Using Ory Keto with RBAC design for permission service

.gitignore

@@ -1,5 +1,5 @@
-# Created by https://www.toptal.com/developers/gitignore/api/go,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode
-# Edit at https://www.toptal.com/developers/gitignore?templates=go,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode
+# Created by https://www.toptal.com/developers/gitignore/api/go,node,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode
+# Edit at https://www.toptal.com/developers/gitignore?templates=go,node,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode
 
 ### dotenv ###
 .env
@@ -229,6 +229,145 @@ Temporary Items
 # iCloud generated files
 *.icloud
 
+### Node ###
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+.pnpm-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+web_modules/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Microbundle cache
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variable files
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# Next.js build output
+.next
+out
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+
+# Gatsby files
+.cache/
+# Comment in the public line in if your project uses Gatsby and not Next.js
+# https://nextjs.org/blog/next-9-1#public-directory-support
+# public
+
+# vuepress build output
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+.temp
+
+# Docusaurus cache and generated files
+.docusaurus
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# TernJS port file
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
+
+### Node Patch ###
+# Serverless Webpack directories
+.webpack/
+
+# Optional stylelint cache
+
+# SvelteKit build / generate output
+.svelte-kit
+
 ### SublimeText ###
 # Cache files for Sublime Text
 *.tmlanguage.cache
@@ -327,4 +466,4 @@ $RECYCLE.BIN/
 # Windows shortcuts
 *.lnk
 
-# End of https://www.toptal.com/developers/gitignore/api/go,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode
+# End of https://www.toptal.com/developers/gitignore/api/go,node,vim,linux,macos,dotenv,eclipse,windows,sublimetext,jetbrains+all,visualstudiocode

config/keto/keto.yml

@@ -0,0 +1,11 @@
+version: v0.12.0-alpha.0
+
+dsn: memory
+
+namespaces:
+  location: file://./namespaces.keto.ts
+
+log:
+  level: debug
+  format: text
+  leak_sensitive_values: true

config/keto/namespaces.keto.ts

@@ -0,0 +1,70 @@
+import { Context, Namespace, SubjectSet } from "@ory/keto-namespace-types"
+
+class User implements Namespace {}
+
+class Role implements Namespace {
+  related: {
+    members: (User | Role)[]
+  }
+}
+
+class Global implements Namespace {
+  related: {
+    editors: Role[]
+  }
+
+  permits = {
+    tournament_edit: (ctx: Context): boolean => this.related.editors.includes(ctx.subject),
+  }
+}
+
+class OsuTournament implements Namespace {
+  related: {
+    viewers: (User | SubjectSet<Role, "members">)[]
+    editors: (User | SubjectSet<Role, "members">)[]
+
+    mappool_viewers: (User | SubjectSet<Role, "members">)[]
+    mappool_editors: (User | SubjectSet<Role, "members">)[]
+
+    match_viewers: (User | SubjectSet<Role, "members">)[]
+    match_editors: (User | SubjectSet<Role, "members">)[]
+
+    global: Global[]
+  }
+
+  permits = {
+    edit: (ctx: Context): boolean => 
+      this.related.editors.includes(ctx.subject) ||
+      this.related.global.traverse((p) => p.permits.tournament_edit(ctx)),
+
+    mappool_edit: (ctx: Context): boolean => 
+      this.permits.edit(ctx) ||
+      this.related.mappool_editors.includes(ctx.subject),
+
+    match_edit: (ctx: Context): boolean => 
+      this.permits.edit(ctx) ||
+      this.related.match_editors.includes(ctx.subject)
+  }
+}
+
+class OsuMappool implements Namespace {
+  related: {
+    tournament: OsuTournament[]
+  }
+
+  permits = {
+    edit: (ctx: Context): boolean =>
+      this.related.tournament.traverse((p) => p.permits.mappool_edit(ctx))
+  }
+}
+
+class OsuMatch implements Namespace {
+  related: {
+    tournament: OsuTournament[]
+  }
+
+  permits = {
+    edit: (ctx: Context): boolean =>
+      this.related.tournament.traverse((p) => p.permits.match_edit(ctx))
+  }
+}

config/keto/package.json

@@ -0,0 +1,7 @@
+{
+    "private": true,
+    "devDependencies": {
+        "@ory/keto-namespace-types": "^0.13.0-alpha.0",
+        "typescript": "^5.5.3"
+    }
+}

config/keto/relation-tuples/global.json

@@ -0,0 +1,22 @@
+[
+    {
+        "namespace": "Global",
+        "object": "*",
+        "relation": "editors",
+        "subject_set": {
+            "namespace": "Role",
+            "object": "admin",
+            "relation": "members"
+        }
+    },
+    {
+        "namespace": "Global",
+        "object": "*",
+        "relation": "editors",
+        "subject_set": {
+            "namespace": "Role",
+            "object": "developer",
+            "relation": "members"
+        }
+    }
+]

config/keto/relation-tuples/osu.json

@@ -0,0 +1,32 @@
+[
+    {
+        "namespace": "OsuTournament",
+        "object": "*",
+        "relation": "editors",
+        "subject_set": {
+            "namespace": "Role",
+            "object": "organizer",
+            "relation": "members"
+        }
+    },
+    {
+        "namespace": "OsuTournament",
+        "object": "*",
+        "relation": "mappool_editors",
+        "subject_set": {
+            "namespace": "Role",
+            "object": "mappooler",
+            "relation": "members"
+        }
+    },
+    {
+        "namespace": "OsuTournament",
+        "object": "*",
+        "relation": "match_editors",
+        "subject_set": {
+            "namespace": "Role",
+            "object": "refree",
+            "relation": "members"
+        }
+    }
+]

config/keto/tsconfig.json

@@ -0,0 +1,3 @@
+{
+    "extends": "@ory/keto-namespace-types/tsconfig.json"
+}

config/kratos/kratos-dev.yml

@@ -3,6 +3,11 @@ version: v0.13.0
 dsn: memory
 dev: true
 
+log:
+  level: debug
+  format: text
+  leak_sensitive_values: true
+
 serve:
   public:
     base_url: http://127.0.0.1:4433/
@@ -122,11 +127,6 @@ selfservice:
 #                    value: OVERWRITE_ME
 #                    in: header
 
-log:
-  level: debug
-  format: text
-  leak_sensitive_values: true
-
 secrets:
   cookie:
     - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE