snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

cmd/check/root.go

@@ -0,0 +1,92 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package check
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/ory/x/cmdx"
+
+	"github.com/ory/keto/cmd/client"
+	"github.com/ory/keto/cmd/helpers"
+	rts "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+)
+
+type checkOutput struct {
+	Allowed bool `json:"allowed"`
+}
+
+func (o *checkOutput) String() string {
+	if o.Allowed {
+		return "Allowed\n"
+	}
+	return "Denied\n"
+}
+
+const FlagMaxDepth = "max-depth"
+
+func NewCheckCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "check <subject_namespace>:<subject_id> <relation> <object_namespace>:<object_id>",
+		Short: "Check whether a subject has a relation on an object",
+		Long: "Check whether a subject has a relation on an object.\n\n" +
+			"Example:\n" +
+			"	keto check User:Alice view Doc:readme\n\n" +
+			"Legacy format 'keto check <subject_namespace>:<subject_id> <relation> <object_namespace> <object_id>' is deprecated.",
+		Args: cobra.RangeArgs(3, 4),
+		RunE: check,
+	}
+
+	client.RegisterRemoteURLFlags(cmd.Flags())
+	cmdx.RegisterFormatFlags(cmd.Flags())
+	cmd.Flags().Int32P(FlagMaxDepth, "d", 0, "Maximum depth of the search tree. If the value is less than 1 or greater than the global max-depth then the global max-depth will be used instead.")
+
+	return cmd
+}
+
+func check(cmd *cobra.Command, args []string) error {
+	namespace, object, err := helpers.ParseNamespaceObject(cmd, args[2:])
+	if err != nil {
+		return err
+	}
+
+	sub, err := helpers.ParseSubject(args[0])
+	if err != nil {
+		return fmt.Errorf("could not parse subject %q: %w", args[0], err)
+	}
+	conn, err := client.GetReadConn(cmd)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = conn.Close() }()
+
+	maxDepth, err := cmd.Flags().GetInt32(FlagMaxDepth)
+	if err != nil {
+		return err
+	}
+
+	cl := rts.NewCheckServiceClient(conn)
+	resp, err := cl.Check(cmd.Context(), &rts.CheckRequest{
+		Tuple: &rts.RelationTuple{
+			Namespace: namespace,
+			Object:    object,
+			Relation:  args[1],
+			Subject:   sub,
+		},
+		MaxDepth: maxDepth,
+	})
+	if err != nil {
+		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "Could not make request: %s\n", err)
+		return cmdx.FailSilently(cmd)
+	}
+
+	cmdx.PrintJSONAble(cmd, &checkOutput{Allowed: resp.Allowed})
+	return nil
+}
+
+func RegisterCommandsRecursive(parent *cobra.Command) {
+	parent.AddCommand(NewCheckCmd())
+}

cmd/check/root_test.go

@@ -0,0 +1,92 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package check
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/keto/cmd/client/clienttest"
+	"github.com/ory/keto/cmd/relationtuple"
+	"github.com/ory/keto/internal/namespace"
+)
+
+func TestCheckCommand(t *testing.T) {
+	nspace := &namespace.Namespace{Name: t.Name()}
+	nspaceUser := &namespace.Namespace{Name: "User"}
+
+	newCmd := func() *cobra.Command {
+		cmd := &cobra.Command{
+			Use: "keto",
+		}
+		RegisterCommandsRecursive(cmd)
+		relationtuple.RegisterCommandsRecursive(cmd)
+		return cmd
+	}
+
+	ts := clienttest.NewTestServer(t, []*namespace.Namespace{nspace, nspaceUser}, newCmd)
+
+	tuple1 := clienttest.RandomTupleWithSubjectID(nspace.Name)
+	tuple2 := clienttest.RandomTupleWithSubjectSet(nspace.Name, nspaceUser.Name)
+	ts.Cmd.ExecNoErr(t, "relation-tuple", "create", tuple2.SubjectSet.String(), tuple2.Relation, tuple2.Namespace+":"+tuple2.Object)
+	ts.Cmd.ExecNoErr(t, "relation-tuple", "create", *tuple1.SubjectID, tuple1.Relation, tuple1.Namespace+":"+tuple1.Object)
+
+	t.Run("case=SubjectSet", func(t *testing.T) {
+		subject := tuple2.SubjectSet.String()
+		rel := tuple2.Relation
+		nsObj := tuple2.Namespace + ":" + tuple2.Object
+
+		noPermSubject := tuple2.SubjectSet.Namespace + ":no-perm-subject"
+
+		t.Run("case=allowed when tuple exists", func(t *testing.T) {
+			stdOut := ts.Cmd.ExecNoErr(t, "check", subject, rel, nsObj)
+			require.Equal(t, "Allowed\n", stdOut)
+		})
+
+		t.Run("case=denied for unrelated subject", func(t *testing.T) {
+			stdOut := ts.Cmd.ExecNoErr(t, "check", noPermSubject, rel, nsObj)
+			require.Equal(t, "Denied\n", stdOut)
+		})
+
+		t.Run("case=4-arg format still works with deprecation warning", func(t *testing.T) {
+			stdOut, stdErr, err := ts.Cmd.Exec(nil, "check", subject, rel, tuple2.Namespace, tuple2.Object)
+			require.NoError(t, err)
+			require.Equal(t, "Allowed\n", stdOut)
+			require.Contains(t, stdErr, "deprecated")
+		})
+
+		t.Run("case=errors on invalid namespace:object format", func(t *testing.T) {
+			_, stdErr, err := ts.Cmd.Exec(nil, "check", subject, rel, "no-colon-here")
+			require.Error(t, err)
+			require.Contains(t, stdErr, "expected <object_namespace>:<object_id> format")
+		})
+	})
+
+	t.Run("case=SubjectID", func(t *testing.T) {
+		subject := *tuple1.SubjectID
+		rel := tuple1.Relation
+		nsObj := tuple1.Namespace + ":" + tuple1.Object
+
+		noPermSubject := "no-perm-subject"
+
+		t.Run("case=SubjectID, allowed when tuple exists", func(t *testing.T) {
+			stdOut := ts.Cmd.ExecNoErr(t, "check", subject, rel, nsObj)
+			require.Equal(t, "Allowed\n", stdOut)
+		})
+
+		t.Run("case=denied for unrelated object", func(t *testing.T) {
+			stdOut := ts.Cmd.ExecNoErr(t, "check", noPermSubject, rel, nspace.Name+":nope")
+			require.Equal(t, "Denied\n", stdOut)
+		})
+
+		t.Run("case=4-arg format still works with deprecation warning", func(t *testing.T) {
+			stdOut, stdErr, err := ts.Cmd.Exec(nil, "check", subject, rel, tuple1.Namespace, tuple1.Object)
+			require.NoError(t, err)
+			require.Equal(t, "Allowed\n", stdOut)
+			require.Contains(t, stdErr, "deprecated")
+		})
+	})
+}