1

I'm having an issue with authzed schema and relationships. I seem to be misunderstanding how things work.

I've got a scenario where users can be part of a group either by direct inclusion or by indirect location based criteria, location is hierarchical, with three levels -- Country, State/Province, and City.

That is to say, Anyone in Wichita, Topeka, or Dodge City is also in Kansas Anyone in Seattle, Tacoma, or Spokane is in Washington Anyone in Kansas or in Washington is in the United States Similarly, anyone who is in Pune is also in Maharashtra, and anyone in Maharashtra is in India

I've built a schema (https://play.authzed.com/s/cBfN1HhtcoVE) that supports detection of direct inclusions. I have a user_group called wichitans. It includes (naturally) users in the wichita org_unit, as well as user Samuel, who is in Seattle, but will be moving to wichita in the coming months.

I'm using the permission name "is_user_in_ex/implicits" just to understand I have grouping correct. I can see in the Expected_relations that Samuel is in Wichita explicits and Wally is in Wichita implicits which is what I expect, as wally is in the children of wichita.

Now I make a small change to line 22 of the test relationships (https://play.authzed.com/s/zeYxryGzYbaK), so that instead of assigning Wichita to the to implicits, I assign Kansas to implicits. Samual remains in Explicits, Wichita remains in Implicits (because it's a child of Kansas), but Wally is no longer in implicits. I was under the assumption that there would be a recursive evaluation, but that doesn't appear to be the case. Is there a different operator to say "I would like this relationship to be recursive" or do I need to change some schema definitions? I'd like to avoid splitting the org unit into three distinct levels if possible.

Sidney
  • 624
  • 7
  • 20
  • Just as a comment -- I noticed there are no authzed or zanzibar tags. As a new tech tags might need to be made; Perhaps someone with the appropriate rep to create tags could edit them into this question? – Sidney Apr 20 '23 at 15:51

1 Answers1

0

While exploring I found if I create a duplicate permission "is_user_in_implicits" on the org unit and selected the children of an org unit + the new "is_user_in_implicits" permission of the org unit's childern it appears that recursive relationships work as expected even up to the level of the united states (at this point it also picks up seattle, washington and Samuel, but that's how I would expect it to work". Is this the correct approach for getting a recursive relationship?

https://play.authzed.com/s/ZcjmA_7_1Xg3/schema

Sidney
  • 624
  • 7
  • 20
  • This appears to work for me but I don't know if it's the actual proper way to do what I want. I'm leaving it since this question is edge case and may not get a proper answer. – Sidney Apr 20 '23 at 16:14