Skip to content

fix(docs): use relation 'reader' instead of 'can_view' in perform-check.mdx #1022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

maxloge
Copy link
Contributor

@maxloge maxloge commented Apr 28, 2025

Description

The "Getting Started" use inconsistent relationship names between the Update Relationship Tuples and Perform a Check sections:

Step Page Relation
1. Create tuple update-tuples.mdx reader
2. Check tuple perform-check.mdx can_view

Someone who follows the instructions in order will receive a 400 Bad Request / ValidationException when calling the Check API, even though the example in the doc claims that the result is allowed: true.

A user following the example in Python with

    body = ClientCheckRequest(
        user="user:anne",
        relation="can_view",
        object="document:Z",
    )

would get the following Traceback:

Traceback (most recent call last):
  File "<string>", line 6, in <module>
  File "<string>", line 2, in <module>
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/client/client.py", line 650, in check
    api_response = self._api.check(body=req_body, **kwargs)
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/open_fga_api.py", line 255, in check
    return self.check_with_http_info(body, **kwargs)
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/open_fga_api.py", line 388, in check_with_http_info
    return self.api_client.call_api(
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/api_client.py", line 565, in call_api
    return self.__call_api(
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/api_client.py", line 344, in __call_api
    raise e
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/api_client.py", line 278, in __call_api
    response_data = self.request(
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/api_client.py", line 641, in request
    return self.rest_client.request(
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/rest.py", line 507, in request
    self.handle_response_exception(raw_response)
  File "/home/vscode/.local/lib/python3.10/site-packages/openfga_sdk/sync/rest.py", line 333, in handle_response_exception
    raise ValidationException(http_resp=response)
openfga_sdk.exceptions.ValidationException: (400)
Reason: Bad Request

I've also updated the explanation regarding the result since:

export FGA_API_URL=http://openfga:8080 && \
export FGA_STORE_ID=01JSWBHVGB4VSPPNCCV8R4SBSW && \
export FGA_MODEL_ID=01JSWQNDX7MPVM29P39ACTH9EN
$ curl -i -s -X POST \
  "${FGA_API_URL}/stores/${FGA_STORE_ID}/check" \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'"${FGA_MODEL_ID}"'",
    "tuple_key": {
      "user": "user:anne",
      "relation": "reader",
      "object": "document:Z"
    }
  }' && printf "\n"

returns

HTTP/1.1 200 OK
Content-Type: application/json
Openfga-Authorization-Model-Id: 01JSWQNDX7MPVM29P39ACTH9EN
Openfga-Store-Id: 01JSWBHVGB4VSPPNCCV8R4SBSW
Vary: Origin
X-Request-Id: 50d7c9e8-2400-4e48-bdea-3c42a07f9183
Date: Tue, 29 Apr 2025 02:15:53 GMT
Content-Length: 32

{"allowed":true,"resolution":""}

$ curl -i -s -X POST \
  "${FGA_API_URL}/stores/${FGA_STORE_ID}/check" \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'"${FGA_MODEL_ID}"'",
    "tuple_key": {
      "user": "user:anne",
      "relation": "writer",
      "object": "document:Z"
    }
  }' && printf "\n"

returns

HTTP/1.1 200 OK
Content-Type: application/json
Openfga-Authorization-Model-Id: 01JSWQNDX7MPVM29P39ACTH9EN
Openfga-Store-Id: 01JSWBHVGB4VSPPNCCV8R4SBSW
Vary: Origin
X-Request-Id: c06bbc2d-d326-4422-8e59-16e92edee840
Date: Tue, 29 Apr 2025 02:16:16 GMT
Content-Length: 33

{"allowed":false,"resolution":""}

and

$ curl -i -s -X POST \
  "${FGA_API_URL}/stores/${FGA_STORE_ID}/check" \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'"${FGA_MODEL_ID}"'",
    "tuple_key": {
      "user": "user:anne",
      "relation": "can_view",
      "object": "document:Z"
    }
  }' && printf "\n"

returns

HTTP/1.1 400 Bad Request
Content-Type: application/json
Openfga-Authorization-Model-Id: 01JSWQNDX7MPVM29P39ACTH9EN
Openfga-Store-Id: 01JSWBHVGB4VSPPNCCV8R4SBSW
Vary: Origin
X-Request-Id: afff79c3-cf8b-4d9d-a7fa-c9bd189786f9
Date: Tue, 29 Apr 2025 02:16:40 GMT
Content-Length: 79

{"code":"validation_error","message":"relation 'document#can_view' not found"}

Fix

In perform-check.mdx, change the example relation from can_view to reader so it matches the tuple created in the previous page and the relation that is used in the other pages of the Getting Started section of the documentation.

After the fix, the end-to-end example executed by a user reading the documentation linearly using the instructions of the precedent page will works as expected.

The explanation below the example regarding the expected result has also been updated to be more specific.

References

The mismatch is visible on these pages:

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

@maxloge maxloge requested a review from a team as a code owner April 28, 2025 23:58
@maxloge maxloge marked this pull request as draft April 29, 2025 00:34
@maxloge maxloge force-pushed the fix/docs/reader-relation-mismatch branch from 71eadcb to ea75a56 Compare April 29, 2025 02:11
@maxloge maxloge marked this pull request as ready for review April 29, 2025 02:30
@maxloge maxloge force-pushed the fix/docs/reader-relation-mismatch branch from ea75a56 to 77c7488 Compare May 2, 2025 02:17
@rhamzeh rhamzeh self-assigned this May 6, 2025
@rhamzeh
Copy link
Member

rhamzeh commented May 6, 2025

Thanks @maxloge - will take a look at this soon!

…date-tuples

The perform-check.mdx example was using relation 'can_view', but the
update-tuples page creates relation 'reader'. This brings the two
getting-started examples into sync and prevents the ValidationException.
@maxloge maxloge force-pushed the fix/docs/reader-relation-mismatch branch from 77c7488 to 6275cad Compare May 13, 2025 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants