Command line client for managing authorization models

[bpmoneill]

I believe there is a need to support a CLI to support the following:

• Context switching between local and remote stores
• Reading a schema
• Writing a schema, ideally imported from a DSL file (or other data store)
• Validating a schema against a set of assertions from a file
• Check relationships
• Read relationships, also return all the objects a user has any relationship with. For example:

  auth0-fga read document --subject-filter user:fred
  
  document:1 reader user:fred
  document:1 writer user:fred
  document:2 reader user:fred
  document:3 reader user:fred
  document:4 owner user:fred
  

• Write relationships
• List objects, similar to the current experimental method
• Return all the possible relationships for a given object. This would be useful and possibly more applicable in the API also. Where we would want to assign new permissions to a user via a UI it would be beneficial that all the possible relationships a user could be assigned to a given object could be discoverable. E.g.

  auth0-fga relationship read document
  reader
  writer
  owner
  

  This would prevent the need to hard code known permissions in front end components which becomes brittle as the model evolves.

I believe the above would aid a possible solution to managing schema migrations. Specifically, as a model evolves over time there will be a need to:

• Add/Remove schema definitions
• Add/Remove relationships
• Test changes to a schema
• Debug relationships to understand how a given user has or does not have access to a given resource

With a CLI and API, with the above capabilities, it may be possible to facilitate other teams in an org being able to request changes to a model via a PR and CI pipeline and have those changes tested and verified before applying to individual environments or have user permissions amended via an Admin UI without needing to update and deploy new versions of the code.

[rhamzeh]

Thanks for raising this issue and listing some interesting use-cases @bpmoneill!

A CLI is definitely in our plans, but hearing how you and other folks from the community are looking to using it gives us a lot of interesting use-cases we will aim to cover. Thanks!

And please do add to this any other use-cases you can think of if you remember any. We will be taking them to heart.

[aaguiarz]

We plan to work on this soon openfga/roadmap#17