In order to understand this guide correctly you must be familiar with some Auth0 FGA Concepts and know how to develop the things that we will list below.
Make sure to use unique ids for each object and user within your application domain when creating relationship tuples for Auth0 Fine-Grained Authorization (FGA). We are using first names and simple ids to just illustrate an easy-to-follow example.
In previous guides, we have shown how to indicate that objects are related to users or objects. In some cases, you might want to indicate that everyone is related to an object (for example when sharing a document publicly).
To do this we need to create a relationship tuple using the type bound public access. The type bound public access syntax is used to indicate that all users of a particular type have a relation to a specific object.Let us create a relationship tuple that states: any user can view document:company-psa.doc
Wildcard syntax usagePlease note that type-bound public access is not a wildcard or a regex expression.You cannot use the <type>:* syntax in the tuple’s object field.The following syntax is invalid:
[ // It is invalid to use this syntax in the object field. The below relationship tuple is invalid and does not mean that Bob can view all documents. { "user": "user:bob", "relation": "view", "object": "document:*" }]
Wildcard syntax usageYou cannot use <type>:* as part of a userset in the tuple’s user field.The following syntax is invalid:
[ // It is invalid to use this syntax as part of a userset. The below relationship tuple is invalid and does not mean that members of any org can view the company-psa document. { "user": "org:*#member", "relation": "view", "object": "document:company-psa.doc" }]
Once the above relationship tuple is added, we can check if bob cab viewdocument:company-psa.doc. Auth0 FGA will return { "allowed": true } even though no relationship tuple linking bob to the document was added. That is because the relationship tuple with user:* as the user made it so every object of type user (such as user:bob) can view the document, making it public.
