openfga
openfga copied to clipboard
Add more model validation test cases
Right now we have some model validations in place that should protect users from some mistakes, but there's quite a few (unlikely) cases that are not covered.
Here are a few examples (using Craig Pastro's parser) of invalid models that should be enforced, but currently are not:
type user
type document
relations
define restricted: [user] as self
define editor: [user] as self
define viewer: [document#viewer] as (self or editor) but not restricted
type user
type document
relations
define allowed: [user] as self
define editor: [user] as self
define viewer: [document#viewer] as (self or editor) and allowed
Basically, if there is a compound rewrite (nested expressions) joined by at least one or more intersections or exclusions, then we're not currently handling the validation cases around this properly.
We are closing this issue as it is not currently feasible in the new schema to write such models.