Skip to content

Commit

Permalink
fix: correct some broken links due to site changes
Browse files Browse the repository at this point in the history
  • Loading branch information
ewanharris committed Aug 14, 2024
1 parent 7f51869 commit c520eb8
Show file tree
Hide file tree
Showing 13 changed files with 32 additions and 32 deletions.
8 changes: 4 additions & 4 deletions docs/content/concepts.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ import {

<DocumentationNotice />

The <ProductName format={ProductNameFormat.ProductLink}/> service answers <IntroductionSection linkName="authorization" section="authentication-vs-authorization"/> [checks](#what-is-a-check-request) by determining whether a **[relationship](#what-is-a-relation)** exists between an [object](#what-is-an-object) and a [user](#what-is-a-user). Checks reference your **[authorization model](#what-is-an-authorization-model)** against your **[relationship tuples](#what-is-a-relationship-tuple)** for authorization authority. Below are explanations of basic FGA concepts, like type and authorization model, and a [playground](https://play.fga.dev/) to test your knowledge.
The <ProductName format={ProductNameFormat.ProductLink}/> service answers <IntroductionSection linkName="authorization" section="authentication-and-authorization"/> [checks](#what-is-a-check-request) by determining whether a **[relationship](#what-is-a-relation)** exists between an [object](#what-is-an-object) and a [user](#what-is-a-user). Checks reference your **[authorization model](#what-is-an-authorization-model)** against your **[relationship tuples](#what-is-a-relationship-tuple)** for authorization authority. Below are explanations of basic FGA concepts, like type and authorization model, and a [playground](https://play.fga.dev/) to test your knowledge.

<Playground />

Expand Down Expand Up @@ -343,7 +343,7 @@ For the following model, only [relationship tuples](#what-is-a-relationship-tupl

A relationship tuple with user `user:anne` or `user:3f7768e0-4fa7-4e93-8417-4da68ce1846c` may be written for objects with type `document` and relation `viewer`, so writing `{"user": "user:anne","relation":"viewer","object":"document:roadmap"}` succeeds.
A relationship tuple with a disallowed user type for the `viewer` relation on objects of type `document` - for example `workspace:auth0` or `folder:planning#editor` - will be rejected, so writing `{"user": "folder:product","relation":"viewer","object":"document:roadmap"}` will fail.
This affects only relations that are [directly related](#what-are-direct-and-implied-relationships) and have [direct relationship type restrictions](./configuration-language.mdx#the-direct-relationship-type-restrictions) in their relation definition.
This affects only relations that are [directly related](#what-are-direct-and-implied-relationships) and have [direct relationship type restrictions](./configuration-language.mdx#direct-relationship-type-restrictions) in their relation definition.

</details>

Expand Down Expand Up @@ -443,13 +443,13 @@ An [authorization model](#what-is-an-authorization-model), together with [relati

## What Are Direct And Implied Relationships?

A **direct relationship** (R) between user X and object Y means the relationship tuple (user=X, relation=R, object=Y) exists, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model for that relation allows the direct relationship because of [direct relationship type restrictions](./configuration-language.mdx#the-direct-relationship-type-restrictions)).
A **direct relationship** (R) between user X and object Y means the relationship tuple (user=X, relation=R, object=Y) exists, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model for that relation allows the direct relationship because of [direct relationship type restrictions](./configuration-language.mdx#direct-relationship-type-restrictions)).

An **implied (or computed) relationship** (R) exists between user X and object Y if user X is related to an object Z that is in a direct or implied relationship with object Y, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model allows it.

</summary>

- `user:anne` has a direct relationship with `document:new-roadmap` as `viewer` if the [type definition](#what-is-a-type-definition) allows it with [direct relationship type restrictions](./configuration-language.mdx#the-direct-relationship-type-restrictions), and one of the following [relationship tuples](#what-is-a-relationship-tuple) exist:
- `user:anne` has a direct relationship with `document:new-roadmap` as `viewer` if the [type definition](#what-is-a-type-definition) allows it with [direct relationship type restrictions](./configuration-language.mdx#direct-relationship-type-restrictions), and one of the following [relationship tuples](#what-is-a-relationship-tuple) exist:

- <RelationshipTuplesViewer
relationshipTuples={[
Expand Down
4 changes: 2 additions & 2 deletions docs/content/configuration-language.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -388,7 +388,7 @@ Above, `document` <ProductConcept section="what-is-a-type-definition" linkName="

:::info

`can_rename` does not reference the [direct relationship type restrictions](#the-direct-relationship-type-restrictions), which means a user cannot be directly assigned this relation and it must be inherited when the `editor` relation is assigned. Conversely, the `viewer` relation allows both direct and indirect relationships using the [Union Operator](#the-union-operator).
`can_rename` does not reference the [direct relationship type restrictions](#direct-relationship-type-restrictions), which means a user cannot be directly assigned this relation and it must be inherited when the `editor` relation is assigned. Conversely, the `viewer` relation allows both direct and indirect relationships using the [Union Operator](#the-union-operator).

:::

Expand Down Expand Up @@ -827,7 +827,7 @@ The JSON syntax accepted by the <ProductName format={ProductNameFormat.ShortForm

| Zanzibar | <ProductName format={ProductNameFormat.ShortForm}/> JSON | <ProductName format={ProductNameFormat.ShortForm}/> DSL |
| :----------------- | :------------------------------------------------------- | :------------------------------------------------------ |
| `this` | `this` | [`[<type1>,<type2>]`](#the-direct-relationship-type-restrictions) |
| `this` | `this` | [`[<type1>,<type2>]`](#direct-relationship-type-restrictions) |
| `union` | `union` | `or` |
| `intersection` | `intersection` | `and` |
| `exclusion` | `difference` | `but not` |
Expand Down
8 changes: 4 additions & 4 deletions docs/content/getting-started/production-best-practices.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ import {

The following list outlines best practices for running OpenFGA in a production environment:

- [Configure Authentication](./setup-openfga/docker-setup.mdx#configuring-authentication)
- [Configure Authentication](./setup-openfga/configure-openfga.mdx#configuring-authentication)
- Enable HTTP TLS or gRPC TLS or both
- Set the log format to "json" and log level to "info"
- [Disable the Playground](./setup-openfga/docker-setup.mdx#playground)
- [Disable the Playground](./setup-openfga/playground.mdx#disabling-the-playground)
- [Set Cluster](#cluster-recommendations)
- [Set Database Options](#database-recommendations)
- [Set Maximum Results](#maximum-results)
Expand All @@ -36,7 +36,7 @@ We recommend:

## Database Recommendations

To ensure good performance for OpenFGA, it is recommended that the [database](./setup-openfga/docker-setup.mdx#configuring-data-storage) be:
To ensure good performance for OpenFGA, it is recommended that the [database](./setup-openfga/configure-openfga.mdx#configuring-data-storage) be:
- Co-located in the same physical datacenter and network as your OpenFGA servers. This will minimize latency of database calls.
- Used exclusively for OpenFGA and not shared with other applications. This allows scaling the database independently and avoiding contention with your database.
- Bootstrapped and managed with the `openfga migrate` command. This will ensure the appropriate database indexes are created.
Expand All @@ -53,7 +53,7 @@ It's strongly recommended to fine-tune your server database connection settings

## Concurrency Limits
:::note
Before modifying concurrency limits please make sure you've followed the guidance for [Database Recommendations](./#database-recommendations)
Before modifying concurrency limits please make sure you've followed the guidance for [Database Recommendations](#database-recommendations)
:::

OpenFGA queries such as Check, ListObjects and ListUsers can be quite database and CPU intensive in some cases. If you notice that a single request is consuming a lot of CPU or creating a high degree of database contention, then you may consider setting some concurrency limits to protect other requests from being negatively impacted by overly aggressive queries.
Expand Down
4 changes: 2 additions & 2 deletions docs/content/interacting/relationship-queries.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,7 @@ There's two variations of the List Objects API.

### Caveats

ListObjects will return the results found within the time allotted (`listObjectsDeadline`, default: `3s`) up to the maximum number of results configured (`listObjectsMaxResults`, default: `1000`). See [Configuring the Server](../getting-started/setup-openfga/docker-setup.mdx#configuring-the-server)) for more on how to change the default configuration.
ListObjects will return the results found within the time allotted (`listObjectsDeadline`, default: `3s`) up to the maximum number of results configured (`listObjectsMaxResults`, default: `1000`). See [Configuring the Server](../getting-started/setup-openfga/configure-openfga.mdx)) for more on how to change the default configuration.

- If you set `listObjectsDeadline` to `1s`, the server will spend at most 1 second finding results.
- If you set `listObjectsMaxResults` to `10`, the server will return, at most, 10 objects.
Expand Down Expand Up @@ -336,7 +336,7 @@ Use the ListUsers API to get which users have a relation to a specific object.

### Caveats

ListUsers will return the results found within the time allotted (`listUsersDeadline`, default: `3s`) up to the maximum number of results configured (`listUsersMaxResults`, default: `1000`). See [Configuring the Server](../getting-started/setup-openfga/docker-setup.mdx#configuring-the-server)) for more on how to change the default configuration.
ListUsers will return the results found within the time allotted (`listUsersDeadline`, default: `3s`) up to the maximum number of results configured (`listUsersMaxResults`, default: `1000`). See [Configuring the Server](../getting-started/setup-openfga/configure-openfga.mdx)) for more on how to change the default configuration.

- If you set `listUsersDeadline` to `1s`, the server will spend at most 1 second finding results.
- If you set `listUsersMaxResults` to `10`, the server will return, at most, 10 objects.
Expand Down
4 changes: 2 additions & 2 deletions docs/content/modeling/advanced/entitlements.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -354,7 +354,7 @@ Add it now. Like so:

In this tutorial, you will find the phrases <ProductConcept section="what-are-direct-and-implied-relationships" linkName="direct relationship and implied relationship" />.

A _direct relationship_ R between user X and object Y means the relationship tuple (user=X, relation=R, object=Y) exists, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model for that relation allows this direct relationship (by use of [direct relationship type restrictions](../../configuration-language.mdx#the-direct-relationship-type-restrictions)).
A _direct relationship_ R between user X and object Y means the relationship tuple (user=X, relation=R, object=Y) exists, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model for that relation allows this direct relationship (by use of [direct relationship type restrictions](../../configuration-language.mdx#direct-relationship-type-restrictions)).

An _implied relationship_ R exists between user X and object Y if user X is related to an object Z that is in direct or implied relationship with object Y, and the <ProductName format={ProductNameFormat.ShortForm}/> authorization model allows it.

Expand Down Expand Up @@ -906,7 +906,7 @@ In this tutorial, you learned:
- how to start with a set of requirements and scenarios and iterate on the <ProductName format={ProductNameFormat.ShortForm}/> authorization model until the checks match the expected scenarios
- how to model [**parent-child relationships**](../parent-child.mdx) to indicate that a user having a relationship with a certain object implies having a relationship with another object in <ProductName format={ProductNameFormat.ShortForm}/>
- how to use [**the union operator**](../../configuration-language.mdx#the-union-operator) condition to indicate multiple possible paths for a relationship between two objects to be computed
- using [**direct relationship type restrictions**](../../configuration-language.mdx#the-direct-relationship-type-restrictions) in a <ProductName format={ProductNameFormat.ShortForm}/> authorization model, and how to block direct relationships by removing it
- using [**direct relationship type restrictions**](../../configuration-language.mdx#direct-relationship-type-restrictions) in a <ProductName format={ProductNameFormat.ShortForm}/> authorization model, and how to block direct relationships by removing it

<Playground title="Entitlements" preset="entitlements" example="Entitlements" store="entitlements" />

Expand Down
6 changes: 3 additions & 3 deletions docs/content/modeling/advanced/iot.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -717,7 +717,7 @@ To remedy this, remove `[user]` from `live_video_viewer`, `recorded_video_viewer

:::info

Notice that any reference to the [**direct relationship type restrictions**](../../configuration-language.mdx#the-direct-relationship-type-restrictions) has been removed. That indicates that a user cannot have a <ProductConcept section="what-are-direct-and-implied-relationships" linkName="direct relationship" /> with an object in this type.
Notice that any reference to the [**direct relationship type restrictions**](../../configuration-language.mdx#direct-relationship-type-restrictions) has been removed. That indicates that a user cannot have a <ProductConcept section="what-are-direct-and-implied-relationships" linkName="direct relationship" /> with an object in this type.

With this change, `anne` can no longer have a `live_video_viewer` permission for `device:1` except through having a `security_guard` or `it_admin` role first, and when she loses access to that role, she will automatically lose access to the `live_video_viewer` permission.

Expand Down Expand Up @@ -749,7 +749,7 @@ To test this, we can add a new user `emily`. Emily is **not** a `security_guard`
]}
/>

Now try to query `is emily related to device:1 as live_video_viewer?`. The returned result should be `emily is not related to device:1 as live_video_viewer`. This confirms that direct relations have no effect on the `live_video_viewer` relations, and that is because the [**direct relationship type restriction**](../../configuration-language.mdx#the-direct-relationship-type-restrictions) was removed from the relation configuration.
Now try to query `is emily related to device:1 as live_video_viewer?`. The returned result should be `emily is not related to device:1 as live_video_viewer`. This confirms that direct relations have no effect on the `live_video_viewer` relations, and that is because the [**direct relationship type restriction**](../../configuration-language.mdx#direct-relationship-type-restrictions) was removed from the relation configuration.

<CheckRequestViewer user={'user:emily'} relation={'live_video_viewer'} object={'device:1'} allowed={false} />

Expand All @@ -762,7 +762,7 @@ Query on the other relationships and you will see:

## Summary

In this post, you were introduced to <IntroductionSection linkName="fine grain authentication" section="what-is-fine-grained-authorization-fga"/> and <ProductName format={ProductNameFormat.LongForm}/>.
In this post, you were introduced to <IntroductionSection linkName="fine grain authentication" section="what-is-fine-grained-authorization"/> and <ProductName format={ProductNameFormat.LongForm}/>.

Upcoming posts will dive deeper into <ProductName format={ProductNameFormat.LongForm}/>, introducing concepts that will improve on the model you built today, and tackling more complex permission systems, with more relations and requirements that need to be met.

Expand Down
6 changes: 3 additions & 3 deletions docs/content/modeling/advanced/slack.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ Here is how you would express than in <ProductName format={ProductNameFormat.Sho
- Member (`member`)
- Guest (`guest`)

[Direct relationship type restrictions](../../configuration-language.mdx#the-direct-relationship-type-restrictions) indicate that a user can have a <ProductConcept section="what-are-direct-and-implied-relationships" linkName="direct relationship" /> with an object of the type the relation specifies.
[Direct relationship type restrictions](../../configuration-language.mdx#direct-relationship-type-restrictions) indicate that a user can have a <ProductConcept section="what-are-direct-and-implied-relationships" linkName="direct relationship" /> with an object of the type the relation specifies.

:::

Expand Down Expand Up @@ -888,12 +888,12 @@ Repeat this for the following relations

## Summary

- Have a basic understanding of <IntroductionSection linkName="authorization" section="authentication-vs-authorization"/> and <ProductConcept/>.
- Have a basic understanding of <IntroductionSection linkName="authorization" section="authentication-and-authorization"/> and <ProductConcept/>.
- Understand how to model authorization for a communication platform like Slack using <ProductName format={ProductNameFormat.ProductLink}/>.

In this tutorial, you:

- were introduced to <IntroductionSection linkName="fine grain authentication" section="what-is-fine-grained-authorization-fga"/> and <ProductName format={ProductNameFormat.ProductLink}/>.
- were introduced to <IntroductionSection linkName="fine grain authentication" section="what-is-fine-grained-authorization"/> and <ProductName format={ProductNameFormat.ProductLink}/>.
- learned how to build and test an <ProductName format={ProductNameFormat.LongForm}/> authorization model for a communication platforms like Slack.

Upcoming tutorials will dive deeper into <ProductName format={ProductNameFormat.LongForm}/>, introducing concepts that will improve on the model you built today, and tackling different permission systems, with other relations and requirements that need to be met.
Expand Down
Loading

0 comments on commit c520eb8

Please sign in to comment.