[BUG] Entity lookup does not take in consideration recursive permissions if the permission is based on attributes

[mezakos]

Describe the bug
Entity lookup does not take in consideration recursive permissions if the permission is based on attributes

To Reproduce
Use the following data:

schema: |-
  entity user {}

  entity resource {
      relation parent @resource
      relation creator @user

      attribute is_public boolean

      permission view = is_public or parent.view
  }
relationships:
  - resource:r1#parent@resource:default
  - resource:r1#creator@user:u1
attributes:
  - resource:default$is_public|boolean:true

Call:

curl --request POST \
  --url http://localhost:3476/v1/tenants/t1/permissions/lookup-entity \
  --header 'content-type: application/json' \
  --data '{
  "metadata":{
    "snap_token": "",
    "schema_version": "",
    "depth": 20
  },
  "entity_type": "resource",
  "permission": "view",
  "subject": {
    "type":"user",
    "id":"u1"
  },
  "page_size": 20,
  "continuous_token": ""
}'

Expected behavior
Returned entity ids should be be ["default", "r1"]
Actual: ["default"]

Environment (please complete the following information, because it helps us investigate better):

• docker
• Version 1.6.2

[omer-topal]

Hello @mezakos , I can reproduce this. LookupEntity misses recursive permissions when the recursion depends on attributes.
For now, please use direct Check calls or avoid attribute-based recursion in the model. We aren't prioritizing a fix immediately, but we will keep this open for future review.

[mezakos]

Hi @omer-topal ,
Thanks for the response. I further analyzed this and I came to the conclusion that if an attribute is not explicitly written, the EntityLookup will leave it out from the results. If permission check is issued for the entity, it will evaluate correctly. This is also true for recursive permissions

Example:

entity user {}

entity resource {
    relation owner @user
    attribute is_private boolean

    permission view = negate(is_private)
}

rule negate(is_private boolean){
    !is_private
}

resource:r1#owner@user:u1

EntityLookup will result in no data.

Add: resource:r1$is_private|boolean:false

EntityLookup returns ["r1"]

[mooreds]

thanks for sharing the workaround, @mezakos !