Modeling inherited entitlements

[joshcanhelp]

Hi there! I'm trying to model something similar to the entitlements example but with hierarchal organizations. In this case, organizations can have parents and the entitlements from the parent should apply to the children. The first way I tried it was putting an entitled_account relation on service but that wouldn't work when checking the child account since it can't follow a direct path to the parent.

I landed on this:

# model.fga
type service

type account
  relations
    define parent: [account]
    define is_entitled_to: [service] or is_entitled_to from parent

... and the tests are:

# test.yaml
tuples:
  - user: account:child
    relation: parent
    object: account:parent

  - user: service:messaging
    relation: is_entitled_to
    object: account:parent

tests:
  - name: Child has a parent
    check:
      - user: account:child
        object: account:parent
        assertions:
          parent: true

  - name: Parent can access messaging
    check:
      - user: service:messaging
        object: account:parent
        assertions:
          is_entitled_to: true

  - name: Child can access messaging
    check:
      - user: service:messaging
        object: account:child
        assertions:
          is_entitled_to: true

That last test is failing but I'm not sure why:

ⅹ Check(user=service:messaging,relation=is_entitled_to,object=account:child): expected=true, got=false

I can model this with users and having their membership be inherited but that's not technically correct and I'm curious why the above does not pass.

Thank you!

[aaguiarz]

Hi @joshcanhelp!

The parent/child tuple is reversed :)

  - user: account:parent
    relation: parent
    object: account:child

"User account:parent is related to object account:child as a parent"

[joshcanhelp]

Too simple 😆 Thank you for the English version as well, that makes more sense! Thank you!