Is there a concept of a type being a user in relation to itself?

[a0js]

Say I have 2 entity types person and account. Normally we would check if a person had a specific relation on an account, but my app also supports account level api tokens without an associated person. In this instance an account should have access to itself. Is there a concept of self referencing that I can utilize without opening the relationship to all accounts (can_haz_access: [..., account]) and an extra tuple (account:1, can_haz_access, account:1) in the db?

model
  schema 1.1
type person

type account
  relations
     member: [person]
     
     can_haz_access: [person, account#member, ???] <- Is there something I can put in place of ??? that references the account itself?

[aaguiarz]

Hi @a0js,

There currently no way to achieve it without the additional tuple. However, if you have service accounts, it might make sense to control which services account can access each account:

model
  schema 1.1

type person
type service_account

type account
  relations
     member: [person]
     
     can_haz_access: [person, account#member, service_account] 

That way you can have multiple services account and give each one permissions to the account they own.

[a0js]

Thanks for the quick reply, @aaguiarz! In an ideal world, I would tie the api token to bot_user, but I don't really have that available in my business db. I might just have to deviate from "reality" in the model and make a service_account or bot_user type to represent accessing via the tokens and just use the same id (with a different prefix) for the tuples. Thanks for the direction.

I thought of another use case that this kind of self referencing could be useful:

model
  schema 1.1

type person
  relations
    org: [organization]
    can_update_notification_preferences: [self] or admin from org

type organization
  relations
    admin: [person]

So in instances like this, does it just make more sense to do this check outside of openfga? I could see instances where downstream/indirect relations could benefit from self referencing capability. I'm assuming it will be very complicated to implement, but is there any talk of adding such a capability?

[aaguiarz]

That use case makes sense, can you add an Idea for it? 🙏

Currently you could potentially solve it as:

type person
  relations
    define org: [organization]
    define me : [person]
    define can_update_notification_preferences: me or admin from org

And send a contextual tuple saying 'person:id, me, person:id' when calling check, to avoid writing the tuple to the store.

[a0js]

For sure, I'll add the idea!

I ended up doing something just like your suggestion of using me, though I think you don't want the brackets around me in the can_update_notrication_preferences defintion, correct?

For my case I ended up doing something like this:

model
  schema 1.1
type person

type account
  relations
     member: [person]
     account_access_token: [account]
     can_haz_access: [person, account#member] or account_access_token

And then I added the (account:1, account_access_token, account:1) tuple, rather than adding the extra type to keep track of.
This will work for our use case for now. Thanks so much for the quick responses!

[aaguiarz]

Right, just removed the brackets :)

[flex-seongbok]

Hello I have a similar requirement like this.
If there is a owner accessible relation like below I have to add relation explicitly on every user created.
Using contextual tuple every check feels like separating authorization policy into code and model.

type user
  relations
    define self: [user]
    define manager: [user]
    define can_edit_role: manager
    define can_read_personal_info: manager or self