ory / keto

The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
https://www.ory.sh/?utm_source=github&utm_medium=banner&utm_campaign=keto
Apache License 2.0
4.8k stars 346 forks source link

feat: compare this with ctx.subject (#1204) #1497

Open cmmoran opened 9 months ago

cmmoran commented 9 months ago

In the conversation for #1204, @hperl commented:

From an implementation point of view, this would require:

  • adding support for this expression in the OPL parser
  • adding a new userset rewrites type (maybe SubjectEqualsObject), and attach it to the relation if we parsed the expression
  • implement the SubjectEqualsObject rewrite in the check engine (simple, just compare object and subject for a given relation tuple)

Of course, add tests to make sure your change was effective, and run the fuzzers if you touch parser code.

This PR addresses the above suggested implementation and adds the related feature.

Related issue(s)

1204

Checklist

Further Comments

I will amend this PR to update/add to the documentation regarding this new feature.