chore!: remove excluded users from ListUsers response (#64)

## Description Removes `excluded_users` from the response of all SDKs as it was removed from OpenFGA with openfga/api#171. This feature was originally a well-intentioned way to communicate any negations that may exist on public-typed wildcard (e.g. `user:*`) as a means of being abundantly clear about what a `user:*` result entails. However, as we discover more possible situations where excluded users could arise, we realize that we were making a premature decision about the API. We fully intend to re-add excluded_users at some point in the future but may or may not be a flattened list as previously implemented. **Please note:** - This is technically a breaking but is acceptable provided that the ListUsers API is still experimental ## References - Related PR in openfga/sdk-generator: openfga/sdk-generator#377 - Related PR in openfga/api: openfga/api#171 ## Review Checklist - [x] I have clicked on ["allow edits by maintainers"](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork). - [ ] I have added documentation for new/changed functionality in this PR or in a PR to [openfga.dev](https://github.com/openfga/openfga.dev) [Provide a link to any relevant PRs in the references section above] - [x] The correct base branch is being used, if not `main` - [ ] I have added tests to validate that the change in functionality is working as expected
openfga · Jun 14, 2024 · 8ffebc0 · 8ffebc0
2 parents c77aa9d + 8da4653
commit 8ffebc0
Show file tree

Hide file tree

Showing 10 changed files with 3 additions and 191 deletions.
diff --git a/.openapi-generator/FILES b/.openapi-generator/FILES
@@ -52,7 +52,6 @@ docs/Node.md
 docs/Nodes.md
 docs/NotFoundErrorCode.md
 docs/NullValue.md
-docs/ObjectOrUserset.md
 docs/ObjectRelation.md
 docs/OpenFgaApi.md
 docs/PathUnknownErrorMessageResponse.md
@@ -201,7 +200,6 @@ src/OpenFga.Sdk/Model/Node.cs
 src/OpenFga.Sdk/Model/Nodes.cs
 src/OpenFga.Sdk/Model/NotFoundErrorCode.cs
 src/OpenFga.Sdk/Model/NullValue.cs
-src/OpenFga.Sdk/Model/ObjectOrUserset.cs
 src/OpenFga.Sdk/Model/ObjectRelation.cs
 src/OpenFga.Sdk/Model/PathUnknownErrorMessageResponse.cs
 src/OpenFga.Sdk/Model/ReadAssertionsResponse.cs

diff --git a/README.md b/README.md
@@ -746,7 +746,6 @@ const response = await fgaClient.listUsers({
 }, options);
 
 // response.users = [{object: {type: "user", id: "81684243-9356-4421-8fbf-a4f8d36aa31b"}}, {userset: { type: "user" }}, ...]
-// response.excluded_users = [ {object: {type: "user", id: "4a455e27-d15a-4434-82e0-136f9c2aa4cf"}}, ... ]
 ```
 
 #### Assertions
@@ -882,7 +881,6 @@ namespace Example {
  - [Model.Nodes](docs/Nodes.md)
  - [Model.NotFoundErrorCode](docs/NotFoundErrorCode.md)
  - [Model.NullValue](docs/NullValue.md)
- - [Model.ObjectOrUserset](docs/ObjectOrUserset.md)
  - [Model.ObjectRelation](docs/ObjectRelation.md)
  - [Model.PathUnknownErrorMessageResponse](docs/PathUnknownErrorMessageResponse.md)
  - [Model.ReadAssertionsResponse](docs/ReadAssertionsResponse.md)

diff --git a/docs/ListUsersResponse.md b/docs/ListUsersResponse.md
@@ -5,7 +5,6 @@
 Name | Type | Description | Notes
 ------------ | ------------- | ------------- | -------------
 **Users** | [**List&lt;User&gt;**](User.md) |  | 
-**ExcludedUsers** | [**List&lt;ObjectOrUserset&gt;**](ObjectOrUserset.md) |  | 
 
 [[Back to Model list]](../README.md#models) [[Back to API list]](../README.md#api-endpoints) [[Back to README]](../README.md)
 
diff --git a/docs/ObjectOrUserset.md b/docs/ObjectOrUserset.md
diff --git a/docs/OpenFgaApi.md b/docs/OpenFgaApi.md
@@ -581,7 +581,7 @@ Name | Type | Description  | Notes
 
 [EXPERIMENTAL] List the users matching the provided filter who have a certain relation to a particular type.
 
-The ListUsers API returns a list of all the users of a specific type that have a relation to a given object.  This API is available in an experimental capacity and can be enabled with the `- -experimentals enable-list-users` flag.  To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). An `authorization_model_id` may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify `contextual_tuples` that will be treated as regular tuples. Each of these tuples may have an associated `condition`. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the \"users\" field of the response. These results may include specific objects, usersets  or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In certain cases of negation via the `but not` operator, some results are marked as excluded from the main set of results. These exclusions  are returned in the `excluded_users` property and should be handled appropriately at the point of implementation.The number of users in the response array will be limited by the execution timeout specified in the flag OPENFGA_LIST_USERS_DEADLINE and by the upper bound specified in the flag OPENFGA_LIST_USERS_MAX_RESULTS, whichever is hit first. The returned users will not be sorted, and therefore two identical calls may yield different sets of users.
+The ListUsers API returns a list of all the users of a specific type that have a relation to a given object.  This API is available in an experimental capacity and can be enabled with the `- -experimentals enable-list-users` flag.  To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as `document:2021-budget#viewer@document:2021-budget#viewer`; the set of users who are viewers of `document:2021-budget` are the set of users who are the viewers of `document:2021-budget`). An `authorization_model_id` may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify `contextual_tuples` that will be treated as regular tuples. Each of these tuples may have an associated `condition`. You may also provide a `context` object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the \"users\" field of the response. These results may include specific objects, usersets  or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In cases where a type-bound public acces result is returned (e.g. `user:*`), it cannot be inferred that all subjects of that type have a relation to the object; it is possible that negations exist and checks should still be queried on individual subjects to ensure access to that document.The number of users in the response array will be limited by the execution timeout specified in the flag OPENFGA_LIST_USERS_DEADLINE and by the upper bound specified in the flag OPENFGA_LIST_USERS_MAX_RESULTS, whichever is hit first. The returned users will not be sorted, and therefore two identical calls may yield different sets of users.
 
 ### Example
 ```csharp

diff --git a/src/OpenFga.Sdk.Test/Api/OpenFgaApiTests.cs b/src/OpenFga.Sdk.Test/Api/OpenFgaApiTests.cs
@@ -1514,7 +1514,6 @@ public class OpenFgaApiTests : IDisposable {
                     }
 
                 },
-                ExcludedUsers = new List<ObjectOrUserset>()
             };
             mockHandler.Protected()
                 .Setup<Task<HttpResponseMessage>>(

diff --git a/src/OpenFga.Sdk.Test/Client/OpenFgaClientTests.cs b/src/OpenFga.Sdk.Test/Client/OpenFgaClientTests.cs
@@ -1464,7 +1464,6 @@ public class OpenFgaClientTests {
                 }
 
             },
-            ExcludedUsers = new List<ObjectOrUserset>()
         };
         mockHandler.Protected()
             .Setup<Task<HttpResponseMessage>>(

diff --git a/src/OpenFga.Sdk/Api/OpenFgaApi.cs b/src/OpenFga.Sdk/Api/OpenFgaApi.cs
@@ -248,7 +248,7 @@ public class OpenFgaApi : IDisposable {
     }
 
     /// <summary>
-    /// [EXPERIMENTAL] List the users matching the provided filter who have a certain relation to a particular type. The ListUsers API returns a list of all the users of a specific type that have a relation to a given object.  This API is available in an experimental capacity and can be enabled with the &#x60;- -experimentals enable-list-users&#x60; flag.  To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as &#x60;document:2021-budget#viewer@document:2021-budget#viewer&#x60;; the set of users who are viewers of &#x60;document:2021-budget&#x60; are the set of users who are the viewers of &#x60;document:2021-budget&#x60;). An &#x60;authorization_model_id&#x60; may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify &#x60;contextual_tuples&#x60; that will be treated as regular tuples. Each of these tuples may have an associated &#x60;condition&#x60;. You may also provide a &#x60;context&#x60; object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the \&quot;users\&quot; field of the response. These results may include specific objects, usersets  or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In certain cases of negation via the &#x60;but not&#x60; operator, some results are marked as excluded from the main set of results. These exclusions  are returned in the &#x60;excluded_users&#x60; property and should be handled appropriately at the point of implementation.The number of users in the response array will be limited by the execution timeout specified in the flag OPENFGA_LIST_USERS_DEADLINE and by the upper bound specified in the flag OPENFGA_LIST_USERS_MAX_RESULTS, whichever is hit first. The returned users will not be sorted, and therefore two identical calls may yield different sets of users.
+    /// [EXPERIMENTAL] List the users matching the provided filter who have a certain relation to a particular type. The ListUsers API returns a list of all the users of a specific type that have a relation to a given object.  This API is available in an experimental capacity and can be enabled with the &#x60;- -experimentals enable-list-users&#x60; flag.  To arrive at a result, the API uses: an authorization model, explicit tuples written through the Write API, contextual tuples present in the request, and implicit tuples that exist by virtue of applying set theory (such as &#x60;document:2021-budget#viewer@document:2021-budget#viewer&#x60;; the set of users who are viewers of &#x60;document:2021-budget&#x60; are the set of users who are the viewers of &#x60;document:2021-budget&#x60;). An &#x60;authorization_model_id&#x60; may be specified in the body. If it is not specified, the latest authorization model ID will be used. It is strongly recommended to specify authorization model id for better performance. You may also specify &#x60;contextual_tuples&#x60; that will be treated as regular tuples. Each of these tuples may have an associated &#x60;condition&#x60;. You may also provide a &#x60;context&#x60; object that will be used to evaluate the conditioned tuples in the system. It is strongly recommended to provide a value for all the input parameters of all the conditions, to ensure that all tuples be evaluated correctly. The response will contain the related users in an array in the \&quot;users\&quot; field of the response. These results may include specific objects, usersets  or type-bound public access. Each of these types of results is encoded in its own type and not represented as a string.In cases where a type-bound public acces result is returned (e.g. &#x60;user:*&#x60;), it cannot be inferred that all subjects of that type have a relation to the object; it is possible that negations exist and checks should still be queried on individual subjects to ensure access to that document.The number of users in the response array will be limited by the execution timeout specified in the flag OPENFGA_LIST_USERS_DEADLINE and by the upper bound specified in the flag OPENFGA_LIST_USERS_MAX_RESULTS, whichever is hit first. The returned users will not be sorted, and therefore two identical calls may yield different sets of users.
     /// </summary>
     /// <exception cref="ApiException">Thrown when fails to make API call</exception>
     /// <param name="storeId"></param>

diff --git a/src/OpenFga.Sdk/Model/ListUsersResponse.cs b/src/OpenFga.Sdk/Model/ListUsersResponse.cs
@@ -34,18 +34,12 @@ public partial class ListUsersResponse : IEquatable<ListUsersResponse>, IValidat
         /// Initializes a new instance of the <see cref="ListUsersResponse" /> class.
         /// </summary>
         /// <param name="users">users (required).</param>
-        /// <param name="excludedUsers">excludedUsers (required).</param>
-        public ListUsersResponse(List<User> users = default(List<User>), List<ObjectOrUserset> excludedUsers = default(List<ObjectOrUserset>)) {
+        public ListUsersResponse(List<User> users = default(List<User>)) {
             // to ensure "users" is required (not null)
             if (users == null) {
                 throw new ArgumentNullException("users is a required property for ListUsersResponse and cannot be null");
             }
             this.Users = users;
-            // to ensure "excludedUsers" is required (not null)
-            if (excludedUsers == null) {
-                throw new ArgumentNullException("excludedUsers is a required property for ListUsersResponse and cannot be null");
-            }
-            this.ExcludedUsers = excludedUsers;
             this.AdditionalProperties = new Dictionary<string, object>();
         }
 
@@ -57,14 +51,6 @@ public partial class ListUsersResponse : IEquatable<ListUsersResponse>, IValidat
         [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
         public List<User> Users { get; set; }
 
-        /// <summary>
-        /// Gets or Sets ExcludedUsers
-        /// </summary>
-        [DataMember(Name = "excluded_users", IsRequired = true, EmitDefaultValue = false)]
-        [JsonPropertyName("excluded_users")]
-        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
-        public List<ObjectOrUserset> ExcludedUsers { get; set; }
-
         /// <summary>
         /// Gets or Sets additional properties
         /// </summary>
@@ -112,12 +98,6 @@ public partial class ListUsersResponse : IEquatable<ListUsersResponse>, IValidat
                     this.Users != null &&
                     input.Users != null &&
                     this.Users.SequenceEqual(input.Users)
-                ) &&
-                (
-                    this.ExcludedUsers == input.ExcludedUsers ||
-                    this.ExcludedUsers != null &&
-                    input.ExcludedUsers != null &&
-                    this.ExcludedUsers.SequenceEqual(input.ExcludedUsers)
                 )
                 && (this.AdditionalProperties.Count == input.AdditionalProperties.Count && !this.AdditionalProperties.Except(input.AdditionalProperties).Any());
         }
@@ -133,9 +113,6 @@ public partial class ListUsersResponse : IEquatable<ListUsersResponse>, IValidat
                 if (this.Users != null) {
                     hashCode = (hashCode * 9923) + this.Users.GetHashCode();
                 }
-                if (this.ExcludedUsers != null) {
-                    hashCode = (hashCode * 9923) + this.ExcludedUsers.GetHashCode();
-                }
                 if (this.AdditionalProperties != null) {
                     hashCode = (hashCode * 9923) + this.AdditionalProperties.GetHashCode();
                 }