ReBAC Support

[coopbri]

Relationship-based access control (ReBAC) is an access control model where permissions are granted based on the relationships between entities (e.g. users, resources, groups), beyond roles and attributes. This is used in production by companies like Google (e.g. for Google Docs sharing permissions), and enables convenient use case fulfillment such as automatic relations/authZ based on nested attributes resulting from an authZ graph (typically directed).

See Google Zanzibar paper for reference implementation

Reading/references:

https://cspages.ucalgary.ca/~pwlfong/Pub/codaspy2011.pdf
https://dl.acm.org/doi/10.1145/1943513.1943539
https://www.researchgate.net/publication/236136712_A_New_Access_Control_Scheme_for_Facebook-Style_Social_Networks
https://www.osohq.com/academy/relationship-based-access-control-rebac
https://permify.co/post/relationship-based-access-control-rebac
https://aws.amazon.com/blogs/database/graph-powered-authorization-relationship-based-access-control-for-access-management
https://docs.permit.io/how-to/build-policies/rebac/overview
https://www.permit.io/blog/custom-policies

[letstri]

Thank you for the issue! Right now, this looks complicated to me. I only see the option of releasing a new major version as a solution.

You can help me by providing an example of how you would like to see Permix used with ReBAC.

[coopbri]

It is complicated, honestly!

The way I imagine it is extending createPermix to be graph-based/relation-aware:

type Relations = {
  user: {
    follows: string[];
    owns: string[];
  };
  post: {
    author: string;
  };
};

const permix = createPermix<
  {
    post: {
      read: (ctx: { userId: string; postId: string }) => boolean;
    };
  } & Relations
>();

permix.setup({
  post: {
    read: ({ userId, postId }) => {
      const user = permix.get("user", userId);
      const post = permix.get("post", postId);
      
      // ReBAC logic: owner or follower
      return user.owns.includes(postId) || user.follows.includes(post.author);
    },
  },
});

Then:

// true if related
const canRead = permix.check("post", "read", { userId, postId }); 

Technically that's not full Zanzibar-style ReBAC, with zookies and such, which is where things get really complicated. But that's the initial, simplified API I can think of. :)

[letstri]

Well, I have a lot of thoughts about this.

We need to somehow understand the relations, in your example it is unclear where the posts and users inside Permix come from.

Also, the definition needs to be improved since the & operator stands out from the general plan.

This rework needs to be thought through quite well and for more than just one day 😁

[Laci556]

Hey! I’m a bit late to the conversation but this is exactly what I’ve tried to solve with my library. It uses an ORM adapter (currently Prisma and Drizzle are supported) to infer the entities and relations from the database schema and make queries to check the permissions.

Documentation is very incomplete, it was originally created for my BSc thesis and I haven’t had the motivation to continue it until RQBv2 becomes stable in Drizzle 1.0. But feel free to check it out for inspiration, here are some examples that show the library in action: usage with Drizzle, permission definition tests

PS, great job on Permix, I wish I had discovered it earlier 😄