How would you call /check in parallel on each object returned from your database?

[vazexqi]

We are using OpenFGA and are trying to figure out what's the best way to support a list operation. This, I believe, falls squarely into the "Search with Permissions" problem space.

I have a (hopefully) simple question on Option 1 suggested at https://openfga.dev/docs/interacting/search-with-permissions.

Option 1: Search, Then Check
Pre-filter, then call OpenFGA Check endpoint.

1. Filter and sort on your database.
2. Call [/check](https://openfga.dev/docs/interacting/relationship-queries#check) in parallel on each object returned from your database.
3. Filter out objects the user does not have access to.
4. Return the filtered result to the user.

Per my understanding of the /check API, you can only provide it with one tuple to query at a time.

Assuming that my database returns 100 objects, I would have to make 100 calls to /check to see if the user can access each object.

My questions;

1. If we are indeed making 100 individual HTTP calls, won't this be quite taxing on the client machine (the one that has to make the 100 /check calls)? Imagine I am running this on some edge runtime.

2. [Maybe I am just missing something in the API] To mitigate the overheard, is there a different /check endpoint that takes in a list tuples to check and return the results of the check for the list individually? More concretely,

BODY
[
{user:x1, relation:y1, object:z2},
{user:x2, relation:y2, object:z2},
]

RESPONSE
[
{allowed: true}, // This is the result for the first tuple in the body
{allowed: false} // This is the result for the second tuple in the body, etc
]

Thanks!

[aaguiarz]

Hi @vazexqi !

The SDKs have a batchCheck method that runs the checks in parallel for you, and yes, they can be taxing to the client.

We'll be working on a batchCheck server endpoint towards the end of the year (openfga/roadmap#35)

[vazexqi]

Thanks — I missed this because we are not using the SDKs directly, we are calling the API from our edge runtime. We do have some other runtimes that can make use of the SDK so we will use batchCheck there.

👍 Good to know that server-side batch is on the roadmap.