Reuse Type Definitions

[aaguiarz]

In some applications resources always have the same structure, for example:

model
   schema 1.1

type user

type organization
  relations
    define member : [user]
    define admin : [user]

type document
  relations
     define parent : [organization]
     define owner : [user]
     define editor : [user] or owner or admin from organization
     define viewer : [user] or editor

type image
  relations
     define parent : [organization]
     define owner : [user]
     define editor : [user] or owner or admin from organization
     define viewer : [user] or editor

To make models smaller and easier to read, it would be useful to define a template or base type where you'd define the resource structure:

template resource
  relations
     define parent : [organization]
     define owner : [user]
     define editor : [user] or owner or admin from organization
     define viewer : [user] or editor

type image based on resource
type document based on resource

It could be possible to add additional relations in a specific resource:

type document based on resource
  relations
    define can_print : viewer

or maybe override a specific relation

type document based on resource
  relations
    define viewer : member from organization

Thoughts? Would you use this? How? If you can provide specific examples it would be very useful.

[jasehackman]

This change will also make model changes less error prone. When I have several types that have the same definition, a change requires a lot of copy and paste. This is compounded when writing tests against the model. The test file grows exponentially with each asset. It would be nice to test a 'base' type in one place instead of repeating tests for each type.

[aaguiarz]

For testing, that would imply to define the test on the 'template' and execute them for every instance of the template, and eventually create tuples that are based on the template, e.g.

- tuples: 
   - user: organization:x
   - relation: parent
   - object: <resource>:1

- tests:
      check: 
          - user: organization:x
             object: <resource>:1
             assertions:
                  parent : true

This would create 2 tuples, one for image:1 and another for document:1, and run two tests, one for each tuple.

Makes sense?

[fullonic]

This feature would be very useful. It would make the model declaration more DRY, making changes easy to track, review, and less error-prone.

We have multiple database tables that need to be mapped to a concrete OpenFGA type. Because all of these tables have the same authorization policies, we are copying and pasting all the relations N times. In the end, we end up with a huge .yaml file. Having the ability to reuse the relations would reduce the size of the .fga file and make it easier to maintain and read. Furthermore, if we could extend the base template either with new relations or by overriding the base ones, it would be even better. But for now, having the template feature for our use case would be great.

Cheers