Transitive permissions , does it really work?

[laxathom]

Hi,

I currently am confused with what the doc says VS what I see from running the provided example and I'm looking for clarification.
So, I've followed the example at https://www.ory.sh/docs/keto/guides/userset-rewrites#transitive-permissions-for-objects-in-the-hierarchy and when I run the check with the latest keto binary I don't have the expected result.

The said user being an owner of the File is denied when I check if he has edit or view right.

Am I missing something here?
thx

[laxathom]

Ok, I think I see now where's the hint here. The permissions rules have been provided separately and only within the ory console (not from the CLI) and that's what confuses me.
I'll double-check this part further.

[laxathom]

Just to close this discussion, I found my way through w/o the Ory console and was able to get a transitive permission hierarchy as expected.

Here's an example of what the relation tuples looks like:

NAMESPACE	OBJECT			RELATION NAME	SUBJECT
Groups          owners                  members         User:seller01
Groups		editors			members		Groups:owners#members						
Groups		viewers			members		Groups:owners#members		
Stores          devices                 edit            Groups:editors#members
Stores          devices                 view            Groups:viewers#members
Stores          devices/phones          edit            Stores:devices#view

This allows me to check with the following

keto check User:seller01 edit Stores devices/phones
Allowed