future-laptop-57870
03/26/2024, 2:22 PMimport { Namespace, Context } from "@ory/permission-namespace-types"
class user implements Namespace { }
class team implements Namespace {
related: {
members: user[]
}
}
class document implements Namespace {
related: {
owner: team[]
author: user[]
}
permits = {
view: (ctx: Context): boolean => this.related.author.includes(ctx.subject) ||
this.related.owner.traverse((ws)=>ws.related.members.includes(ctx.subject))
}
}
When I run ory list relationships, I have these:
NAMESPACE OBJECT RELATION NAME SUBJECT
team 1 members alice
team 2 members bob
document 2 author alice
document 2 owner 1
When I run checks, the following are Allowed, which is what I expect:
• ory is allowed alice members team 1
• ory is allowed bob members team 1
• ory is allowed 1 owner document 2
• ory is allowed alice author document 2
• ory is allowed alice view document 2
But this one is denied:
ory is allowed bob view document 2
Since bob is a member of team 1, and team 1 is the owner of document 2, how do I permit bob to view document 2?