You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/best-practices/adoption-patterns.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -159,7 +159,7 @@ On the other hand, adding another service increases latency, adds additional com
159
159
160
160
## Shadowing the <ProductNameformat={ProductNameFormat.ShortForm}/> API
161
161
162
-
When migrating from an existing authorization system to <ProductNameformat={ProductNameFormat.ShortForm}/>, it's recommended to first run both systems in parallel, with <ProductNameformat={ProductNameFormat.ShortForm}/> in "shadow mode". This means that while the existing system continues to make the actual authorization decisions, you also make calls to <ProductNameformat={ProductNameFormat.ShortForm}/> asynchornously and compare the results.
162
+
When migrating from an existing authorization system to <ProductNameformat={ProductNameFormat.ShortForm}/>, it's recommended to first run both systems in parallel, with <ProductNameformat={ProductNameFormat.ShortForm}/> in "shadow mode". This means that while the existing system continues to make the actual authorization decisions, you also make calls to <ProductNameformat={ProductNameFormat.ShortForm}/> asynchronously and compare the results.
Copy file name to clipboardExpand all lines: docs/content/configuration-language.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,6 +34,7 @@ Please familiarize yourself with basic <ProductConcept /> and [How to get starte
34
34
Below is a sample authorization model. The next sections discuss the basics of the <ProductNameformat={ProductNameFormat.ShortForm}/> configuration language.
You should now have Postgres running in a container in the `openfga` network. However, it will not have the tables required for running OpenFGA. You can use the `migrate` command to create the tables. Using the OpenFGA container, this will look like:
Copy file name to clipboardExpand all lines: docs/content/interacting/relationship-queries.mdx
+14-2Lines changed: 14 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -181,12 +181,24 @@ For example, you can call Batch Check to determine whether `bob` has `can_view_n
181
181
182
182
The <ProductNameformat={ProductNameFormat.ShortForm}/> API will return `true` depending on the level of access assigned to that user and the implied relationships inherited in the authorization model.
183
183
184
-
185
184
### Caveats and when not to use it
186
185
187
186
If you are making less than 10 checks, it may be faster to call the [Check API](/api/service#Relationship%20Queries/Check) in parallel instead of Batch Check.
188
187
189
-
The new BatchCheck endpoint is currently supported by the JS SDK (>=[v0.8.0](https://github.com/openfga/js-sdk/releases/tag/v0.8.0) and the Python SDK (>=[v0.9.0](https://github.com/openfga/python-sdk/releases/tag/v0.9.0)). Support in the other SDKs is being worked on.
188
+
:::note
189
+
The BatchCheck endpoint is currently supported by the following SDKs:
190
+
- Go SDK ([>=0.7.0](https://github.com/openfga/go-sdk/releases/tag/v0.7.0))
- Support for .NET is in progress and coming soon.
195
+
196
+
In SDKs that support the `BatchCheck` endpoint (server-side batch checks), the previous `BatchCheck` method has been renamed to `ClientBatchCheck`. `ClientBatchCheck` performs client-side batch checks by making multiple check requests with limited parallelization.
197
+
198
+
The .NET SDK does not yet support the `BatchCheck` endpoint (coming soon). Until then, the `BatchCheck` method maintains its current behavior, performing client-side batch checks equivalent to `ClientBatchCheck` in other SDKs.
199
+
200
+
Refer to the README for each SDK for more information. Refer to the release notes of the relevant SDK version for more information on how to migrate from client-side to the server-side `BatchCheck`.
If you are interested in learning more about Authorization and Role Management at Slack, check out the Auth0 Fine-Grained Authorization (FGA) team's chat with the Slack engineering team.
904
-
904
+
<!--markdown-link-check-disable-->
905
905
<figureclassName="video_container">
906
906
<iframe
907
907
style={{ marginTop: 36, borderRadius: 8 }}
@@ -913,6 +913,7 @@ If you are interested in learning more about Authorization and Role Management a
Copy file name to clipboardExpand all lines: docs/content/modeling/getting-started.mdx
-13Lines changed: 0 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -331,7 +331,6 @@ We will also need to add "User" to the list as it establishes the type of user w
331
331
Now that we have a list of object types we can start defining them using the <UpdateProductNameInLinkslink="../configuration-language"name="{ProductName} Configuration Language" />:
332
332
333
333
<AuthzModelSnippetViewer
334
-
onlyShow={SyntaxFormat.Friendly2}
335
334
configuration={{
336
335
schema_version: '1.1',
337
336
type_definitions: [
@@ -554,7 +553,6 @@ Relation names in <ProductName format={ProductNameFormat.ShortForm}/> are arbitr
554
553
Remember _"How a user is added as a member to an organization is beyond the scope of this feature."_ For the purposes of this model the relation definition should be:
555
554
556
555
<AuthzModelSnippetViewer
557
-
onlyShow={SyntaxFormat.Friendly2}
558
556
configuration={{
559
557
schema_version: '1.1',
560
558
type_definitions: [
@@ -611,7 +609,6 @@ If you want to learn more, you can read further about this in [Modeling User Gro
611
609
The complete <ProductConceptsection="what-is-a-type-definition"linkName="type definition" /> for the **organization** type is:
612
610
613
611
<AuthzModelSnippetViewer
614
-
onlyShow={SyntaxFormat.Friendly2}
615
612
configuration={{
616
613
schema_version: '1.1',
617
614
type_definitions: [
@@ -659,7 +656,6 @@ When a document is created, a relationship tuple will be stored in <ProductName
659
656
The relation definition then should be:
660
657
661
658
<AuthzModelSnippetViewer
662
-
onlyShow={SyntaxFormat.Friendly2}
663
659
configuration={{
664
660
schema_version: '1.1',
665
661
type_definitions: [
@@ -694,7 +690,6 @@ When a user shares a document with another user or set of users as editor, a rel
694
690
The relation definition then should be:
695
691
696
692
<AuthzModelSnippetViewer
697
-
onlyShow={SyntaxFormat.Friendly2}
698
693
configuration={{
699
694
schema_version: '1.1',
700
695
type_definitions: [
@@ -739,7 +734,6 @@ You can learn more about this in [Modeling User Groups](./user-groups.mdx).
739
734
The viewer relation is similar to the document's [editor relation](#relation-editor). It will be defined like this:
740
735
741
736
<AuthzModelSnippetViewer
742
-
onlyShow={SyntaxFormat.Friendly2}
743
737
configuration={{
744
738
schema_version: '1.1',
745
739
type_definitions: [
@@ -772,7 +766,6 @@ This relation is different from the others we have seen so far, as it is a relat
772
766
When a document is created a relationship tuple will be stored in <ProductNameformat={ProductNameFormat.ShortForm}/> to represent this relationship between parent and document. The relation definition then should be:
773
767
774
768
<AuthzModelSnippetViewer
775
-
onlyShow={SyntaxFormat.Friendly2}
776
769
configuration={
777
770
{
778
771
type: 'document',
@@ -811,7 +804,6 @@ _A user can share a document with another user or an organization as either edit
811
804
We can achieve that with the following definition using <UpdateProductNameInLinkslink="../configuration-language"name="{ProductName} Configuration Language" />:
812
805
813
806
<AuthzModelSnippetViewer
814
-
onlyShow={SyntaxFormat.Friendly2}
815
807
skipVersion={true}
816
808
configuration={
817
809
{
@@ -870,7 +862,6 @@ _A user can view a document if they are an owner, viewer or editor of a document
870
862
Similar to the [can_share relation](#relation-can_share), we can achieve that with the following definition using <UpdateProductNameInLinkslink="../configuration-language"name="{ProductName} Configuration Language" />:
871
863
872
864
<AuthzModelSnippetViewer
873
-
onlyShow={SyntaxFormat.Friendly2}
874
865
skipVersion={true}
875
866
configuration={{
876
867
type: 'document',
@@ -937,7 +928,6 @@ _A user can write a document if they are an owner or editor of a document or if
937
928
Similar to the [can_share relation](#relation-can_share), we can achieve that with the following definition using <UpdateProductNameInLinkslink="../configuration-language"name="{ProductName} Configuration Language" />:
938
929
939
930
<AuthzModelSnippetViewer
940
-
onlyShow={SyntaxFormat.Friendly2}
941
931
skipVersion={true}
942
932
configuration={{
943
933
type: 'document',
@@ -986,7 +976,6 @@ _A user can change the owner of a document if they are an owner of the document.
986
976
Similar to the [can_share relation](#relation-can_share), we can achieve that with the following definition using <UpdateProductNameInLinkslink="../configuration-language"name="{ProductName} Configuration Language" />:
987
977
988
978
<AuthzModelSnippetViewer
989
-
onlyShow={SyntaxFormat.Friendly2}
990
979
skipVersion={true}
991
980
configuration={{
992
981
type: 'document',
@@ -1007,7 +996,6 @@ Similar to the [can_share relation](#relation-can_share), we can achieve that wi
1007
996
The complete <ProductConceptsection="what-is-a-type-definition"linkName="type definition" /> for the document type is:
1008
997
1009
998
<AuthzModelSnippetViewer
1010
-
onlyShow={SyntaxFormat.Friendly2}
1011
999
configuration={{
1012
1000
schema_version: '1.1',
1013
1001
type_definitions: [
@@ -1169,7 +1157,6 @@ The complete <ProductConcept section="what-is-a-type-definition" linkName="type
1169
1157
Combining the type definitions for document and organization, we have
Copy file name to clipboardExpand all lines: docs/content/modeling/testing-models.mdx
+9-3Lines changed: 9 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ The `.fga.yaml` contains tests for <ProductName format={ProductNameFormat.ShortF
26
26
| Object | Description |
27
27
| -------- | -------- |
28
28
|`name` (optional) | A descriptive name for the test file |
29
-
|`model` or `model_file`| An <ProductNameformat={ProductNameFormat.ShortForm}/> model or a reference to an external model file in `fga`or `json` format |
29
+
|`model` or `model_file`| An <ProductNameformat={ProductNameFormat.ShortForm}/> model or a reference to an external model file in `fga`, `json`or `mod` format |
30
30
|`tuples or tuple_file` (optional) | A set of tuples or a reference to an external tuple file in `json`, `yaml` or `csv` format. These are considered for all tests. |
31
31
|`tests`| A set of tests that verify the return values of <ProductNameformat={ProductNameFormat.ShortForm}/> API calls |
32
32
@@ -51,7 +51,7 @@ model: |
51
51
current_time < grant_time + grant_duration
52
52
}
53
53
54
-
# tuple_file: ./tuples.yaml # you can specify an external file, or include it inline
54
+
# tuple_file: ./tuples.yaml # you can specify an external file, include it inline, or both
55
55
tuples:
56
56
57
57
# Anne is a member of the Acme organization
@@ -79,7 +79,7 @@ Tests have the following structure:
79
79
| Object | Description |
80
80
| -------- | -------- |
81
81
|`name` (optional) | A descriptive name for the test, like “Organization Membership” |
82
-
|`tuples`| A set of tuples that are only considered for the test |
82
+
|`tuple_file` or `tuples`| A set of tuples that are only considered for the test |
83
83
|`check`| A set of tests for Check calls, each with a user/object and a set of assertions |
84
84
|`list_objects`| A set of tests for ListObjects calls, each one with a user/type and a set of assertions for any number of relations|
85
85
|`list_users`| A set of tests for ListUsers calls, each one with an object and user filter and a set of assertions for the users for any number of relations |
@@ -187,6 +187,12 @@ The following is an example of using the `list_users` option in <ProductName for
187
187
```
188
188
The example above checks that the `organization:acme`, given the current time is February 2nd 2024, it has 'user:anne' as a `member`, nobody as an `admin`. If we tried with current time being February 1st 2024, then `user:peter` would be listed as an `admin`
189
189
190
+
## Testing with Modular Models
191
+
192
+
If you are using [Modular Models](./modular-models.mdx), you need to use the `fga.mod` as the `model_file`.
193
+
194
+
You can define the tests for each model in separate `.fga.yaml` files. All files should point to the `fga.mod` model. You can create a shared file with tuples and reference it with the `tuple_file` option. You can include module-specific tuples in each `fga.yaml` file.
195
+
190
196
## Running tests
191
197
192
198
Tests are run using the `model test` CLI command. For instructions on installing the OpenFGA CLI, visit the [OpenFGA CLI Github repository](https://github.com/openfga/cli).
0 commit comments