sample-stores/stores/knowledge-base/store.fga.yaml at main · openfga/sample-stores · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
name: Knowledge Base Authorization Model Tests
model_file: model.fga

tuples:
  - user: user:alice
    relation: admin
    object: organization:acme
  - user: user:bob
    relation: editor
    object: organization:acme
  - user: user:charlie
    relation: member
    object: organization:acme

  - user: organization:acme
    relation: organization
    object: group:docs-team
  - user: user:bob
    relation: member
    object: group:docs-team
  - user: user:dave
    relation: member
    object: group:docs-team

  # Top-level space container
  - user: organization:acme
    relation: organization
    object: container:engineering-space
  - user: user:bob
    relation: owner
    object: container:engineering-space
  - user: group:docs-team#member
    relation: editor
    object: container:engineering-space

  # Nested folder container
  - user: organization:acme
    relation: organization
    object: container:api-docs
  - user: container:engineering-space
    relation: parent_container
    object: container:api-docs

  # Article in the API docs container
  - user: container:api-docs
    relation: parent_container
    object: article:getting-started
  - user: user:bob
    relation: author
    object: article:getting-started

  # Public article (anyone can view)
  - user: user:*
    relation: viewer
    object: article:public-faq
  - user: user:bob
    relation: author
    object: article:public-faq

  # Attachment
  - user: article:getting-started
    relation: article
    object: attachment:diagram-png
  - user: user:bob
    relation: uploader
    object: attachment:diagram-png

tests:
  - name: Admin has full access to containers
    check:
      - user: user:alice
        object: container:engineering-space
        assertions:
          can_view: true
          can_edit: true
          can_delete: true

  - name: Container owner can manage container
    check:
      - user: user:bob
        object: container:engineering-space
        assertions:
          can_view: true
          can_edit: true
          can_create_article: true
          can_delete: true

  - name: Org members can view containers
    check:
      - user: user:charlie
        object: container:engineering-space
        assertions:
          can_view: true
          can_edit: false

  - name: Nested container inherits from parent
    check:
      - user: user:bob
        object: container:api-docs
        assertions:
          can_view: true
          can_edit: true
      - user: user:charlie
        object: container:api-docs
        assertions:
          can_view: true
          can_edit: false

  - name: Article author can publish and archive
    check:
      - user: user:bob
        object: article:getting-started
        assertions:
          can_view: true
          can_edit: true
          can_publish: true
          can_archive: true
          can_delete: true

  - name: Article inherits container visibility
    check:
      - user: user:charlie
        object: article:getting-started
        assertions:
          can_view: true
          can_edit: false
          can_publish: false

  - name: Public article is viewable by anyone
    check:
      - user: user:charlie
        object: article:public-faq
        assertions:
          can_view: true
      - user: user:bob
        object: article:public-faq
        assertions:
          can_view: true
          can_publish: true

  - name: Group-based access to containers
    check:
      - user: user:dave
        object: container:engineering-space
        assertions:
          can_view: true
          can_edit: true
          can_create_article: true
      - user: user:dave
        object: article:getting-started
        assertions:
          can_view: true
          can_edit: true

  - name: Attachment follows article visibility
    check:
      - user: user:bob
        object: attachment:diagram-png
        assertions:
          can_view: true
          can_delete: true
      - user: user:charlie
        object: attachment:diagram-png
        assertions:
          can_view: true
          can_delete: false

  - name: List containers accessible by users
    list_objects:
      - user: user:alice
        type: container
        assertions:
          can_view:
            - container:engineering-space
            - container:api-docs
          can_edit:
            - container:engineering-space
            - container:api-docs
      - user: user:bob
        type: container
        assertions:
          can_view:
            - container:engineering-space
            - container:api-docs
          can_edit:
            - container:engineering-space
            - container:api-docs
      - user: user:dave
        type: container
        assertions:
          can_view:
            - container:engineering-space
            - container:api-docs
          can_edit:
            - container:engineering-space
            - container:api-docs

  - name: List articles accessible by users
    list_objects:
      - user: user:bob
        type: article
        assertions:
          can_view:
            - article:getting-started
            - article:public-faq
          can_edit:
            - article:getting-started
            - article:public-faq
          can_publish:
            - article:getting-started
            - article:public-faq
      - user: user:charlie
        type: article
        assertions:
          can_view:
            - article:getting-started
            - article:public-faq

  - name: List attachments accessible by users
    list_objects:
      - user: user:bob
        type: attachment
        assertions:
          can_view:
            - attachment:diagram-png
          can_delete:
            - attachment:diagram-png

  - name: List users with access to engineering container
    list_users:
      - object: container:engineering-space
        user_filter:
          - type: user
        assertions:
          can_view:
            users:
              - user:alice
              - user:bob
              - user:charlie
              - user:dave
          can_edit:
            users:
              - user:alice
              - user:bob
              - user:dave

  - name: List users who can publish articles
    list_users:
      - object: article:getting-started
        user_filter:
          - type: user
        assertions:
          can_publish:
            users:
              - user:alice
              - user:bob

  - name: List users with access to attachment
    list_users:
      - object: attachment:diagram-png
        user_filter:
          - type: user
        assertions:
          can_view:
            users:
              - user:alice
              - user:bob
              - user:charlie
              - user:dave