snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

internal/check/step/helpers.go

@@ -0,0 +1,78 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package step
+
+import (
+	"context"
+
+	"github.com/ory/keto/internal/check"
+	"github.com/ory/keto/internal/namespace"
+	"github.com/ory/keto/internal/namespace/ast"
+	"github.com/ory/keto/internal/relationtuple"
+)
+
+// astRelationFor looks up the AST Relation for the given tuple's namespace and
+// relation. Returns nil (not an error) when no namespace config is present.
+func astRelationFor(ctx context.Context, nm namespace.Manager, r *relationTuple) (*ast.Relation, error) {
+	return namespace.ASTRelationFor(ctx, nm, r.Namespace, r.Relation)
+}
+
+// maxDepthReached logs a debug message and returns MembershipUnknown.
+// Call it when RestDepth is exhausted and the check cannot be expanded further.
+func maxDepthReached(ex check.Executor, req check.CheckRequest) check.Result {
+	ex.Deps().Logger().
+		WithField("request", req.Tuple.String()).
+		Debug("reached max-depth, therefore this query will not be further expanded")
+
+	return check.Result{Membership: check.MembershipUnknown, Limitation: check.LimitationMaxDepthExceeded}
+}
+
+// subjectSetTypesFor returns the OPL-declared subject-set types for the relation.
+// It looks up the AST for each next-level (namespace, relation) to determine
+// whether the Subject can be direct-match there.
+func subjectSetTypesFor(ctx context.Context, nm namespace.Manager, subject relationtuple.Subject, relation *ast.Relation) ([]relationtuple.SubjectSetType, error) {
+	if relation == nil {
+		return nil, nil
+	}
+	var types []relationtuple.SubjectSetType
+	for _, t := range relation.Types {
+		// empty relation means direct membership, so not a SubjectSet<> declaration
+		if t.Relation == "" {
+			continue
+		}
+		nextRel, err := namespace.ASTRelationFor(ctx, nm, t.Namespace, t.Relation)
+		if err != nil {
+			return nil, err
+		}
+		types = append(types, relationtuple.SubjectSetType{
+			Namespace:    t.Namespace,
+			Relation:     t.Relation,
+			AllowsDirect: AllowsDirectMember(nextRel, subject),
+		})
+	}
+	return types, nil
+}
+
+// AllowsDirectMember reports whether OPL allows a direct subject match for the given relation.
+// A relation with a SubjectSetRewrite is computed, so no direct tuple conforms to OPL,
+// regardless of the subject kind.
+// SubjectID subjects have no namespace, so declared types cannot constrain them and true
+// is returned conservatively.
+// For SubjectSet subjects, both namespace and relation must match a declared type exactly.
+func AllowsDirectMember(relation *ast.Relation, subject relationtuple.Subject) bool {
+	s, isSubjectSet := subject.(*relationtuple.SubjectSet)
+	if !isSubjectSet {
+		// For SubjectID, allow direct when the relation is not computed via a rewrite.
+		return relation == nil || relation.SubjectSetRewrite == nil
+	}
+	if relation == nil || relation.SubjectSetRewrite != nil {
+		return false
+	}
+	for _, t := range relation.Types {
+		if t.Namespace == s.Namespace && t.Relation == s.Relation {
+			return true
+		}
+	}
+	return false
+}