Transform model to extended format

[mauriceackel]

It occurs to me that the OpenFGA API is returning a "richer" authorization model JSON response than the one provided in the "write" call.

In particular, say you store this authorization model:

{
  "schema_version": "1.1",
  "type_definitions": [
    {
      "type": "user"
    },
    {
      "type": "document",
      "relations": {
        "viewer": {
          "this": {}
        }
      },
      "metadata": {
        "relations": {
          "viewer": {
            "directly_related_user_types": [
              {
                "type": "user",
                "condition": "non_expired_grant"
              }
            ]
          }
        }
      }
    }
  ],
  "conditions": {
    "non_expired_grant": {
      "name": "non_expired_grant",
      "expression": "current_time == grant_time + grant_duration",
      "parameters": {
        "current_time": {
          "type_name": "TYPE_NAME_TIMESTAMP"
        },
        "grant_duration": {
          "type_name": "TYPE_NAME_DURATION"
        },
        "grant_time": {
          "type_name": "TYPE_NAME_TIMESTAMP"
        }
      }
    }
  }
}

Once I read it back from the API, it looks like this:

{
  "schema_version": "1.1",
  "type_definitions": [
    {
      "relations": {},
      "type": "user"
    },
    {
      "metadata": {
        "module": "",
        "relations": {
          "viewer": {
            "directly_related_user_types": [
              {
                "condition": "non_expired_grant",
                "type": "user"
              }
            ],
            "module": ""
          }
        }
      },
      "relations": {
        "viewer": {
          "this": {}
        }
      },
      "type": "document"
    }
  ],
  "conditions": {
    "non_expired_grant": {
      "expression": "current_time == grant_time + grant_duration",
      "name": "non_expired_grant",
      "parameters": {
        "current_time": {
          "generic_types": [],
          "type_name": "TYPE_NAME_TIMESTAMP"
        },
        "grant_duration": {
          "generic_types": [],
          "type_name": "TYPE_NAME_DURATION"
        },
        "grant_time": {
          "generic_types": [],
          "type_name": "TYPE_NAME_TIMESTAMP"
        }
      }
    }
  }
}

I.e. it has some additional (optional) fields now like "relations": {} or "generic_types": [] or "module": "".

Background

I'm trying to write a terraform provider and I want to store the model in JSON representation in the state. However, the fact that I receive a different response compared to what I've sent makes this difficult. Terraform will continuously identify a changed state. Hence, I want to be able to convert the user's input into the "rich" format first before storing it in the state.

Is there a library out there (perhaps in openfga/language) that can convert the first JSON (without the optional fields) into the second representation (with default values for the optional fields)?

[mauriceackel]

After a lot of research, I've realized that this is probably caused by the grpc-gateway framework.

As it turns out, the default marshaller has the EmitUnpopulated flag set to true (code reference)

This causes the marshaller to set default values for certain data types as explained in the docs. Notably, it sets "" for undefined strings and [] for undefined arrays.

This behaviour can be changed by providing custom marshaller to the framework using the WithMarshalerOption (code reference) mux option.

To me, this behaviour increasingly looks like a bug. I'd be keen to get your perspective on this @aaguiarz.

[mauriceackel]

Here is also the original issue that introduced the EmitUnpopulated: true behaviour: grpc-ecosystem/grpc-gateway#233

[senojj]

If the input contains some unpopulated fields, what is the expected output?