Support additional ABAC scenarios

[aaguiarz]

OpenFGA provides support for some basic ABAC scenarios with contextual tuples.

We want to explore additional options, that could be:

• Specifying conditions when writing a tuple (e.g. this tuple is only valid if condition X)
• Support storing/referring to resource attributes (e.g. write a resource attribute like "feature:X status = 'in-development'" and refer to it in the model)
• Support conditional functions in the DSL that can be called from the model
• Grant access for a specific period of time, e.g. 10 minutes after the permission was granted.
• Allow implementing entitlements scenarios that restrict based on usage data (e.g. max number of collaborators)
• IP-based filtering, where the IP ranges can be coded in the DSL

Related conversations: https://github.com/orgs/openfga/discussions/114

Early POC was demoed here https://youtu.be/sFqk42fJy_E?t=667

[velmohan]

This one has some excellent features. I am particularly interested in the features:

1. support conditional functions in the DSL and
2. support referring to resource attributes.

This will provide a solution for my problem I discussed in here: https://github.com/orgs/openfga/discussions/206.

[velmohan]

Is it possible to say roughly when we might expect these features to be released please?

[claraisrael]

Something I missed during my time using OpenFGA was time-based authorization, it'd be amazing if you could add support for that use-case!

[aaguiarz]

Available in https://github.com/openfga/openfga/releases/tag/v1.4.0