We are currently experimenting to see whether Ketos could be a good fit for our permission system. However I’m stuck 😭: I have the following permission model:

class Company implements Namespace {
  related: {
    admins: User[]
  }

  permits = {
    owner: (ctx: Context): boolean =>
      this.related.admins.includes(ctx.subject)
  }
}
class LearningPlan implements Namespace {
  related: {
    owners: User[]
    companies: Company[]
  }

  permits = {
    owner: (ctx: Context): boolean =>
      this.related.companies.traverse((parent) => parent.permits.owner(ctx)) ||
      this.related.owners.includes(ctx.subject)
  }
}

With these relations: • Subject

companies/simpleclub

is

companies

of Object

LearningPlan:learning_plans/xyz

• Subject

users/abc

is

admins

of Object

Company:companies/simpleclub

Why does this request

https://{project-slug}.<http://projects.oryapis.com/relation-tuples/checknamespace=LearningPlan&object=learning_plans/xyz&relation=owner&subject_id=users/abc&max-depth=20|projects.oryapis.com/relation-tuples/checknamespace=LearningPlan&object=learning_plans/xyz&relation=owner&subject_id=users/abc&max-depth=20>

return

{"allowed": false}

I thought be cause of the

.companies.traverse()

the user would also get permissions when they are an

admin

in the company?

Hello Dennis, thanks for the feedback. Will let the team know so we can clarify this.