Avoid duplicate everyone check #1327
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kian99
force-pushed
the
cloud-default-follow-up
branch
from
2bfa86e to
7cb33ed
Compare
alesstimec
previously approved these changes
Aug 27, 2024
internal/jimm/utils.go
Outdated
| ) | ||
|
|
||
| /** | ||
| * Authorisation utilities | ||
| **/ | ||
|
|
||
| // EveryoneUser is a convenience method to retrieve the "everyone" user |
There was a problem hiding this comment.
nitpick: EveryoneIdentity?
There was a problem hiding this comment.
Bit torn on this, I think EveryoneUser conveys a better understanding when you read it.
ale8k
previously approved these changes
Aug 27, 2024
ale8k
reviewed
Aug 27, 2024
kian99
force-pushed
the
cloud-default-follow-up
branch
from
1645376 to
6c6baf3
Compare
SimoneDutto
approved these changes
Aug 28, 2024
kian99
added a commit
to kian99/jimm
that referenced
this pull request
Sep 3, 2024
* avoid duplicate everyone checks * make method not exported
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
I noticed in many places we were checking a user's access to a resource and if they had no access, then checking the "everyone" user's access. This is not necessary because when the "everyone" user is granted access to a resource, OpenFGA transparently handles such cases. I.e. If "everyone" has access to a model, and we check whether Alice has access to that model, although she doesn't have a direct relation to the model, the check will return the "everyone" user's access level.
I also created a utility method on
jimmto return the "everyone" user without requiring duplicated setup.See https://openfga.dev/docs/modeling/public-access for more info.