Debug authorization_model_resolution_too_complex error

[Akos-T]

Hi All,

I'm new with OpenFGA, just started to get to know each other 😄 , so please bear with me.

The problem:
I fired up OpenFGA locally, created an IMO simple model and a few tuples, most of my assertions work as expected, but I have one that throws an error saying:

{
  "code": "authorization_model_resolution_too_complex",
  "message":"Authorization Model resolution required too many rewrite rules to be resolved. Check your authorization model for infinite recursion or too much nesting"
}

Question:
I was wondering how could I debug this issue? Is there a way to see the resolution steps/plan to see where it might go wrong? I saw that there is tracing that can be enabled, but it needs to setup basically otel, prometheus and who knows what, so it's pretty heavy. Would tracing help? Isn't there a more lightweight debugging option?

Thank you for your help!

All the best,
Akos

[rhamzeh]

Hi @Akos-T - Can I ask you to share your:

• Model
• Tuples
• Check request
  So we can help you debug or understand why this is happening and how to work around it

[Akos-T]

Hi @rhamzeh ,

Well it wasn't exactly what I wanted, so I changed my model anyways and it's working now. I was just wondering what tools I have to find out why it throws a given error? As mentioned in my initial message, I would assume the tracing would help, but it's a bit cumbersome to setup as it has a lot of dependency (otel, prometheus, grafana?)... A debug flag/option that just prints verbose messages to the console to find the source of the issue would be nice.

Nonetheless, here's an example of what I had issue with:

Model:

model
  schema 1.1
type user
type department
  relations
    define admin: [user] or sysadmin or admin from parent
    define child: [department]
    define member: [user] or member from child
    define parent: [department]
    define sysadmin: [user] or sysadmin from parent or sysadmin from child

Tuples:

"tuples":[
  {"object":"department:top","relation":"child","user":"department:middle"},
  {"object":"department:middle","relation":"child","user":"department:bottom1"},
  {"object":"department:middle","relation":"child","user":"department:bottom2"},
  {"object":"department:middle","relation":"child","user":"department:bottom3"},
  {"object":"department:middle","relation":"member","user":"user:Alan"},
  {"object":"department:middle","relation":"member","user":"user:Peter"},
  {"object":"department:middle","relation":"admin","user":"user:Alan"},
  {"object":"department:middle","relation":"member","user":"user:David"},
  {"object":"department:middle","relation":"admin","user":"user:David"},
  {"object":"department:middle","relation":"sysadmin","user":"user:Alan"},
  {"object":"department:middle","relation":"parent","user":"organization:top"},
  {"object":"department:bottom2","relation":"parent","user":"department:middle"},
  {"object":"department:bottom1","relation":"parent","user":"department:middle"},
  {"object":"department:bottom3","relation":"parent","user":"department:middle"}
],

Assertions:

"assertions":[
  {"tuple_key":{"user":"user:David","relation":"admin","object":"department:top"},"expectation":true},
  {"tuple_key":{"user":"user:David","relation":"admin","object":"department:bottom3"},"expectation":true},
  {"tuple_key":{"user":"user:Alan","relation":"sysadmin","object":"department:bottom3"},"expectation":true},
  {"tuple_key":{"user":"user:Alan","relation":"sysadmin","object":"department:top"},"expectation":true},
  {"tuple_key":{"user":"user:Alan","relation":"sysadmin","object":"department:middle"},"expectation":true},
  {"tuple_key":{"user":"user:David","relation":"admin","object":"department:middle"},"expectation":true}
]

First assertion fails with the error. If I change the admin relation like:

define admin: [user] or sysadmin or admin from parent or admin from child

Then it works, though the tree looks overly complicated...