9456a4e922
Some checks failed
CI / Run lints and checks (push) Failing after 47s
CI / Run tests (push) Failing after 1s
CI / Run race tests (push) Failing after 5s
CI / Build CLI docs (push) Has been skipped
CI / Run buf actions (push) Failing after 5s
CodeQL / Analyze (go) (push) Failing after 3s
CodeQL / Analyze (javascript) (push) Failing after 2s
Docker Image Scanners / scanners (push) Failing after 3s
Format / format (push) Failing after 3s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Draft newsletter (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
79 lines
2.9 KiB
Go
79 lines
2.9 KiB
Go
// Copyright © 2026 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package step
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/ory/keto/internal/check"
|
|
"github.com/ory/keto/internal/namespace"
|
|
"github.com/ory/keto/internal/namespace/ast"
|
|
"github.com/ory/keto/internal/relationtuple"
|
|
)
|
|
|
|
// astRelationFor looks up the AST Relation for the given tuple's namespace and
|
|
// relation. Returns nil (not an error) when no namespace config is present.
|
|
func astRelationFor(ctx context.Context, nm namespace.Manager, r *relationTuple) (*ast.Relation, error) {
|
|
return namespace.ASTRelationFor(ctx, nm, r.Namespace, r.Relation)
|
|
}
|
|
|
|
// maxDepthReached logs a debug message and returns MembershipUnknown.
|
|
// Call it when RestDepth is exhausted and the check cannot be expanded further.
|
|
func maxDepthReached(ex check.Executor, req check.CheckRequest) check.Result {
|
|
ex.Deps().Logger().
|
|
WithField("request", req.Tuple.String()).
|
|
Debug("reached max-depth, therefore this query will not be further expanded")
|
|
|
|
return check.Result{Membership: check.MembershipUnknown, Limitation: check.LimitationMaxDepthExceeded}
|
|
}
|
|
|
|
// subjectSetTypesFor returns the OPL-declared subject-set types for the relation.
|
|
// It looks up the AST for each next-level (namespace, relation) to determine
|
|
// whether the Subject can be direct-match there.
|
|
func subjectSetTypesFor(ctx context.Context, nm namespace.Manager, subject relationtuple.Subject, relation *ast.Relation) ([]relationtuple.SubjectSetType, error) {
|
|
if relation == nil {
|
|
return nil, nil
|
|
}
|
|
var types []relationtuple.SubjectSetType
|
|
for _, t := range relation.Types {
|
|
// empty relation means direct membership, so not a SubjectSet<> declaration
|
|
if t.Relation == "" {
|
|
continue
|
|
}
|
|
nextRel, err := namespace.ASTRelationFor(ctx, nm, t.Namespace, t.Relation)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
types = append(types, relationtuple.SubjectSetType{
|
|
Namespace: t.Namespace,
|
|
Relation: t.Relation,
|
|
AllowsDirect: AllowsDirectMember(nextRel, subject),
|
|
})
|
|
}
|
|
return types, nil
|
|
}
|
|
|
|
// AllowsDirectMember reports whether OPL allows a direct subject match for the given relation.
|
|
// A relation with a SubjectSetRewrite is computed, so no direct tuple conforms to OPL,
|
|
// regardless of the subject kind.
|
|
// SubjectID subjects have no namespace, so declared types cannot constrain them and true
|
|
// is returned conservatively.
|
|
// For SubjectSet subjects, both namespace and relation must match a declared type exactly.
|
|
func AllowsDirectMember(relation *ast.Relation, subject relationtuple.Subject) bool {
|
|
s, isSubjectSet := subject.(*relationtuple.SubjectSet)
|
|
if !isSubjectSet {
|
|
// For SubjectID, allow direct when the relation is not computed via a rewrite.
|
|
return relation == nil || relation.SubjectSetRewrite == nil
|
|
}
|
|
if relation == nil || relation.SubjectSetRewrite != nil {
|
|
return false
|
|
}
|
|
for _, t := range relation.Types {
|
|
if t.Namespace == s.Namespace && t.Relation == s.Relation {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|