Skip to main content

Managing User Access

In this guide you will learn how to grant a user access to a particular object.

When to use

Granting access with a relationship tuple is a core part of OpenFGA. Without any relationship tuples, any check will fail. You should use:

  • authorization model to represent what relations are possible between the users and objects in your system
  • relationship tuples to represent the facts about the relationships between users and objects in your system.

Before You Start

In order to understand this guide correctly you must be familiar with some OpenFGA Concepts and know how to develop the things that we will list below.

Assume that you have the following authorization model.
You have a type called tweet that can have a reader.

model
schema 1.1

type user

type tweet
relations
define reader: [user]

In addition, you will need to know the following:

Direct Access

You need to know how to create an authorization model and create a relationship tuple to grant a user access to an object. Learn more →

OpenFGA Concepts

  • A Type: a class of objects that have similar characteristics
  • A User: an entity in the system that can be related to an object
  • A Relation: is a string defined in the type definition of an authorization model that defines the possibility of a relationship between an object of the same type as the type definition and a user in the system
  • An Object: represents an entity in the system. Users' relationships to it can be define through relationship tuples and the authorization model
  • A Relationship Tuple: a grouping consisting of a user, a relation and an object stored in OpenFGA

Step By Step

01. Adding Direct Relationship

For our application, we will give user Anne the reader relationship to a particular tweet. To do so we add a tuple as follows:

[// Anne can read tweet:1
{
"_description": "Anne can read tweet:1",
"user": "user:anne",
"relation": "reader",
"object": "tweet:1"
}]

With the above, we have added a direct relationship between Anne and tweet:1. When we call the Check API to see if Anne has a reader relationship, OpenFGA will say yes.

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaClient } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example
storeId: process.env.FGA_STORE_ID,
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
});

// Run a check
const { allowed } = await fgaClient.check({
user: 'user:anne',
relation: 'reader',
object: 'tweet:1',
}, {
authorization_model_id: '1uHxCSuTP0VKPYSnkq1pbb1jeZw',
});

// allowed = true

02. Removing Direct Relationship

Now let's change this so that Anne no longer has a reader relationship to tweet:1 by deleting the tuple:

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaClient } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example
storeId: process.env.FGA_STORE_ID,
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
});

await fgaClient.write({
deletes: [
{ user: 'user:anne', relation: 'reader', object: 'tweet:1'}
],
}, {
authorization_model_id: "1uHxCSuTP0VKPYSnkq1pbb1jeZw"
});

With this, we have removed the direct relationship between Anne and tweet:1. And because our type definition for reader does not include any other relations, a call to the Check API will now return a negative response.

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaClient } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaClient({
apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example
storeId: process.env.FGA_STORE_ID,
authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request
});

// Run a check
const { allowed } = await fgaClient.check({
user: 'user:anne',
relation: 'reader',
object: 'tweet:1',
}, {
authorization_model_id: '1uHxCSuTP0VKPYSnkq1pbb1jeZw',
});

// allowed = false
Direct Access

Learn about how to model granting user access to an object.

Modeling Public Access

Learn about how to model granting public access.

How to update relationship tuples

Learn about how to update relationship tuples in SDK.