From 39e19ffde2ea61fe6b4a522198ed301e367f13b8 Mon Sep 17 00:00:00 2001 From: Jonathan Whitaker Date: Fri, 8 Dec 2023 16:25:42 -0700 Subject: [PATCH] docs: abac feedback --- docs/content/concepts.mdx | 4 ++-- docs/content/modeling/abac-conditions.mdx | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/content/concepts.mdx b/docs/content/concepts.mdx index 2d6b769bf..7d3be1b62 100644 --- a/docs/content/concepts.mdx +++ b/docs/content/concepts.mdx @@ -403,12 +403,12 @@ For more information, please see [Direct Access](./modeling/direct-access.mdx). ## What Is A Conditional Relationship Tuple? -A **conditional relationship tuple** is a [relationship tuple](#what-is-a-relationship-tuple?) which represents a [relationship](#what-is-a-relationship?) conditioned upon the evaluation of the boolean outcome the relationship tuple is conditioned upon. +A **conditional relationship tuple** is a [relationship tuple](#what-is-a-relationship-tuple?) which represents a [relationship](#what-is-a-relationship?) conditioned upon the evaluation of some [ABAC Condition](#what-is-an-abac-condition?). If a relationship tuple is conditioned, then the condition which the tuple is conditioned upon must evaluate to a truthy outcome for the relationship tuple to be considered a permissible relationship. -The following relationship tuple is a conditional relationship tuple because it is conditioned on `mycondition`. The relationship is considered permissible because the expression `x < 100` for the condition evaluates to a truthy outcome since `20 < 100`. +The following relationship tuple is a conditional relationship tuple because it is conditioned on `mycondition`. If the expression for `mycondition` is defined as `x < 100`, then the relationship is considered permissible because the expression evaluates to a truthy outcome since `20 < 100`. ## Queries with Condition Context -Now that we have written a [Conditional Relationship Tuple](../concepts.mdx#what-is-a-conditional-relationship-tuple), we can query OpenFGA using the [Check API](https://openfga.dev/api/service#/Relationship%20Queries/Check) to see if `user:anne` has viewer access to `document:1` under certain conditions/context. That is, `user:anne` should only have access is the current timestamp is less than or equal to the grant timestamp (e.g. the time which the tuple was written) plus the duration of the grant (10 minutes). If the current timestamp is less than or equal, then you'll get a permit decision. For example, +Now that we have written a [Conditional Relationship Tuple](../concepts.mdx#what-is-a-conditional-relationship-tuple), we can query OpenFGA using the [Check API](https://openfga.dev/api/service#/Relationship%20Queries/Check) to see if `user:anne` has viewer access to `document:1` under certain conditions/context. That is, `user:anne` should only have access is the current timestamp is less than or equal to the grant timestamp (e.g. the time which the tuple was written) plus the duration of the grant (10 minutes). If the current timestamp is less than or equal, then you'll get a permissive decision. For example,