You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/getting-started/modeling.mdx
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ This is facilitated by our relationship-based access control (ReBAC), which allo
9
9
10
10
## Permify Schema
11
11
12
-
Permify has its own language that you can model your authorization logic with it. The language allows you to define arbitrary relations between users and objects.
12
+
Permify has its own language that you can model your authorization logic with. The language allows you to define arbitrary relations between users and objects.
13
13
14
14
You can assign users associate them with arbitrary objects representing application concepts, such as teams, organizations, or stores.
15
15
@@ -19,7 +19,7 @@ You can also use dynamic attributes in your authorization model, such as boolean
You can define your entities, relations between them and access control decisions with using the Permify Schema language. It includes set-algebraic operators such as intersection and union. These allow you to specify complex access control policies in terms of user-object relations.
22
+
You can define your entities, relations between them and access control decisions using the Permify Schema language. It includes set-algebraic operators such as intersection and union. These allow you to specify complex access control policies in terms of user-object relations.
23
23
24
24
Here’s a simple breakdown of our schema.
25
25
@@ -29,7 +29,7 @@ Permify Schema can be created on our [playground](https://play.permify.co/) as w
29
29
30
30
## Developing a Schema
31
31
32
-
This guide will show how to develop a Permify Schema from scratch with an example. It's relative simple, yet it will illustrate almost every aspect of the modeling language.
32
+
This guide will show how to develop a Permify Schema from scratch with an example. It's relatively simple, yet it will illustrate almost every aspect of the modeling language.
33
33
34
34
We'll follow a simplified version of the GitHub access control system, where teams and organizations have control over the viewing, editing, or deleting access rights for their repositories.
35
35
@@ -58,7 +58,7 @@ You can start developing Permify Schema on [VSCode]. You can install the extensi
58
58
59
59
The first step to building Permify Schema is creating entities. An entity is an object that defines your resources which hold roles in your permission system.
60
60
61
-
Think of entities as tables in your database. It is strongly recommended to ngly advice to name entities the same as the corresponding database table name. Doing so allows you to model and reason about your authorization and eliminate the possibility of error.
61
+
Think of entities as tables in your database. It is strongly recommended to name entities the same as the corresponding database table name. Doing so allows you to model and reason about your authorization and eliminate the possibility of error.
62
62
63
63
You can create entities using the `entity` keyword. Let's create some entities for our example GitHub authorization logic.
64
64
@@ -82,7 +82,7 @@ Entities have a number of different types of properties. These are:
82
82
83
83
Relations represent relationships between entities. It's the most critical part of the schema because Permify is based on relations between resources and their permissions.
84
84
85
-
Use the keyword `relation` to create a entity relation with the `name` and `type` properties.
85
+
Use the keyword `relation` to create an entity relation with the `name` and `type` properties.
86
86
87
87
**Relation Attributes:**
88
88
@@ -101,7 +101,7 @@ Let's turn back to our example and define relations inside our entities:
101
101
102
102
### User Entity
103
103
104
-
→ The user entity is a mandatory entity in Permify. It generally will be empty, but it will used in other entities as a relation type referencing users.
104
+
→ The user entity is a mandatory entity in Permify. It generally will be empty, but it will be used in other entities as a relation type referencing users.
105
105
106
106
```perm
107
107
entity user {}
@@ -124,7 +124,7 @@ entity organization {
124
124
125
125
### Parent-Child Relationship
126
126
127
-
→ Let's say teams can belong organizations and can have members. We model that as follows:
127
+
→ Let's say teams can belong to organizations and can have members. We model that as follows:
128
128
129
129
```perm
130
130
entity organization {
@@ -159,7 +159,7 @@ entity repository {
159
159
}
160
160
```
161
161
162
-
The owner relation indicates the creator of the repository. This is how you can defin**ownership** in a Permify schema.
162
+
The owner relation indicates the creator of the repository. This is how you can define**ownership** in a Permify schema.
163
163
164
164
### Multiple Relation Types
165
165
@@ -199,7 +199,7 @@ You then can specify not only individual users but also members of an organizati
199
199
- organization:1#viewer@user:U2
200
200
- organization:1#viewer@organization:O1#member
201
201
202
-
With `organization:1#viewer@organization:O1#member` all members of the organization O1 will have the right to perform the defined action. In this case, all members in O1 now have the `viewer` relation.
202
+
With `organization:1#viewer@organization:O1#member`, all members of the organization O1 will have the right to perform the defined action. In this case, all members in O1 now have the `viewer` relation.
203
203
204
204
These definitions prevent you from creating undesired user set relationships.
205
205
@@ -250,11 +250,11 @@ The same `read` can also be defined using the **permission** keyword, as follows
250
250
permission read = org.admin and (owner or maintainer or org.member)
251
251
```
252
252
253
-
Using the `action` or `permission` keywords yields the same authorization logic. We have two keywords for defining an permission because most, but not all, permissions are based on actions. Learn more in our [Nested Hierarchies](/modeling-guides/rebac/impersonation) section.
253
+
Using the `action` or `permission` keywords yields the same authorization logic. We have two keywords for defining a permission because most, but not all, permissions are based on actions. Learn more in our [Nested Hierarchies](/modeling-guides/rebac/impersonation) section.
254
254
</Note>
255
255
256
256
The `and` operation creates an intersection between relations but is not tied to specific entities.
257
-
TODO is there a way to do tie it to specific entities?
257
+
TODO is there a way to tie it to specific entities?
258
258
259
259
For example, in the following model, users can see a repository if they are a member or admin of any organization.
260
260
@@ -432,7 +432,7 @@ entity repository {
432
432
}
433
433
```
434
434
435
-
As shown in the example, this rule is part of the the `edit` permission of the repository. This lets you check whether an organization:X has repository edit access, depending on the authority level the organization possesses relative to the repository.
435
+
As shown in the example, this rule is part of the `edit` permission of the repository. This lets you check whether an organization:X has repository edit access, depending on the authority level the organization possesses relative to the repository.
436
436
437
437
<Note>
438
438
We designed our schema language based on [Common Expression Language (CEL)](https://github.com/google/cel-go). The syntax looks nearly identical to equivalent expressions in C++, Go, Java, and TypeScript.
@@ -470,10 +470,10 @@ You can also check out comprehensive schema examples from the [Real World Exampl
470
470
Here is what each example focuses on,
471
471
472
472
-[Google Docs]: how users can gain direct access to a document through **organizational roles** or through **inherited/nested permissions**.
473
-
-[Facebook Groups]: how users can perform various actions based on the **roles and permissions within the groups** they belong.
473
+
-[Facebook Groups]: how users can perform various actions based on the **roles and permissions within the groups**to which they belong.
474
474
-[Notion]: how **one global entity (workspace) can manage access rights** in the child entities that belong to it.
475
-
-[Instagram]: how **public/private attributes** play role in granting access to specific users.
476
-
-[Mercury]: how **attributes and rules interact within the hierarchical relationships**.
475
+
-[Instagram]: how **public/private attributes**can play a role in granting access to specific users.
476
+
-[Mercury]: how **attributes and rules** interact within the hierarchical relationships.
0 commit comments