Playground Graph Relation Bug on Visualizer

[EgeAytin]

Graph relation bug on Permify Playground Visualizer, according to the model below the edit relations parent.admin and owner on the Visualizer should be connected with or not and

entity user {}
        
entity organization {

    // organizational roles
    relation admin @user
    relation member @user
    
}

entity repository {

    // represents repositories parent organization
    relation parent @organization
    
    // represents owner of this repository
    relation owner  @user
    
    // permissions
    action edit   = parent.admin or owner
    action delete = owner
    
} 

[luco5826]

It is not just the visualization, also the actual check doesn't work. In the example you provided, if you create

And

The check

can user:1 edit repository:1

Fails, while it should work given the fact that either the organization admin OR the repository owner can edit the repository

[EgeAytin]

Hi @luco5826, we have tried the check "can user:1 edit repository:1" and got success result as shown below.

Could you send the model you're trying with ?

[luco5826]

How can I send you a reproducible example? The Authorization Model is the same as your screenshot (e.g., the default one when landing on the playground

The tuples are

organization:1#admin@user:1
repository:1#parent@organization:1

Tell me how can I be of more help!

[EgeAytin]

Second relation tuple - repository:1#parent@organization?1 - is wrong formatted and its causing the false negative result. It should be: repository:1#parent@organization?1...

The “...” used when subject type is different from user entity. #… represents a relation that does not affect the semantics of the tuple.

Actually we covered it on our docs but we'll look for solutions to prevent the creation of malformed tuples on playground.

Thanks for caching the problem 🙏

[luco5826]

Thanks for pointing that out. My fault for not reading the docs carefully.

As a side note, even after reading the link you mentioned, it is still a little bit hard to grasp on "why" is this suffix needed. What does "does not affect the semantics of the tuple" means? Isn't the subjectType enough to detect that the user is not the subject ?

Sorry for these questions but I'm trying to better understand how this software could be used in our use-case as it looks really promising!

[EgeAytin]

To be honest, we can detect the type of the subject with different ways and not use the "..." suffix as you mentioned. But we want to be faithful to the Google Zanzibar paper and leave that with the suffix. Here is some example relation tuples from the Google Zanzibar paper:

Apart from this, no worries for the questions we'd love to hear from you. So please feel free to ask any questions related Permify or authorization, join our discord to discuss, or schedule a call anytime you're available :)

[luco5826]

Thank you very much. You've been very helpful and I really look forward to integrating permify in my projects, thanks!