does OPL offer a mechanism for TransitiveCheck aga...
# talk-keto
b
does OPL offer a mechanism for TransitiveCheck against… self? i have this invalid OPL: I would like, for ex, anyone who can
edit
to also have
something_else_editor_can_do
. this.permits is disallowed (logs make that very obvious), but is there some other syntax to evaluate a different permit on self? (
this.permit.install_draft
accomplished the same thing using code reuse, but that will only scale so far)
Copy code
class GuideTemplate implements Namespace {
    related: {
        editors: SubjectSet<Group, "members">[]
        viewers: SubjectSet<Group, "members">[]
    }

    permits = {
        // either related group has view access
        view: (ctx: Context): boolean =>
            this.related.viewers.includes(ctx.subject) ||
            this.related.editors.includes(ctx.subject),

        // the related editors group can write
        edit: (ctx: Context): boolean => this.related.editors.includes(ctx.subject),

        // anyone who can view can install
        install: (ctx: Context): boolean =>
            this.related.viewers.includes(ctx.subject) ||
            this.related.editors.includes(ctx.subject),

        // editors can install regardless of publish state
        install_draft: (ctx: Context): boolean => this.related.editors.includes(ctx.subject),

        something_else_editor_can_do: (ctx: Context): boolean => this.permits.edit(ctx) 
    }
}
also, I could achieve the policy with a dirty hack. (this isn’t going to prod, it was just a fun experiment) add
related.self: GuideTemplate[]
now i’m allowed to use
<http://permits.XXX|permits.XXX>: (ctx: Context): boolean => this.related.self.traverse(p => p.permits.edit(ctx))
that policy passes with these tuples:
Copy code
GuideTemplate:001#viewers@(Group:consumers#members)
GuideTemplate:001#editors@(Group:cartographers#members)
// hacky self-reference
GuideTemplate:001#self@(GuideTemplate:001)
s
hm I guess we should allow that @narrow-van-43826 wdyt?
n
Yes, I can see that making sense.