docs: rewrite multitenant rbac example with OPL#2545
Merged
DavudSafarli merged 3 commits intomasterfrom May 8, 2026
Merged
Conversation
DavudSafarli
requested review from
aeneasr,
piotrmsc,
unatasha8,
vinckr and
zepatrik
as code owners
There was a problem hiding this comment.
Pull request overview
This PR updates the Ory Keto RBAC documentation and associated syntax highlighting to reflect an OPL-based, multi-tenant-friendly modeling approach instead of the older RBAC example.
Changes:
- Rewrites the RBAC guide to demonstrate tenant-scoped RBAC modeling in OPL, including role management flows.
- Extends the
keto-naturalPrism grammar to support dotted permission names (e.g.users.list,reports.view) and the optionalperformkeyword. - Updates Jest Prism tokenization tests and snapshots to cover the new grammar behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| tests/jest/prism/ketoRelationsPermissionsPrism.test.ts | Adds a new declarative test case for dotted permission names in keto-natural. |
| tests/jest/prism/snapshots/ketoRelationsPermissionsPrism.test.ts.snap | Refreshes snapshots to match the updated tokenizer behavior and new test case. |
| src/theme/ketoRelationsPermissionsPrism.js | Updates regexes/tokenization rules to accept dotted relations/permits and perform. |
| docs/keto/guides/rbac.mdx | Replaces the RBAC guide content with an OPL-based, multi-tenant RBAC example and guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe PR extends the keto-natural Prism grammar to recognize additional sentence forms, including "allowed to" and "perform" phrases, with refined lookahead-based placeholder matching and adjusted keyword/permit token ordering. Two new test cases validate these expanded patterns. ChangesGrammar and Test Expansion for "Allowed To" Constructs
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
tests/jest/prism/ketoRelationsPermissionsPrism.test.ts (1)
59-72: ⚡ Quick winAdd a question-form test for
performand dotted actions.
natural-check(lines 106 / 130 / 132 insrc/theme/ketoRelationsPermissionsPrism.js) was updated to accept(?:perform )?and dotted permits, butquestionTestCasesdoesn't exercise either path. Without a snapshot here, regressions in the question grammar'sperform/ dotted-action handling will go undetected.🧪 Suggested additional test cases
const questionTestCases = [ { name: "simple question: is User:Bob allowed to view on Document:X", input: "is User:Bob allowed to view on Document:X", }, { name: "question with 'in': is User:Alice in viewers of Document:X", input: "is User:Alice in viewers of Document:X", }, { name: "question with relation subject: are members of Group:XYZ allowed to view on Document:X", input: "are members of Group:XYZ allowed to view on Document:X", }, + { + name: "question with 'perform' and dotted action: is User:Bob allowed to perform users.list on Document:X", + input: "is User:Bob allowed to perform users.list on Document:X", + }, ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/jest/prism/ketoRelationsPermissionsPrism.test.ts` around lines 59 - 72, The questionTestCases array doesn't include cases exercising the new "perform" optional token and dotted actions; add at least two new test entries to questionTestCases: one with "perform" (e.g., input "is User:Bob allowed to perform view on Document:X") and one using a dotted action/permission (e.g., input "is User:Bob allowed to view.read on Document:X" or similar dotted permit form) so the grammar branch in natural-check (the updated rule accepting (?:perform )? and dotted permits) is exercised by the test suite; update the questionTestCases array by adding objects with descriptive name fields and the specified input strings.src/theme/ketoRelationsPermissionsPrism.js (1)
4-19: 💤 Low valueUpdate the grammar JSDoc to cover the new sentence forms.
The header docblock still only describes the original declarative/question forms. The grammar now also accepts:
<Subject> is allowed to <action> (to|on|of) <Object>(e.g.,User:Bob is allowed to access to Document:X)<Subject> is allowed to perform <action> <Object>- Dotted actions (e.g.,
users.list)Adding a couple of example lines here will keep the file self-documenting and match what the regex on lines 74/106 actually parses.
📝 Proposed doc additions
* Declarative sentences: * - User:Bob is owner of Document:X * - Group:group2 is in members of Group:group1 * - members of Group:Eng are viewers of Document:Xyz * - viewers of Group:Eng are in readers of Document:Xyz * - User:Bob is allowed to read Document:X * - members of Group:Eng is allowed to read Document:X + * - User:Bob is allowed to access to Document:X + * - User:Bob is allowed to perform users.list on Document:X * * Question sentences: * - is User:Bob allowed to view on Document:X * - is User:Alice in viewers of Document:X * - are members of Group:XYZ allowed to view on Document:X + * - is User:Bob allowed to perform users.list on Document:X🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/theme/ketoRelationsPermissionsPrism.js` around lines 4 - 19, Update the top JSDoc in src/theme/ketoRelationsPermissionsPrism.js to document the new sentence patterns parsed by the grammar: add examples for "<Subject> is allowed to <action> (to|on|of) <Object>" (e.g., "User:Bob is allowed to access to Document:X"), "<Subject> is allowed to perform <action> <Object>" (e.g., "Group:admins is allowed to perform users.list Document:Y"), and show dotted actions like "users.list" to reflect what the regexes used in the grammar (the patterns around the action parsing referenced near the action-related regexes) actually accept; include a couple representative example lines in the header so the docblock matches the parser behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/theme/ketoRelationsPermissionsPrism.js`:
- Around line 4-19: Update the top JSDoc in
src/theme/ketoRelationsPermissionsPrism.js to document the new sentence patterns
parsed by the grammar: add examples for "<Subject> is allowed to <action>
(to|on|of) <Object>" (e.g., "User:Bob is allowed to access to Document:X"),
"<Subject> is allowed to perform <action> <Object>" (e.g., "Group:admins is
allowed to perform users.list Document:Y"), and show dotted actions like
"users.list" to reflect what the regexes used in the grammar (the patterns
around the action parsing referenced near the action-related regexes) actually
accept; include a couple representative example lines in the header so the
docblock matches the parser behavior.
In `@tests/jest/prism/ketoRelationsPermissionsPrism.test.ts`:
- Around line 59-72: The questionTestCases array doesn't include cases
exercising the new "perform" optional token and dotted actions; add at least two
new test entries to questionTestCases: one with "perform" (e.g., input "is
User:Bob allowed to perform view on Document:X") and one using a dotted
action/permission (e.g., input "is User:Bob allowed to view.read on Document:X"
or similar dotted permit form) so the grammar branch in natural-check (the
updated rule accepting (?:perform )? and dotted permits) is exercised by the
test suite; update the questionTestCases array by adding objects with
descriptive name fields and the specified input strings.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 795dbdb8-3d6c-4bd6-a333-bf4572b2c48a
⛔ Files ignored due to path filters (2)
docs/keto/guides/rbac.mdxis excluded by!**/*.mdxtests/jest/prism/__snapshots__/ketoRelationsPermissionsPrism.test.ts.snapis excluded by!**/*.snap
📒 Files selected for processing (2)
src/theme/ketoRelationsPermissionsPrism.jstests/jest/prism/ketoRelationsPermissionsPrism.test.ts
DavudSafarli
force-pushed
the
keto-d-update-rbac-example
branch
from
c405eed to
539a7e1
Compare
zepatrik
reviewed
May 6, 2026
Member
zepatrik
left a comment
zepatrik
left a comment
There was a problem hiding this comment.
Very good starting point! Two general improvement ideas:
- I first had concerns because the last section on multi-tenancy is quite important and it wasn't obvious at first. Maybe it needs to be more prominent? Or the examples above should not look like a multi-tenant system as much?
- I think we should consistently use the
Sub is rel of objnotion.
vinckr
requested changes
May 6, 2026
Member
vinckr
left a comment
vinckr
left a comment
There was a problem hiding this comment.
some style fixes:
- Always use Ory Keto, not Keto by itself
- Active voice in headlines, so for example
Create a new organizationinstead ofCreating a new organization - Remove numbering in the headlines so
Create a custom roleinstead of3. Creating a custom role
for some reason I couldn't comment on the individual sections of the text, but I hope this is clear.
stoked to see this merged 🚢
DavudSafarli
force-pushed
the
keto-d-update-rbac-example
branch
from
a008d43 to
6e11c1d
Compare
unatasha8
reviewed
May 8, 2026
Contributor
unatasha8
left a comment
unatasha8
left a comment
There was a problem hiding this comment.
- You need to clarify what OPL stands for and link to it in the docs.
- Clarify what 'organization' means in relation to Workspace/Project/Organization. "When Alice creates a new organization..."
- Role ID guidance buried at the bottom on the article. This guidance rises to the level of a warning and should be shown well before any example of creating a role. Our own examples contradicts our guidance: "Suppose Alice creates a custom role called "Report Editor"."
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the outdated keto RBAC example
Summary by CodeRabbit