list-api to retrieve list accessible objects

[SlickWish]

Lets say I have 3 users, customer1, customer2, and support1

When the customers create objects I want them to have an owner relationship. This maps to read,write and delete.

Now, I want to be able to put a support users group that has read access to the customer objects.

I don't want to have to make a separate API for support users and customers. The objects visible should be reflected by what group they are in.

I have tried the list API, but it doesn't list objects the support user should have for visibility.

Can Keto support this type of scenario?

[zepatrik]

Have you seen and followed https://www.ory.sh/keto/docs/guides/list-api-display-objects? There we explain why there is no specific "list everything I have access to" API.
If you have a use case that has vastly different requirements, which can't be met by the current API, please explain them in more detail.

I don't want to have to make a separate API for support users and customers.

Currently, for me this sounds more like a convenience thing rather than a limitation of the current API. Please keep in mind that adding such convenience shortcuts will impact performance, possibly by orders of magnitude, depending on your data. More details are in above linked docs page.

[zhaochy1990]

hello @zepatrik

we are trying to use keto as the foundation of our authorization system. I'v already read keto docs and had a brief understanding of keto implementation through reading part of keto codes.

our business scenarios have 1k+ subjects that might be binded to a role, and a role will be assigned to a principal, principal could be any of User, Department, UserGroup, Organization, Application, Device, etc...

our planned modeling like following

OBJECT         NAMESPACE               RELATION               SUBJECT

3vc3fa1y       Principal               member                 Bob

r1             Role                    assignment             Bob
r2             Role                    assignment             Principal:3vc3fa1y#member

d038f916       Book                    Read                   Role:r1#assignment
d038f916       Book                    Update                 Role:r1#assignment
b24b4f92       Book                    Read                   Role:r2#assignment
b24b4f92       Book                    Update                 Role:r2#assignment

With the above model, we have the following considerations for the list API, and we are happy to see if you could give our some suggestions:

1. we need to get all Books that a user have Read permission, which means the list API also needs to includes object from indirect relation-tuples
2. most of the time, there might be business query filters along with the list API. For instance:
   1. I want to list all books I can Read which are published in 2021.
   2. I want to list all books I can Read sort by the books' publish time
3. both 1 and 2 needs to support pagination

[zepatrik]

I opened a new discussion for this: #806