Repository navigation
Add contextual tuples and context to assertions store import and export #452
Description
Describe the problem you'd like to have solved
We added support to the API for Assertions to support context and contextual tuples, given that these are supported in the store file format we should add support for them in the fga store import and fga store export commands.
Describe the ideal solution
Store Import
When importing the assertions in a store file, we should add the contents of context and tuples/tuple_file in a test definition to every
So the following test definition:
Test definition
tests:
- name: "folder-document-access"
tuples:
- user: folder:5
relation: parent
object: folder:product-2021
check: # Each check test is made of: a user, an object and the expected result for one or more relations
- user: user:anne
object: folder:product-2021
context:
some: "value"
assertions:
can_view: true
can_edit: true
Should produce the following assertions, note that the tuples and context are present in both assertions
Assertions written
{
"tuple_key": {
"object": "user:anne",
"relation": "can_view",
"user": "folder:product-2021"
},
"expectation": true,
"contextual_tuples": [
{
"object": "folder:5",
"relation": "parent",
"user": "folder:product-2021"
}
],
"context": {
"some": "value"
}
}{
"tuple_key": {
"object": "user:anne",
"relation": "can_edit",
"user": "folder:product-2021"
},
"expectation": true,
"contextual_tuples": [
{
"object": "folder:5",
"relation": "parent",
"user": "folder:product-2021"
}
],
"context": {
"some": "value"
}
}Store Export
Warning
This isn't as clear and needs more definition on the behaviour
When exporting a store, we should each ModelTestCheck should maintain its own context but the contextual_tuples should most likely be merged together into the tuples on the top level ModelTest.
/assertions response
{
"authorization_model_id": "01G5JAVJ41T49E9TT3SKVS7X1J",
"assertions": [
{
"tuple_key": {
"object": "user:anne",
"relation": "can_view",
"user": "folder:product-2021"
},
"expectation": true,
"contextual_tuples": [
{
"object": "folder:5",
"relation": "parent",
"user": "folder:product-2021"
}
],
"context": {
"some": "value"
}
},
{
"tuple_key": {
"object": "user:anne",
"relation": "can_edit",
"user": "folder:product-2021"
},
"expectation": true,
"contextual_tuples": [
{
"object": "folder:5",
"relation": "parent",
"user": "folder:product-2021"
}
],
"context": {
"some": "value"
}
}
]
}Test definition
tests:
- name: "folder-document-access"
tuples:
- user: folder:5
relation: parent
object: folder:product-2021
check: # Each check test is made of: a user, an object and the expected result for one or more relations
- user: user:anne
object: folder:product-2021
context:
some: "value"
assertions:
can_view: true
can_edit: true
Should produce the following assertions, note that the tuples and context are present in both assertions
Additional context
This needs this PR in go-sdk to be merged and ship before it can be done.
The playground UI currently does not support adding either of these or sending either of them as part of the Check call if they exist
Activity
aaguiarz commentedon Jun 20, 2025
@ewanharris
If we have them in the assertions, why wouldn't we write them at the test level instead of at the top level?