Skip to main content
In Auth0 FGA, a user’s relationship with an object can affect their relationship with another object. For example, an editor of a folder can also be an editor of all documents that folder is a parent of.

​
Before you start

Familiarize yourself with basic Auth0 FGA Concepts:

​
Step by step

The following walkthrough models (a) folders that contain documents and (b) that a user who has editor access to a given folder has editor access to all documents in that folder. For editors of a folder to be editors of a containing document, you must:
  1. Update the authorization model to allow a parent relationship between folder and document
  2. Update the editor relation in the document type definition to support cascading from folder
The following three steps indicate and verify that bob is an editor of document:meeting_notes.doc because bob is an editor of folder:notes:
  1. Create a new relationship tuple to indicate that bob is a editor of folder:notes
  2. Create a new relationship tuple to indicate that folder:notes is a parent of document:meeting_notes.doc
  3. Check to see if bob is an editor of document:meeting_notes.doc

​
01. Update the Athorization Model to allow a parent relationship between folder and document

As documented in Modeling Concepts: Object to Object Relationships, the following update to the authorization model allows a parent relation between a folder and a document:
The document type now has a parent relation, indicating that other objects can be parents of documents

​
02. Update the editor relation in the document type definition to support cascading from folder

To allow cascading relations between folder and document, update the authorization model:
editor of a document can be the following:
  1. users that are directly assigned as editors
  2. users that are related to any parent of this document as editor (editors of the parent)
After making these changes, anyone related to a folder that is a parent of a document as an editor is also an editor of that document.

​
03. Create a new relationship tuple to indicate that bob is an editor of folder:notes

To leverage the new cascading relation, create a relationship tuple stating that bob is an editor of folder:notes
Use unique ids for each object and user within your application domain when creating relationship tuples for Auth0 Fine-Grained Authorization (FGA). We are using first names and simple ids to illustrate an easy-to-follow example.

​
04. Create a new relationship tuple to indicate that folder:notes is a parent of document:meeting_notes.doc

Now that bob is an editor of folder:notes, we need to indicate that folder:notes is a parent of document:meeting_notes.doc

​
05. Check if bob is an editor of document:meeting_notes.doc

After changing the authorization model and adding two new relationship tuples, verify that your configuration is correct by running the following check: is bob an editor of document:meeting_notes.doc.
Note: There are no other relationship tuples in the store that dictate a direct relation between bob and document:meeting_notes.doc. The check succeeds because of the cascading relation.
The chain of resolution is:
  • bob is an editor of folder:notes
  • folder:notes is a parent of document:meeting_notes.doc
  • editors of any parent folder of document:meeting_notes.doc are also editors of the document
  • therefore bob is an editor of document:meeting_notes.doc
When searching tuples that are related to the object (the word after from, also called the tupleset), Auth0 Fine-Grained Authorization (FGA) will not do any evaluation and only considers concrete objects (of the form <object_type>:<object_id>) that were directly assigned. Auth0 Fine-Grained Authorization (FGA) will throw an error if it encounters any rewrites, a *, a type bound public access (<object_type>:*), or a userset (<object_type>:<object_id>#<relation>).For more information on this topic, see Referencing Relations on Related Objects.
Check the following sections for more on how to model for parent and child objects.