quarkiverse / quarkus-openfga-client

Quarkus extension for OpenFGA support
https://openfga.dev
Apache License 2.0
9 stars 6 forks source link

Parsing error when loading authorization model that contains indirect relations #115

Closed wkerckho closed 6 months ago

wkerckho commented 6 months ago

I'm currently evaluating OpenFGA integration into Quarkus using this library. For testing, I am relying on the dev service with the config option for initializing an authorization model quarkus.openfga.devservices.authorization-model. Whenever I'm trying to load a model that contains indirect relations (e.g. https://openfga.dev/docs/modeling/roles-and-permissions#02-adding-permissions-for-bookings), the DevServicesOpenFGAProcessor cannot complete successfully due to an error while parsing the model.

I've quickly setup a reproducer repository at https://github.com/wkerckho/openfga-parsing-issue-reproducer

wkerckho commented 6 months ago

The exception is caused by the non-null check on the parameter object in the ObjectRelation constructor.

Note that I have been testing with authorization model JSON copied from the official docs or converted from DSL via the OpenFGA playground UI (where a computedUserset only includes the relation attribute). The Swagger API documentation on the other hand, uses an empty object attribute in the JSON value for computedUserSet (see: https://openfga.dev/api/service#/Authorization%20Models/WriteAuthorizationModel).

Is it correct to assume that:

{
  "computedUserset":{
    "relation":"writer"
  }
}

equals:

{
  "computedUserset":{
    "object":"",
    "relation":"writer"
  }
}

from a semantical point-of-view?