Get all tuples related to a user without specifying relation or object

[oasisk]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of OpenFGA and the issue still persists.
• I have searched the Discord community and have not found a suitable solution or answer.
• I agree to the terms within the OpenFGA Code of Conduct.

Description

Our model allows custom role creation & assigning permissions to this role on pre-defined resources, the permissions are get , list , create , update & delete.

Our model is as described in Store data.

We would like to fetch all permissions that role:role1 has, read or list objects API cant help us fetch us because of mandatory request attributes each of API's have

Expectation

We would like to fetch all permission tuples for role:role1

Reproduction

model specified above

Store data

model_file: |
 model
  schema 1.1

type user

type org
  relations
    define viewer: [user]
    define editor: [user]

type folder
  relations
    define GET: [user, role#assignee] or viewer from owningOrg
    define POST: [user, role#assignee] or editor from owningOrg
    define owningOrg: [org]


type dashboard
  relations
    define GET: [user, role#assignee] or viewer from owningOrg
    define POST: [user, role#assignee] or editor from owningOrg
    define owningOrg: [org]

type function
  relations
    define GET: [user, role#assignee] or viewer from owningOrg
    define POST: [user, role#assignee] or editor from owningOrg
    define owningOrg: [org]

type role
  relations
    define assignee: [user] 
    define viewer: [user]

tuples:
  - user: [email protected]
    relation: assignee
    object: role:role1
  - user: role:role1#assignee
    relation: POST
    object: function:a

OpenFGA version

v1.4.0

How are you running OpenFGA?

In Docker

What datastore are you using?

Postgres

OpenFGA Flags

NA

Logs

No response

[aaguiarz]

Hi @oasisk

Those filters are not supported in the Read API. Also, I assume you want to know all the objects that assignee of a specific role have access to, right?

You'd need to make one call per object type:

Read (user: role:role1#assignee , object: "folder:")
Read (user: role:role1#assignee , object: "dashboard:")
Read (user: role:role1#assignee , object: "function:")

[aaguiarz]

BTW, improving this is in our roadmap openfga/roadmap#33