Combining Entitlements Question

[farlej2]

Hello! Thanks in advance for any advice that can be given - I did my best to search the discussion thread for something similar and couldn't find anything. My organization is currently looking to purchase an enterprise license for Okta FGA and I'm trying to figure out how to - for lack of a better phrase - combine relations as entitlements. We have a fairly complicated system with roles and entitlements at different levels, and instead of trying to describe our business I think I'd like to provide a more simplified analogy. Let's say we have the following:

• A feature that grants access/entitles a user to perform a given action. For example, the ability to create_document would entitle a user to create a document.
• A product offering that enables certain features. For example, we may have an enterprise product that enables feature:create_document.
• A customer that can purchase one or more products. The unified/distinct set of products distills down to a set of features/entitlements that the customer is paying for.
• A role type exists that has features associated with it. For example, role:administrator may enable feature:create_document.
• A user object can be related to a customer object to grant access to that customer account, and as part of this they are granted a role (ex: role:administrator).
• The entitlements a given user has in a given customer account can be defined as the intersection of entitlements allowed by products the customer has purchased with the entitlements granted to the role the user was associated with in that customer. A given user can be assigned different roles in different customers.

For example, let's say I have:

• product:enterprise product that has feature:create_document, feature:edit_document, feature:view_document (to keep this simple, I'm only going to provide this one example - but you can imagine other products with a more limited set of entitlements)
• role:administrator role that has feature:create_document, feature:edit_document, feature:view_document
• role:reviewer role that just has feature:view_document
• user:bob with role:administrator access to customer:widgets_customer
• user:jane with role:reviewer access to customer:widgets_customer
• customer:widgets_customer has purchased product:enterprise

What I'd like to do is ask:

• "Does user:bob have the feature:create_document entitlement in customer:widgets_customer"?
  I'd expect this answer to be "true" becauser user:bob is associated with role:administrator in customer:widgets_customer, and that allows them the feature:create_document entitlement, assuming that a product purchased by customer:widgets_customer enables it (which it does, because customer:widgets_customer purchased product:enterprise.
• "Does user:jane have the feature:create_document entitlement in customer:widgets_customer"?
  I'd expect this answer to be "false" becauser user:jane is associated with role:reviewer in customer:widgets_customer, and that DOES NOT grant them the feature:create_document entitlement, even though there IS a product that enables it.

Again, ANY support here would be much appreciated.

Thank you!

[sreeram-n]

have the same question in another discussion topic : https://github.com/orgs/openfga/discussions/312

[aaguiarz]

Hi @farlej2

Let me know if this makes sense. You can run it with the CLI with the fga model test --tests store.fga.yaml command.

model: |
  model
    schema 1.1

  type feature

  type product
    relations
      # products have a set of features
      define feature : [feature]

  type role
    relations
      # roles have users and features assigned to them
      define feature: [feature]

  type customer
    relations
      # customers have products 
      define product : [product]
      # we define this intermediate relation so it can be accessed from the user type
      define feature : feature from product

  type user
    relations
      define role: [role]
      # this is the customer the user is authenticated to
      define customer_in_context: [customer]
      # if the role and the customer have the feature, the user can access it
      define can_access_feature :  feature from role and feature from customer_in_context

tuples:
  # Features for each product
  - user: feature:create_document
    relation: feature
    object: product:enterprise

  - user: feature:edit_document
    relation: feature
    object: product:enterprise

  - user: feature:view_document
    relation: feature
    object: product:enterprise
 
  # Features for each role
  - user: feature:create_document
    relation: feature
    object: role:administrator

  - user: feature:edit_document
    relation: feature
    object: role:administrator

  - user: feature:view_document
    relation: feature
    object: role:administrator

  - user: feature:view_document
    relation: feature
    object: role:reviewer

  # Roles for each user
  - user: role:administrator
    relation : role
    object: user:bob

  - user: role:reviewer
    relation : role
    object: user:jane
 
  # Products per customer
  - user: product:enterprise
    relation: product
    object: customer:widgets_customer

tests:
  - tuples:
    -  user: customer:widgets_customer
       relation: customer_in_context
       object: user:bob
    check:
      - user: feature:create_document
        object: user:bob
        assertions:
          can_access_feature: true

  - tuples:
    -  user: customer:widgets_customer
       relation: customer_in_context
       object: user:jane
    check:
      - user: feature:create_document
        object: user:jane
        assertions:
          can_access_feature: false

When you call check() you'll need to send a contextual tuple specifying the customer that the user is logged-in to using the customer_in_context user relation.

[farlej2]

Thank you!