openfga icon indicating copy to clipboard operation
openfga copied to clipboard

`ListUsers` intersection with wildcards

Open willvedd opened this issue 1 year ago • 0 comments

Description

The initial implementation of intersection (#1467) in ListUsers missed an important case during testing, public typed wildcard tuples. Wildcards require special consideration when it comes to intersection.

The initial implementation of intersection relied on a counter per user object, and if that count equaled the number of and clauses, then the user would be returned on the main results channel. However the presence of wildcards in a clause needs to be considered; you do not want to double-count users as shown in this example below:

model
  schema 1.1
type user
type document
  relations
    define public_1: [user:*,user]
    define public_2: [user:*,user]
    define is_public: public_1 and public_2
"document:1", "public_1", "user:maria"
"document:1", "public_1", "user:*",
ListUsers("document:1", user_filter: ["user"], relation: "is_public") // should return empty list

The solution provided in this PR is to individually evaluate a separate channel per clause to be able to consider the wildcard case.

References

  • Related PR: #1467
  • Related comment: https://github.com/openfga/openfga/pull/1467#discussion_r1533089380
  • Parent PR: #1428

Review Checklist

  • [x] I have clicked on "allow edits by maintainers".
  • [x] I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • [x] The correct base branch is being used, if not main
  • [x] I have added tests to validate that the change in functionality is working as expected

willvedd avatar Mar 22 '24 19:03 willvedd