bulky-hamburger-2500
01/05/2024, 5:46 AMclass User implements Namespace {
related: {
manager: User[]
}
}
class Group implements Namespace {
related: {
members: (User | Group)[]
}
}
class Folder implements Namespace {
related: {
parents: File[]
viewers: SubjectSet<Group, "members">[]
}
permits = {
view: (ctx: Context): boolean => this.related.viewers.includes(ctx.subject),
}
}
class File implements Namespace {
related: {
parents: (File | Folder)[]
viewers: (User | SubjectSet<Group, "members">)[]
owners: (User | SubjectSet<Group, "members">)[]
siblings: File[]
}
permits = {
view: (ctx: Context): boolean =>
this.related.parents.traverse((p) => p.related.viewers.includes(ctx.subject)) ||
this.related.parents.traverse((p) => p.permits.view(ctx)) ||
this.related.viewers.includes(ctx.subject) ||
this.related.owners.includes(ctx.subject),
edit: (ctx: Context) => this.related.owners.includes(ctx.subject),
rename: (ctx: Context) => this.related.siblings.traverse((s) => s.permits.edit(ctx)),
}
}
I've picked this directly from ORY example, I understands that with this configuration it'd means that to view File a subject can either be a a User or a members of a Group namespace. I've query the relationship like this
{
"relation_tuples": [
{
"namespace": "Folder",
"object": "AMC",
"relation": "viewers",
"subject_id": "group1"
},
{
"namespace": "Group",
"object": "group1",
"relation": "members",
"subject_id": "test1"
},
{
"namespace": "File",
"object": "file1",
"relation": "parents",
"subject_id": "AMC"
}
],
"next_page_token": ""
}
Now I've check the permission using REST call like this
{{ory_project}}/relation-tuples/check?namespace=File&object=file1&relation=viewers&subject_id=test1
it return a false. Am I missing something here? or I misunderstands some concept.