Restricts list-objects results from a part of hierarchy in case of Parent-Child Hierarchy between types

[prakashsatyani]

There isn't any way to restrict your results in case of parent-child hierarchy. I have a folder structure here and I want to restrict the results of list-objects based on a certain child objects. For example, here I want to list all the folder a particular user has read access to but the results should be from all the folders under clients folder only and not from the entire folder hierarchy.

[loeffel-io]

+1

@prakashsatyani do you found any solution?

[rhamzeh]

@prakashsatyani - one way would be to add a contextual tuple to specify what folder you're concerned about, and a relation that builds on the can_view permission and takes that folder in context into consideration

For example:

model: |
  model
    schema 1.1

  type user
      
  type folder
    relations
      define parent: [folder]
      define editor: [user] or editor from parent
      define viewer: [user] or editor or viewer from parent

      define user_in_ctx: [user]
      define user_in_parent_ctx: user_in_ctx or user_in_parent_ctx from parent

      define can_edit: editor
      define can_view: viewer

      define can_view_in_folder_context: can_view and user_in_parent_ctx

tuples:
  - user: folder:acme
    relation: parent
    object: folder:clients
  - user: folder:acme
    relation: parent
    object: folder:accounts
  - user: folder:acme
    relation: parent
    object: folder:projects
  - user: folder:acme
    relation: parent
    object: folder:marketing

  - user: folder:clients
    relation: parent
    object: folder:axiom
  - user: folder:clients
    relation: parent
    object: folder:binary
  - user: folder:clients
    relation: parent
    object: folder:centric
  - user: folder:clients
    relation: parent
    object: folder:digitech

  - user: folder:accounts
    relation: parent
    object: folder:transfers
  - user: folder:projects
    relation: parent
    object: folder:city_guide
  - user: folder:marketing
    relation: parent
    object: folder:brochures

  - user: user:anne
    relation: editor
    object: folder:acme


tests:
  - name: Test ListObjects with the context of a single folder
    tuples:
      - user: user:anne
        relation: user_in_ctx
        object: folder:clients
    list_objects:
      # list the folders that anne can view (within the context of folder:clients)
      - user: user:anne
        type: folder
        assertions:
          can_view:
            - folder:acme
            - folder:accounts
            - folder:transfers
            - folder:clients
            - folder:marketing
            - folder:axiom
            - folder:projects
            - folder:binary
            - folder:city_guide
            - folder:brochures
            - folder:digitech
            - folder:centric
          can_view_in_folder_context:
            - folder:clients
            - folder:axiom
            - folder:binary
            - folder:centric
            - folder:digitech

The result should be:

$ fga model test --tests=./store.fga.yaml
# Test Summary #
Tests 1/1 passing
ListObjects 2/2 passing