Skip to content

Commit 72396e9

Browse files
committed
docs: Improve docs and document tuple key structure
1 parent 4708e12 commit 72396e9

File tree

1 file changed

+42
-0
lines changed

1 file changed

+42
-0
lines changed

README.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,48 @@ Below is the example configuration one might use in `declarative_config`:
9595
| `tuple`<br/>_required_<br/><br/>**Type:** record | - | Tuple key for authorization |
9696
| `contextual_tuples`<br/>_optional_<br/><br/>**Type:** set | {} | Set of contextual tuples for authorization |
9797

98+
## Tuple Definition
99+
100+
The `Tuple key` is a structure used to define the relationship between a user, relation, and object. It supports both direct string values and Lua expressions that return a string. The Lua expressions run in the Kong Plugin Sandbox for security.
101+
102+
### Fields
103+
104+
- `user`: A string representing the user.
105+
- `user_by_lua`: A Lua expression that returns a string representing the user.
106+
- `relation`: A string representing the relation.
107+
- `relation_by_lua`: A Lua expression that returns a string representing the relation.
108+
- `object`: A string representing the object.
109+
- `object_by_lua`: A Lua expression that returns a string representing the object.
110+
111+
### Entity Checks
112+
113+
- Only one of `user` or `user_by_lua` must be provided.
114+
- At least one of `user` or `user_by_lua` must be provided.
115+
- Only one of `relation` or `relation_by_lua` must be provided.
116+
- At least one of `relation` or `relation_by_lua` must be provided.
117+
- Only one of `object` or `object_by_lua` must be provided.
118+
- At least one of `object` or `object_by_lua` must be provided.
119+
120+
### Example
121+
122+
Below is an example configuration using `Tuple key` in `declarative_config`:
123+
124+
```yaml
125+
- name: kong-authz-openfga
126+
config:
127+
host: localhost
128+
port: 1234
129+
store_id: "your_store_id"
130+
tuple:
131+
user_by_lua: return 'user:' .. kong.client.get_consumer().username
132+
relation: "can_view"
133+
object: "transaction:A"
134+
contextual_tuples:
135+
- user_by_lua: return 'user:' .. kong.client.get_consumer().username
136+
relation: "user"
137+
object_by_lua: return 'ip:' .. kong.client.get_ip()
138+
```
139+
98140
## Plugin version
99141

100142
Version: 0.1.0

0 commit comments

Comments
 (0)