snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

internal/namespace/ast/ast_definitions.go

@@ -0,0 +1,73 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ast
+
+import "encoding/json"
+
+type (
+	Relation struct {
+		Name              string             `json:"name"`
+		Types             []RelationType     `json:"types,omitempty"`
+		SubjectSetRewrite *SubjectSetRewrite `json:"rewrite,omitempty"`
+	}
+
+	RelationType struct {
+		Namespace string `json:"namespace"`
+		Relation  string `json:"relation,omitempty"` // optional
+	}
+
+	SubjectSetRewrite struct {
+		Operation Operator `json:"operator"`
+		Children  Children `json:"children"`
+	}
+
+	Children = []Child
+
+	// Child are all possible types of subject-set rewrites.
+	Child interface {
+		// AsRewrite returns the child as a subject-set rewrite, as relations
+		// require a top-level rewrite, even if just one child was parsed.
+		AsRewrite() *SubjectSetRewrite
+		// EstimatedSize approximates the memory in bytes retained by the node.
+		EstimatedSize() int64
+	}
+
+	ComputedSubjectSet struct {
+		Relation string `json:"relation"`
+	}
+
+	TupleToSubjectSet struct {
+		Relation                   string `json:"relation"`
+		ComputedSubjectSetRelation string `json:"computed_subject_set_relation"`
+	}
+
+	// InvertResult inverts the check result of the child.
+	InvertResult struct {
+		Child Child `json:"inverted"`
+	}
+)
+
+type Operator int
+
+//go:generate stringer -type=Operator -linecomment
+const (
+	OperatorOr  Operator = iota // or
+	OperatorAnd                 // and
+)
+
+func (i Operator) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+
+}
+
+func (r *SubjectSetRewrite) AsRewrite() *SubjectSetRewrite { return r }
+func (c *ComputedSubjectSet) AsRewrite() *SubjectSetRewrite {
+	return &SubjectSetRewrite{Children: []Child{c}}
+}
+func (t *TupleToSubjectSet) AsRewrite() *SubjectSetRewrite {
+	return &SubjectSetRewrite{Children: []Child{t}}
+}
+func (i *InvertResult) AsRewrite() *SubjectSetRewrite {
+	return &SubjectSetRewrite{Children: []Child{i}}
+}

internal/namespace/ast/operator_string.go

@@ -0,0 +1,24 @@
+// Code generated by "stringer -type=Operator -linecomment"; DO NOT EDIT.
+
+package ast
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[OperatorOr-0]
+	_ = x[OperatorAnd-1]
+}
+
+const _Operator_name = "orand"
+
+var _Operator_index = [...]uint8{0, 2, 5}
+
+func (i Operator) String() string {
+	if i < 0 || i >= Operator(len(_Operator_index)-1) {
+		return "Operator(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Operator_name[_Operator_index[i]:_Operator_index[i+1]]
+}

internal/namespace/ast/size.go

@@ -0,0 +1,54 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ast
+
+import "unsafe"
+
+// EstimatedSize approximates the memory in bytes retained by the relation.
+func (r *Relation) EstimatedSize() int64 {
+	s := int64(unsafe.Sizeof(*r)) + int64(len(r.Name))
+	for _, t := range r.Types {
+		s += int64(unsafe.Sizeof(t)) + int64(len(t.Namespace)+len(t.Relation))
+	}
+	return s + r.SubjectSetRewrite.EstimatedSize()
+}
+
+func (r *SubjectSetRewrite) EstimatedSize() int64 {
+	if r == nil {
+		return 0
+	}
+	s := int64(unsafe.Sizeof(*r))
+	for _, c := range r.Children {
+		s += int64(unsafe.Sizeof(c)) + childSize(c)
+	}
+	return s
+}
+
+func (c *ComputedSubjectSet) EstimatedSize() int64 {
+	if c == nil {
+		return 0
+	}
+	return int64(unsafe.Sizeof(*c)) + int64(len(c.Relation))
+}
+
+func (t *TupleToSubjectSet) EstimatedSize() int64 {
+	if t == nil {
+		return 0
+	}
+	return int64(unsafe.Sizeof(*t)) + int64(len(t.Relation)+len(t.ComputedSubjectSetRelation))
+}
+
+func (i *InvertResult) EstimatedSize() int64 {
+	if i == nil {
+		return 0
+	}
+	return int64(unsafe.Sizeof(*i)) + childSize(i.Child)
+}
+
+func childSize(c Child) int64 {
+	if c == nil {
+		return 0
+	}
+	return c.EstimatedSize()
+}

internal/namespace/ast/size_test.go

@@ -0,0 +1,89 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ast_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/keto/internal/namespace/ast"
+)
+
+// The expected values are exact struct sizes on 64-bit platforms:
+// Relation 48, RelationType 32, SubjectSetRewrite 32, ComputedSubjectSet 16,
+// TupleToSubjectSet 32, InvertResult 16, interface header 16, plus string
+// lengths. If this test breaks, an AST type changed: update the size
+// accounting in size.go together with these numbers.
+func TestRelationEstimatedSize(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name     string
+		relation ast.Relation
+		expected int64
+	}{
+		{
+			name:     "empty relation",
+			relation: ast.Relation{},
+			expected: 48,
+		},
+		{
+			name: "relation with name and types",
+			relation: ast.Relation{
+				Name: "viewers",
+				Types: []ast.RelationType{
+					{Namespace: "User"},
+					{Namespace: "Group", Relation: "members"},
+				},
+			},
+			expected: 48 + 7 + // struct + "viewers"
+				32 + 4 + // type + "User"
+				32 + 5 + 7, // type + "Group" + "members"
+		},
+		{
+			name: "relation with a rewrite of every node type",
+			relation: ast.Relation{
+				Name: "view",
+				SubjectSetRewrite: &ast.SubjectSetRewrite{
+					Operation: ast.OperatorAnd,
+					Children: ast.Children{
+						&ast.ComputedSubjectSet{Relation: "editors"},
+						&ast.TupleToSubjectSet{Relation: "parents", ComputedSubjectSetRelation: "view"},
+						&ast.InvertResult{Child: &ast.ComputedSubjectSet{Relation: "banned"}},
+						&ast.SubjectSetRewrite{Children: ast.Children{
+							&ast.ComputedSubjectSet{Relation: "owners"},
+						}},
+					},
+				},
+			},
+			expected: 48 + 4 + // struct + "view"
+				32 + // rewrite
+				16 + 16 + 7 + // header + computed + "editors"
+				16 + 32 + 7 + 4 + // header + tuple + "parents" + "view"
+				16 + 16 + 16 + 6 + // header + invert + computed + "banned"
+				16 + 32 + 16 + 16 + 6, // header + nested rewrite + header + computed + "owners"
+		},
+		{
+			name: "nil children are safe and cost nothing",
+			relation: ast.Relation{
+				SubjectSetRewrite: &ast.SubjectSetRewrite{
+					Children: ast.Children{
+						nil,
+						(*ast.SubjectSetRewrite)(nil),
+						(*ast.ComputedSubjectSet)(nil),
+						(*ast.TupleToSubjectSet)(nil),
+						(*ast.InvertResult)(nil),
+						&ast.InvertResult{},
+					},
+				},
+			},
+			expected: 48 + 32 + 6*16 + 16, // struct + rewrite + 6 headers + empty invert
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.expected, tc.relation.EstimatedSize())
+		})
+	}
+}