modeling has enough information to process my new funtional requirements. Thus I should be able to add canRead and canWrite relations on the user type that reference existing relations on organization, but I couldn’t find any way of doing it.

How would you do it?

Thanks

[rhamzeh]

Hi @pelmato

OpenFGA acts like a directed graph, if you want the feature you're asking for you need to add a relation from the org back to the user to allow traversal going the opposite direction, for example:

model
  schema 1.1

type user
  relations
    define org: [organization]
    define canRead: isMember from org or isAdmin from org
    define canWrite: isAdmin from org

type organization
  relations
    define parent: [organization]
    define directMember: [user]
    define directAdmin: [user]
    define isMember: directMember or directAdmin or isMember from parent
    define isAdmin: directAdmin or isAdmin from parent
    define canReadOrg: isMember
    define canWriteOrg: isAdmin

[pelmato]

Thank you @rhamzeh. This is the solution I finally came up with. I find it a shame that I need to insert multiple tuples for the same functional concept, but I do understand why it is so.