snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

contrib/docs-code-samples/expand-api-display-access/00-create-tuples/cli.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+set -euo pipefail
+
+export KETO_WRITE_REMOTE="127.0.0.1:4467"
+
+echo '// ownership
+directories:/photos#owner@maureen
+files:/photos/beach.jpg#owner@maureen
+files:/photos/mountains.jpg#owner@laura
+
+// maureen granted access to /photos to laura
+directories:/photos#access@laura
+
+// the following tuples are defined implicitly through subject set rewrites (not supported yet)
+directories:/photos#access@(directories:/photos#owner)
+files:/photos/beach.jpg#access@(files:/photos/beach.jpg#owner)
+files:/photos/beach.jpg#access@(directories:/photos#access)
+files:/photos/mountains.jpg#access@(files:/photos/mountains.jpg#owner)
+files:/photos/mountains.jpg#access@(directories:/photos#access)' | \
+  keto relation-tuple parse -f - --format json | \
+    keto relation-tuple create -f - --insecure-disable-transport-security >/dev/null \
+    && echo "Successfully created tuples" \
+    || echo "Encountered error"

contrib/docs-code-samples/expand-api-display-access/00-create-tuples/curl.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -euo pipefail
+
+echo '// ownership
+directories:/photos#owner@maureen
+files:/photos/beach.jpg#owner@maureen
+files:/photos/mountains.jpg#owner@laura
+
+// maureen granted access to /photos to laura
+directories:/photos#access@laura
+
+// the following tuples are defined implicitly through subject set rewrites (not supported yet)
+directories:/photos#access@(directories:/photos#owner)
+files:/photos/beach.jpg#access@(files:/photos/beach.jpg#owner)
+files:/photos/beach.jpg#access@(directories:/photos#access)
+files:/photos/mountains.jpg#access@(files:/photos/mountains.jpg#owner)
+files:/photos/mountains.jpg#access@(directories:/photos#access)' | \
+  keto relation-tuple parse -f - --format json | \
+    jq "[ .[] | { relation_tuple: . , action: \"insert\" } ]" -c | \
+      curl -X PATCH --silent --fail \
+        -H 'Content-Type: application/json' \
+        --retry 7 --retry-connrefused \
+        --data @- \
+        http://127.0.0.1:4467/admin/relation-tuples
+
+echo "Successfully created tuples"

contrib/docs-code-samples/expand-api-display-access/00-create-tuples/expected_output.txt

@@ -0,0 +1 @@
+Successfully created tuples

contrib/docs-code-samples/expand-api-display-access/00-create-tuples/index.js

@@ -0,0 +1,92 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+import grpc from "@ory/keto-grpc-client/node_modules/@grpc/grpc-js/build/src/index.js"
+import { relationTuples, write, writeService } from "@ory/keto-grpc-client"
+
+const writeClient = new writeService.WriteServiceClient(
+  "127.0.0.1:4467",
+  grpc.credentials.createInsecure(),
+)
+
+const writeRequest = new write.TransactRelationTuplesRequest()
+
+const insert = (tuple) => {
+  const tupleDelta = new write.RelationTupleDelta()
+  tupleDelta.setAction(write.RelationTupleDelta.Action.ACTION_INSERT)
+  tupleDelta.setRelationTuple(tuple)
+
+  writeRequest.addRelationTupleDeltas(tupleDelta)
+}
+
+const addSimpleTuple = (namespace, object, relation, user) => {
+  const relationTuple = new relationTuples.RelationTuple()
+  relationTuple.setNamespace(namespace)
+  relationTuple.setObject(object)
+  relationTuple.setRelation(relation)
+
+  const sub = new relationTuples.Subject()
+  sub.setId(user)
+  relationTuple.setSubject(sub)
+
+  insert(relationTuple)
+}
+
+// ownership
+addSimpleTuple("directories", "/photos", "owner", "maureen")
+addSimpleTuple("files", "/photos/beach.jpg", "owner", "maureen")
+addSimpleTuple("files", "/photos/mountains.jpg", "owner", "laura")
+// granted access
+addSimpleTuple("directories", "/photos", "access", "laura")
+
+// should be subject set rewrite
+// owners have access
+;[
+  ["files", "/photos/beach.jpg"],
+  ["files", "/photos/mountains.jpg"],
+  ["directories", "/photos"],
+].forEach(([namespace, object]) => {
+  const relationTuple = new relationTuples.RelationTuple()
+  relationTuple.setNamespace(namespace)
+  relationTuple.setObject(object)
+  relationTuple.setRelation("access")
+
+  const subjectSet = new relationTuples.SubjectSet()
+  subjectSet.setNamespace(namespace)
+  subjectSet.setObject(object)
+  subjectSet.setRelation("owner")
+
+  const sub = new relationTuples.Subject()
+  sub.setSet(subjectSet)
+  relationTuple.setSubject(sub)
+
+  insert(relationTuple)
+})
+
+// should be subject set rewrite
+// access on parent means access on child
+;["/photos/beach.jpg", "/photos/mountains.jpg"].forEach((file) => {
+  const relationTuple = new relationTuples.RelationTuple()
+  relationTuple.setNamespace("files")
+  relationTuple.setObject(file)
+  relationTuple.setRelation("access")
+
+  const subjectSet = new relationTuples.SubjectSet()
+  subjectSet.setNamespace("directories")
+  subjectSet.setObject("/photos")
+  subjectSet.setRelation("access")
+
+  const sub = new relationTuples.Subject()
+  sub.setSet(subjectSet)
+  relationTuple.setSubject(sub)
+
+  insert(relationTuple)
+})
+
+writeClient.transactRelationTuples(writeRequest, (error) => {
+  if (error) {
+    console.log("Encountered error", error)
+  } else {
+    console.log("Successfully created tuples")
+  }
+})

contrib/docs-code-samples/expand-api-display-access/00-create-tuples/main.go

@@ -0,0 +1,95 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"context"
+	"fmt"
+
+	rts "github.com/ory/keto/gen/go/ory/keto/relation_tuples/v1alpha2"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func main() {
+	conn, err := grpc.NewClient("127.0.0.1:4467", grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		panic("Encountered error: " + err.Error())
+	}
+
+	client := rts.NewWriteServiceClient(conn)
+
+	//directories:/photos#owner@maureen
+	//files:/photos/beach.jpg#owner@maureen
+	//files:/photos/mountains.jpg#owner@laura
+	//directories:/photos#access@laura
+	//directories:/photos#access@(directories:/photos#owner)
+	//files:/photos/beach.jpg#access@(files:/photos/beach.jpg#owner)
+	//files:/photos/beach.jpg#access@(directories:/photos#access)
+	//files:/photos/mountains.jpg#access@(files:/photos/mountains.jpg#owner)
+	//files:/photos/mountains.jpg#access@(directories:/photos#access)
+
+	tuples := []*rts.RelationTuple{
+		// ownership
+		{
+			Namespace: "directories",
+			Object:    "/photos",
+			Relation:  "owner",
+			Subject:   rts.NewSubjectID("maureen"),
+		},
+		{
+			Namespace: "files",
+			Object:    "/photos/beach.jpg",
+			Relation:  "owner",
+			Subject:   rts.NewSubjectID("maureen"),
+		},
+		{
+			Namespace: "files",
+			Object:    "/photos/mountains.jpg",
+			Relation:  "owner",
+			Subject:   rts.NewSubjectID("laura"),
+		},
+		// granted access
+		{
+			Namespace: "directories",
+			Object:    "/photos",
+			Relation:  "access",
+			Subject:   rts.NewSubjectID("laura"),
+		},
+	}
+	// should be subject set rewrite
+	// owners have access
+	for _, o := range []struct{ n, o string }{
+		{"files", "/photos/beach.jpg"},
+		{"files", "/photos/mountains.jpg"},
+		{"directories", "/photos"},
+	} {
+		tuples = append(tuples, &rts.RelationTuple{
+			Namespace: o.n,
+			Object:    o.o,
+			Relation:  "access",
+			Subject:   rts.NewSubjectSet(o.n, o.o, "owner"),
+		})
+	}
+	// should be subject set rewrite
+	// access on parent means access on child
+	for _, obj := range []string{"/photos/beach.jpg", "/photos/mountains.jpg"} {
+		tuples = append(tuples, &rts.RelationTuple{
+			Namespace: "files",
+			Object:    obj,
+			Relation:  "access",
+			Subject:   rts.NewSubjectSet("directories", "/photos", "access"),
+		})
+	}
+
+	_, err = client.TransactRelationTuples(context.Background(), &rts.TransactRelationTuplesRequest{
+		RelationTupleDeltas: rts.RelationTupleToDeltas(tuples, rts.RelationTupleDelta_ACTION_INSERT),
+	})
+	if err != nil {
+		panic("Encountered error: " + err.Error())
+	}
+
+	fmt.Println("Successfully created tuples")
+}