Support for reverse queries for

[fsedano]

Summary

Is there a way to do reverse lookup of users and subjects?

I'm evaluating OpenFGA against SpiceDB. One very nice feature in SpiceDB is it supports both LookupResources and LookupSubjects. I only saw 'list-objects' API in OpenFGA (that would be equivalent of 'LookupResources) but I could not find the opposite.

I.e. I want both 'which users have READER relation with DOC1' and 'Which docs can USER1 access as READER'

[rhamzeh]

Hi @fsedano! Thanks for asking.

Right now we do not have it yet, however it is an upcoming feature in our roadmap as ListUsers

Until we have that endpoint, you can get the same result by recursively calling Expand to re-build the graph permissions on your end and get the list of users with access.

You can see that being done in the Playground for example when you query something like: who is related to repo:openfga/openfga as admin? in the sample GitHub Store

Canonical did the same by wrapping Expand: https://github.com/canonical/ofga/blob/main/client.go#L490-L522

[github-actions]

It appears this issue has been stale for at least 14 days 🗓️. If no action is taken the maintainer team may consider closing the issue. Please reach out if you need feedback or follow up actions from the maintainer team.

[aaguiarz]

This is in our roadmap already

[fsedano]

@aaguiarz We discussed about this on Kubecon today, from what I understood is already shipping? Your response above suggests it's on roadmap.

[aaguiarz]

Hi @fsedano , what we shipped is ListObjects, we are currently working on ListUsers, the RFC is here https://github.com/openfga/rfcs/blob/main/20231214-listUsers-api.md