Hey everyone ☀️ Me an my team are just taking the first steps with Ory and are wondering what the best practices and recommendations are for keeping our “permission rules” under version control in git and then uploading them whenever changes are made and merged using the CLI. Thanks 🙏

Hey Maria, that’s a great question. Looping in @magnificent-energy-493

The way I do it in my projects:

export project_id=
export project_name=

- First get the current permission config,

ory get permission-config $project_id --format json-pretty > ory-permission-config-$project_name.json

- You get a storage.googleapis link with contents like this for example:

import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types"

class User implements Namespace { }

class Blog implements Namespace {
  related: {
    viewers: User[]
  }

  permits = {
    view: (ctx: Context): boolean =>
      this.related.viewers.includes(ctx.subject)
  }
}

- Save the permission config in git - Then whenever I make changes, I first commit to this file. - Then base64 encode it and add it to the config like so ory-permission-config-staging.json

{
  "limit": {},
  "namespaces": {
    "location": "<base64://somevalue>"
  }
}

- Then upload this to Ory Network

ory update permission-config $project_id --file ory-permission-config-$project_name.json

- use the googleapis link in the response to confirm. Not sure if this is the best / ideal approach, but it works for me. Let me know what you think @strong-controller-46383. If this sounds like it could work for you, I will turn it into a tutorial.

Thanks Vincent, this does indeed look like a doable approach and more or less in line with what we were hoping for 🙏

Yea I use the same approach for the identity-config, identity-schema and also jsonnets for social logins and webhooks.

Hi @magnificent-energy-493 I have a following question. We want to implement this process into github actions. Currently I face the issue about

ory auth

CLI. It is interactive in terminal. Is it possible to set flag and pass user credential as parameters directly by using ory auth command? Or do you have any other suggested way to do it? Thank you! 🙂