#Please verify: Docs vs Playground behavior

1 messages · Page 1 of 1 (latest)

olive sail
#

Hey Everyone! I am confused whether the description on the official website is correct. Both my understanding and the tests conducted on the playground yield results inconsistent with this description. Please help to confirm.

"""
he and operation creates an intersection between relations but is not tied to specific entities. For example, in the following model, users can see a repository if they are a member or admin of any organization.
Let’s say user:1 is a member of organization:1 and an admin of organization:2. If repository:1 belongs to organization:1, then user:1 has access to delete repository:1.

Copy
entity user {}

entity organization {
relation member @user
relation admin @user
}

entity repository {
relation org @organization
permission delete = org.member and org.admin
}
This is not always what you want. If you want to tie the relation to a specific organization, so that a user must be an admin and a member of the same organization to have the delete permission, create the permission on the organization and have the repository re-use the permission check.
"""

stuck robin
#

Hello @olive sail , you are right, this example in the docs is incorrect.
What it was trying to explain is, if a repository is related to multiple organizations, and a user is an admin in one of them and a member in another, the current schema can still grant delete.
You can see it in this playground example I created. user:1 is admin in organization:1 and member in organization:2:
https://play.permify.co/?s=1774282917310-9dmtun3
I’ll update the docs. Thanks for reporting this.