When making an FGA check, contextual tuples and/or a context parameter can be passed for more advanced authorization scenarios.

Contextual tuples

Contextual tuples can be sent in a check request and will be part of the authorization evaluation as if they exist they in the store.

For example, user:123 is a member of the marketing group, and the marketing group has been granted the viewer relationship for document:roadmap.

We can send conditional tuples on the request to inform the groups to which user:123 belongs (e.g., from a groups claim):

var body = new ClientCheckRequest()
      .user("user:123")
      .relation("viewer")
      ._object("document:1")
      .contextualTuples(
          List.of(
              new ClientTupleKey()
                  .user("user:123")
                  .relation("member")
                  ._object("group:marketing"),
              new ClientTupleKey()
                  .user("user:123")
                  .relation("member")
                  ._object("group:everyone")
          ));

var allowed = fga.check(body).get().getAllowed();

Conext with conditions

An authorization model may define a condition, and a context parameter can be supplied to the check request as part of the authorization criteria. For example, a condition could exist that specifies that user:anne has viewer relationship to document:roadmap only if the current time is within 10 minutes of the time access was granted.

Example model:

model
  schema 1.1

type user

type document
  relations
    define viewer: [user with non_expired_grant]

condition non_expired_grant(current_time: timestamp, grant_time: timestamp, grant_duration: duration) {
  current_time < grant_time + grant_duration
}

Write a tuple with a condition:

var body = new ClientWriteRequest()
        .writes(List.of(
                new ClientTupleKey()
                        .user("user:123")
                        .relation("viewer")
                        ._object("document:roadmap")
                        .condition(new ClientRelationshipCondition()
                                .name("non_expired_grant")
                                .context(Map.of("grant_time", "2023-01-01T00:00:00Z","grant_duration", "10m"))
                        )
                        
        ));

var response = fgaClient.write(body, options).get();

Send a check request including the context parameter:

var body = new ClientCheckRequest()
      .user("user:123")
      .relation("viewer")
      ._object("document:1")
      .context(Map.of("current_time", "2023-01-01T00:10:01Z"));

var response = fga.check(body).get();

References

• https://openfga.dev/api/service#/Relationship%20Queries/Check
• https://openfga.dev/docs/modeling/conditions#queries-with-condition-context
• https://openfga.dev/docs/modeling/contextual-time-based-authorization#use-contextual-tuples-for-context-related-checks
• https://openfga.dev/docs/modeling/token-claims-contextual-tuples

Create a simple WebFlux example that demonstrates:

• Configuring an FGA client
• Writing FGA data
• Protecting a method with an FGA check

The OpenFgaClient offers additional configurations than those surfaced in #12 (timeouts, maxRetries, etc). We should catalog these and consider if we should expose them for configuration of the openFgaClient bean.

Before making repository public, add standard FGA issue template

https://github.com/diffplug/spotless/tree/main/plugin-gradle#java

Also can look at Java SDK for example to see how it's set up.

Configure CI to build and publish to publication repositories. Should be similar to https://github.com/openfga/java-sdk

Also look at publishing snapshot versions.

Enable an FGA check to be run pre-method invocation. If the check fails, the method body should not be executed and the result should not be returned to the client.

For initial offering, checks with contextual tuples or context are not to be included.

Create a simple Servlet example that demonstrates:

• Configuring an FGA client
• Writing FGA data
• Protecting a method with an FGA check

Look at FGA Java SDK for setting up jacoco plugin

Create/update README:

• Consistent with FGA repositories
• Documents install/usage

Epic to contain v0 support for FGA with Spring Security.

This work broadly entails:

• Enabling the configuration of an OpenFgaClient bean
• A simple FGA check to be used at least for pre-method invocation security (no contextual tuples or context, or list API support; those will come later)

Tasks:

• #17
• #18
• #15
• #11
• #4
• #5
• #7
• #8
• #1
• #9
• #10
• #2
• #14

Provide a configured OpenFgaClient bean.

The client should be configured via application properties or yaml, or environment variables, per the normal Spring convention, and should have a specific prefix (e.g., openfga.*)