New CLI feature: Testing your model using the OpenFGA CLI

[aaguiarz]

We just released a version of the OpenFGA CLI that lets you validate and test your FGA model without hitting an OpenFGA server 😍.

For example, given the following hello-fga.yaml file:

model: | 
  model
    schema 1.1
  type user
  type team
    relations 
      define member : [user]
  type document
    relations
      define can_view: [user, team#member]
tuples:
  - user: team:sales#member
    relation: can_view
    object: document:readme
  - user: user:anne
    relation: member
    object: team:sales

tests:
  - name: "user:anne should be able to view document:readme"
    check:
      - user: user:anne
        object: document:readme
        assertions:
          can_view: true
   
    list_objects:
      - user: user:anne
        type: document
        assertions:
          can_view:
            - document:readme

If you don't have the CLI installed, you can install it with brew:

brew install openfga/tap/fga

You can now run

fga model test --tests hello-fga.yaml

And you'll get:

(PASSING) test document can_view: Checks (1/1 passing) | ListObjects (1/1 passing)      

You can also point to an external model by starting the YAML file by pointing to it, instead of including the full model.

model_file: hello.fga

We'll soon be releasing a Github Action to make it simpler to integrate it in your CI/CD pipelines. You can learn more here.

Let us know what you think!