You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/configuration-language.mdx
+118-5Lines changed: 118 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ import {
25
25
26
26
<ProductNameformat={ProductNameFormat.LongForm}/>'s Configuration Language builds a representation of a system's <ProductConceptsection="what-is-an-authorization-model"linkName="authorization model" />, which informs <UpdateProductNameInLinkslink="/api/service"name="{ProductName}'s API" /> on the <ProductConceptsection="what-is-a-type"linkName="object types" /> in the system and how they relate to each other. The Configuration Language describes the <ProductConceptsection="what-is-a-relation"linkName="relations" /> possible for an object of a given type and lists the conditions under which one is related to that object.
27
27
28
-
The Configuration Language can be presented in **DSL** or **JSON** syntax. The JSON syntax is accepted by the API and closely tracks the language in the [Zanzibar paper](https://research.google/pubs/pub48190/). The DSL adds syntactic sugar on top of JSON for ease of use, but compiles down to JSON before being sent to <ProductNameformat={ProductNameFormat.ShortForm}/>'s API. JSON syntax is used to call API directly or through the [SDKs](./getting-started), while DSL is used to interact with <ProductNameformat={ProductNameFormat.ShortForm}/> in the [Playground](https://play.fga.dev/), and they can be switched between throughout this documentation.
28
+
The Configuration Language can be presented in **DSL** or **JSON** syntax. The JSON syntax is accepted by the API and closely tracks the language in the [Zanzibar paper](https://research.google/pubs/pub48190/). The DSL adds syntactic sugar on top of JSON for ease of use, but compiles down to JSON before being sent to <ProductNameformat={ProductNameFormat.ShortForm}/>'s API. JSON syntax is used to call API directly or through the [SDKs](./getting-started), while DSL is used to interact with <ProductNameformat={ProductNameFormat.ShortForm}/> in the [Playground](https://play.fga.dev/), the [CLI](https://github.com/openfga/cli), and the IDE extensions for [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=openfga.openfga-vscode) and [IntelliJ](https://plugins.jetbrains.com/plugin/24394-openfga). They can be switched between throughout this documentation.
29
29
30
30
Please familiarize yourself with basic <ProductConcept /> and [How to get started on modeling](./modeling/getting-started.mdx) before starting this guide.
31
31
@@ -322,7 +322,7 @@ In the type definition snippet above, `anne` is a `member` of `team:product` if
322
322
relation: 'member',
323
323
object: 'team:product',
324
324
_description: 'Everyone (`*`) is directly related to the product team as a member',
325
-
},
325
+
}
326
326
]}
327
327
/>
328
328
@@ -741,7 +741,7 @@ For more examples, see [Modeling with Multiple Restrictions](./modeling/multiple
741
741
742
742
### The Exclusion Operator
743
743
744
-
The **exclusion operator** (`but not` in the DSL, `difference` in the JSON syntax) indicates that a <ProductConceptsection="what-is-a-relationship"linkName="relationship" /> exists if the <ProductConceptsection="what-is-a-user"linkName="user" /> is in the base userset, but not in the excluded userset. It's helpful when modeling exclusion or block lists.
744
+
The **exclusion operator** (`but not` in the DSL, `difference` in the JSON syntax) indicates that a <ProductConceptsection="what-is-a-relationship"linkName="relationship" /> exists if the <ProductConceptsection="what-is-a-user"linkName="user" /> is in the base userset but not in the excluded userset. This operator is particularly useful when modeling exclusion or block lists.
745
745
746
746
<AuthzModelSnippetViewer
747
747
configuration={{
@@ -774,7 +774,7 @@ The **exclusion operator** (`but not` in the DSL, `difference` in the JSON synta
774
774
}}skipVersion={true}
775
775
/>
776
776
777
-
In the type definition snippet above, `user:anne` is a `viewer` of `document:new-roadmap` if:
777
+
In the type definition snippet above, `user:anne` is a `viewer` of `document:new-roadmap` if and only if:
778
778
779
779
-`anne` has a direct relationship as `viewer` to `document:new-roadmap`
780
780
@@ -789,7 +789,7 @@ In the type definition snippet above, `user:anne` is a `viewer` of `document:new
789
789
/>
790
790
AND
791
791
792
-
-`anne` is not blocked from document:new-roadmap; the following relation tuple **does not exist**:
792
+
-`anne` is not blocked from `document:new-roadmap` (i.e., the following relationship tuple must not exist):
793
793
<RelationshipTuplesViewer
794
794
relationshipTuples={[
795
795
{
@@ -820,6 +820,119 @@ but not in:
820
820
-`anne` is blocked on the document:new-roadmap `{"user": "user:anne", "relation": "blocked", "object": "document:new-roadmap"}`
821
821
822
822
:::
823
+
### Grouping and nesting operators
824
+
825
+
You can define complex conditions by using parentheses to group and nest operators. Note that direct relationships can be included in an expression with parentheses.
826
+
827
+
<AuthzModelSnippetViewer
828
+
configuration={
829
+
{
830
+
"schema_version": "1.1",
831
+
"type_definitions": [
832
+
{
833
+
"type": "user",
834
+
"relations": {},
835
+
"metadata": null
836
+
},
837
+
{
838
+
"type": "organization",
839
+
"relations": {
840
+
"member": {
841
+
"this": {}
842
+
}
843
+
},
844
+
"metadata": {
845
+
"relations": {
846
+
"member": {
847
+
"directly_related_user_types": [
848
+
{
849
+
"type": "user"
850
+
}
851
+
]
852
+
}
853
+
}
854
+
}
855
+
},
856
+
{
857
+
"type": "folder",
858
+
"relations": {
859
+
"organization": {
860
+
"this": {}
861
+
},
862
+
"parent": {
863
+
"this": {}
864
+
},
865
+
"viewer": {
866
+
"intersection": {
867
+
"child": [
868
+
{
869
+
"union": {
870
+
"child": [
871
+
{
872
+
"this": {}
873
+
},
874
+
{
875
+
"tupleToUserset": {
876
+
"computedUserset": {
877
+
"relation": "viewer"
878
+
},
879
+
"tupleset": {
880
+
"relation": "parent"
881
+
}
882
+
}
883
+
}
884
+
]
885
+
}
886
+
},
887
+
{
888
+
"tupleToUserset": {
889
+
"computedUserset": {
890
+
"relation": "member"
891
+
},
892
+
"tupleset": {
893
+
"relation": "organization"
894
+
}
895
+
}
896
+
}
897
+
]
898
+
}
899
+
}
900
+
},
901
+
"metadata": {
902
+
"relations": {
903
+
"organization": {
904
+
"directly_related_user_types": [
905
+
{
906
+
"type": "organization"
907
+
}
908
+
]
909
+
},
910
+
"parent": {
911
+
"directly_related_user_types": [
912
+
{
913
+
"type": "folder"
914
+
}
915
+
]
916
+
},
917
+
"viewer": {
918
+
"directly_related_user_types": [
919
+
{
920
+
"type": "user"
921
+
}
922
+
]
923
+
}
924
+
}
925
+
}
926
+
}
927
+
]
928
+
}
929
+
}skipVersion={true}
930
+
/>
931
+
932
+
933
+
### Conditional relationships
934
+
935
+
<ProductNameformat={ProductNameFormat.ShortForm}/> supports conditional relationships, which are only considered if a specific condition is met. You can learn more about Conditional Relationships in the [Modeling: Conditional Relationships](./modeling/conditions.mdx) guide.
0 commit comments