Sharing tuple data across stores

[marlenekoh]

I have a central permissions store containing a list of tuples (e.g. user -> role, group -> role)

Store 1

model
  schema 1.1

type user

type role
  relations
    define member: [user]

I have a few applications managing their own permissions. Using modular models (https://openfga.dev/docs/modeling/modular-models), I can do this

e.g. Store 2: (extends model from store 1)

# ...

type document
  relations
    define reader: [user, role#member]
    define writer: [user, role#member] 
    # ...

e.g. Store 3: (extends model from store 1)

# ...

type document
  relations
    define approver: [user, role#member]
    # ...

For stores 2 and 3, they will need to share the tuple data (user > member > role) from store 1.

Currently I am syncing tuple data from store 1 -> 2 and store 1 -> 3 via a hourly cronjob, but this means there is a delay before permissions are reflected correctly in store 2 and store 3.

Is there a better way to do this? Thanks!!

[rhamzeh]

Hi @marlenekoh - any reason why the data is not all in one store?

Our intention is that if data needs to be shared, they need to be one store and that stores are completely isolated from one another.

[marlenekoh]

(common) store 1: user -> roles mapping
(application A) store 2: user/roles -> documents mapping
(application B) store 3: user/roles -> documents mapping

in my use case, application A and B have different owners. it makes sense that application B should not be able to modify permissions for application A, and vice versa.

I also do not want applications A and B to modify the permissions in the common store 1.

[rhamzeh]

In that case, would a single store with experimental access control be more in line with what you are thinking?

https://openfga.dev/docs/getting-started/setup-openfga/access-control

You can see a part at the end around:

Grant access to writing tuples of a certain module in a store.

[marlenekoh]

oh yes that seems like it could be useful. would like to clarify, how does it work if the modules in store 2 and store 3 have the same relation (e.g. user > reader > document), then applications can still modify tuples added by a different application?