Skip to content

Modification timestamps in data APIs #2131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pete-woods opened this issue Mar 21, 2025 · 1 comment
Open

Modification timestamps in data APIs #2131

pete-woods opened this issue Mar 21, 2025 · 1 comment
Assignees
Labels
feature request New feature or request

Comments

@pete-woods
Copy link
Contributor

pete-woods commented Mar 21, 2025

Is your feature request related to a problem? Please describe.
To be able to show when a relationship was created (or indeed an attribute added/modified) is very useful when creating management APIs/UIs in your application.

This gives administrators an "at a glance" view of when things changed in the access they are managing (without having to dive into often-complex audit logs).

Describe the solution you'd like
Similar to the READ API in OpenFGA, storing and returning timestamps for relationship tuples would faciliate this greatly.

Adding the tuple and attribute modification timestamps to the read APIs could look like this:

{
  "tuples": [
    {
      "entity": {
        "type": "<string>",
        "id": "<string>"
      },
      "relation": "<string>",
      "subject": {
        "type": "<string>",
        "id": "<string>",
        "relation": "<string>"
      },
      "timestamp": "2021-10-06T15:32:11.128Z" # <-- New field here
    }
  ],
  "continuous_token": "<string>"
}
{
  "attributes": [
    {
      "entity": {
        "type": "<string>",
        "id": "<string>"
      },
      "attribute": "<string>",
      "value": {
        "@type": "<string>"
      },
      "timestamp": "2021-10-06T15:32:11.128Z" # <-- New field here
    }
  ],
  "continuous_token": "<string>"
}

It would also be extremely useful to be able to "spoof" the modification timestamps when writing tuples, to facilitate migration from other authorization systems, or otherwise be the authority on modification timestamps in your app (perhaps from a company-wide central time authority).

cr, err := client.Data.Write(context.Background(), &v1.DataWriteRequest{
    TenantId: "t1",
    Metadata: &v1.DataWriteRequestMetadata{
        SchemaVersion: "",
    },
    Tuples: []*v1.Tuple{
        {
            Entity: &v1.Entity{
                Type: "document",
                Id:   "1",
            },
            Relation: "editor",
            Subject:  &v1.Subject{
                Type: "user",
                Id:   "1",
                Relation: "",
            },
            Timestamp: time.Now(), // <-- New field here
        },
    },
    Attributes: []*v1.Attribute{
        {
            Entity: &v1.Entity{
                Type: "document",
                Id:   "1",
            },
            Attribute: "is_private",
            Value:     value,
            Timestamp: time.Now(), // <-- New field here
        },
    },
})

Describe alternatives you've considered
It's possible to create "dummy entities" with attributes to store this data, but it adds significant complexity to the application code read pathways.

Additional context
For example our groups management page here at CircleCI (where we are currently evaluating a swich from our in-house authorization engine to Permify):

Image
@pete-woods pete-woods added the feature request New feature or request label Mar 21, 2025
@pete-woods
Copy link
Contributor Author

@ucatbas hi - here's the feature request :-)

@pete-woods pete-woods changed the title Modification timestamps in data API Modification timestamps in data APIs Mar 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature request New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants