How to improve complex relationship reads

[johnrc90]

Hey guys, we are using Authzed for 2 months now in our multitenant application. We basically have a tenant where the users can be inside a group and create resouces that can only be accessed by group members. We have a admin user that manage groups/users/resources inside a tenant and a master user that manages tenants. Our schema is something like that:

definition user {}

definition tenant {
  // user roles
	relation writer: user
	relation reader: user
  
  // admin roles
	relation master: user
	relation admin: user

  // user CRUD
        permission write_resource = writer + admin + master
	permission read_resource = reader + writer + admin + master
  
  // admin CRUD
	permission full_access = admin + master
	permission write_tenant = master
}

definition group {
  // a group is owned by a tenant
        relation owner: tenant
  // a user can be member of the group
	relation member: user

  // a group can be viewed by its member users and its owner tenant admin
	permission view_group = owner->full_access + member

  // a resource from the group can be read/written by an user if the user can read/write in the tenant and is a member of the group or if the user is admin
	permission write_resource = (member & owner->write_resource) + owner->full_access
	permission read_resource = (member & owner->read_resource) + owner->full_access
}

// a resource is owned by a group and can be read/written by an user if the user can read/write in the group
definition resource {
	relation owner: group
	permission write = owner->write_resource
	permission read = owner->read_resource
}

The admin user need to see all groups and its members so it can assing users to groups. Right now we are doing:

1. Listing the groups that are ownend by the tenant the admin is in.
2. Listing the members for each group one by one.

Its there a way to model the schema so i can get "All groups and its members from a specific tenant" at once?

With examples:

// Tenant ABC
group:group1#owner@tenant:ABC
group:group2#owner@tenant:ABC
tenant:ABC#admin@user:user1
tenant:ABC#reader@user:user2
tenant:ABC#writer@user:user3
tenant:ABC#writer@user:user4
tenant:ABC#writer@user:user5
group:group1#member@user:user2
group:group1#member@user:user3
group:group2#member@user:user4

// Tenant XYZ
group:group3#owner@tenant:XYZ
tenant:XYZ#writer@user:user6
group:group3#member@user:user6

I would like a way to list only the members from tenant ABC

group:group1#member@user:user2
group:group1#member@user:user3
group:group2#member@user:user4

Just using relationship read group member would also list group:group3#member@user:user6 from tenant XYZ.

I keep thinking on how this could work in a RDBMS with JOINs, but i dont know if this is possible to do in performatic way with Authzed

[josephschorr]

One way is a LookupSubjects via the tenant.

First, add the following to your tenant:

definition tenant {
  ...
  relation group: group
  permission member = group->member
}

Then write relationships linking the tenant to each group (i.e. inverted from your current group->tenant).

Then issue a LookupSubjects on tenant:whoever#member for user, and you should get back all the users for the tenant

[johnrc90]

I see. I would still use the owner relation on the group definition to handle the users roles inside the group. Its not a problem to have this kind of "cyclic" relation then?

[josephschorr]

So long as the permission walks are not actually cyclic in nature, having bidrectional relationships is perfectly fine. In this case, the tenant->group relation would only be used for this purpose, so its perfectly safe.

[johnrc90]

Got it, thanks for the help