Add an 'from all' modifier for relations

[aaguiarz]

In some cases, you want to make sure that user has a relation to every instance of another relation.

For example, Assume you have a recording of a meeting and an employee shall be able to view this resource, if he/she was a participant of the meeting or is the boss of all those employees.

type employee
  relations
    define boss: [employee]
 
type recording_of_meeting
  relations
    define participant_of_meeting: [employee]
    define can_access: participant_of_meeting or boss from participant_of_meeting

It would be useful to be able to define the relation as:

type employee
  relations
    define boss: [employee]
 
type recording_of_meeting
  relations
    define participant_of_meeting: [employee]
    define can_access: participant_of_meeting or boss from all participant_of_meeting

In that case we'll check if the employee is the boss of all participants.

https://github.com/orgs/openfga/discussions/400
openfga/openfga#2156

[wbcustc]

We are blocked by this and have to change to use spiceDB because of the lack of from all support.
Really appreciate if we can get this feature supported soon.

[geoffroybraun]

Hi team,

following up this topic as we requested it, is there any update on it? Any chance to see it in a preview version of OpenFga ?

Thanks!

[jigish]

Just throwing in that we also would love this feature. Any update on when it is planned to be implemented?

[aaguiarz]

We don't have it scheduled it yet.

[jigish]

hey @aaguiarz any idea when this will be prioritized? we're considering switching to SpiceDB as not having from all significantly increases complexity for some of our permissions.

[aaguiarz]

Hi @jigish

We don't plan to work on this in the next 12 month. Can you elaborate on the use case?

[jigish]

Hey @aaguiarz -- we have a few different use cases in our model. I can give you an example schema that sums up our use case.

here is what I'd like to do:

model
  schema 1.1

type role
  relations:
    define assignee: [user]

type user
  relations
    define can_view_report: [role#assignee]

type user_report
  relations
    define owner: [user]
    define reportee: [user]

    define can_view: [role#assignee] or owner or can_view_report from all reportee

but right now i just do:

model
  schema 1.1

type role
  relations:
    define assignee: [user]

type user
  relations
    define can_view_report: [role#assignee]

type user_report
  relations
    define owner: [user]
    # TODO[intersection-arrow]: add reportee relations when intersection arrow exists
    # ideally we would have a relation to all reportees here so we can check can_view_report.
    # https://github.com/openfga/roadmap/issues/71

    define can_view: [role#assignee] or owner

basically I have a report type that has relations to a bunch of other types. I want to make sure the user has a permission on all of those relations in order to access the report. I know I can do this with a batch check to check a single user_report, but you can imagine in the list case -- where I have many many reports to filter through -- I don't want to have to batch check every reportee for every report which is what I'm doing right now.

is there a better way to achieve this as of right now?