Need some help setting up the relations and permissions

[Tri3st]

Hello all,

I am using ORY with oauth2 and oidc. That bit is working like a charm.

Now i want to check the permissions for each user if it logs in.

I have 4 API's : and on those API's i have several groups : viewers, editors, admins, owners.

So I chose namespace : API
object : api-name
relation : viewers, editors, admins, owners

How am i to go from here?
I am not really skilled in the OCL yet.

This is what i came up with :

import { Namespace, SubjectSet, Context } from "@ory/permission-namespace-types"

class User implements Namespace {
  related: {
    manager: User[]
  }
}

class Group implements Namespace {
  related: {
    members: (User | Group)[]
  }
}

class API implements Namespace {
  related: {
    path: API[]
    viewers: (User | API)[]
  }
  
  permits = {
    view: (ctx: Context): boolean => 
      this.related.viewers.includes(ctx.subject)
  }
}

class Endpoint implements Namespace {
  related: {
    parents: (Endpoint | API)[]
    viewers: (User | SubjectSet<Group, "members">)[]
    editors: (User | SubjectSet<Group, "members">)[]
    admins: (User | SubjectSet<Group, "members">)[]
    owners: (User | SubjectSet<Group, "members">)[]
  }

  permits = {
    apiGet: (ctx: Context): boolean =>
      this.related.viewers.includes(ctx.subject) ||
      this.related.editors.includes(ctx.subject) ||
      this.related.admins.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),
    apiPost: (ctx: Context): boolean =>
      this.related.editors.includes(ctx.subject) ||
      this.related.admins.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),
    apiPatch: (ctx: Context): boolean =>
      this.related.admins.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),
    apiDelete: (ctx: Context): boolean =>
      this.related.admins.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),
    apiAdmin: (ctx: Context): boolean =>
      this.related.admins.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),
    apiALL: (ctx: Context): boolean =>
      this.related.owners.includes(ctx.subject)
  }
}

Any help is welcome! thanks in advance