OpenFGA: alternativa Auth0/Okta para Zanzibar

model
  schema 1.1

type user

type organization
  relations
    define admin: [user]
    define member: [user]
    define can_view: admin or member

type folder
  relations
    define parent: [folder, organization]
    define owner: [user]
    define editor: [user]
    define viewer: [user]
    define can_edit: owner or editor or parent.can_edit
    define can_view: viewer or can_edit or parent.can_view

type document
  relations
    define parent: [folder]
    define owner: [user]
    define editor: [user]
    define viewer: [user]
    define can_edit: owner or editor or parent.can_edit
    define can_view: viewer or can_edit or parent.can_view

import { OpenFgaClient, CredentialsMethod } from '@openfga/sdk';

const fga = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL!,
  storeId: process.env.FGA_STORE_ID!,
  authorizationModelId: process.env.FGA_MODEL_ID!,
  credentials: {
    method: CredentialsMethod.ClientCredentials,
    config: {
      clientId: process.env.FGA_CLIENT_ID!,
      clientSecret: process.env.FGA_CLIENT_SECRET!,
      apiTokenIssuer: 'auth.fga.dev',
      apiAudience: 'https://api.us1.fga.dev/',
    },
  },
});

// 1. Compartilhar doc com Bob como editor
await fga.write({
  writes: [
    { user: 'user:bob', relation: 'editor', object: 'document:report-q1' },
  ],
});

// 2. Checar permissão de Bob no doc
const { allowed } = await fga.check({
  user: 'user:bob',
  relation: 'can_view',
  object: 'document:report-q1',
});

if (!allowed) throw new ForbiddenError();

// 3. Listar documents que Bob pode visualizar
const { objects } = await fga.listObjects({
  user: 'user:bob',
  relation: 'can_view',
  type: 'document',
});
// → ['document:report-q1', 'document:notes', ...]

model
  schema 1.1

type user

type document
  relations
    define viewer: [user, user with non_expired_grant]
    define can_view: viewer

condition non_expired_grant(current_time: timestamp, grant_expires_at: timestamp) {
  current_time < grant_expires_at
}

// Adicionar viewer COM condição
await fga.write({
  writes: [{
    user: 'user:guest',
    relation: 'viewer',
    object: 'document:demo',
    condition: {
      name: 'non_expired_grant',
      context: { grant_expires_at: '2026-12-31T23:59:59Z' },
    },
  }],
});

// Check passando o contexto runtime
await fga.check({
  user: 'user:guest',
  relation: 'can_view',
  object: 'document:demo',
  context: { current_time: new Date().toISOString() },
});

// Path crítico (após write de revogação) — força consistência
const result = await fga.check({
  user: 'user:bob',
  relation: 'can_view',
  object: 'document:sensitive',
  consistency: 'HIGHER_CONSISTENCY',
});

# Docker — desenvolvimento
docker run -p 8080:8080 -p 8081:8081 -p 3000:3000 \
  openfga/openfga:latest run

# Postgres backend — produção
docker run -e OPENFGA_DATASTORE_ENGINE=postgres \
  -e OPENFGA_DATASTORE_URI=postgres://user:pass@host/openfga \
  -p 8080:8080 -p 8081:8081 \
  openfga/openfga:latest run

# Health
curl http://localhost:8080/healthz
# → {"status":"SERVING"}

# CLI
fga store create --name "saas-prod"
fga model write --store-id 01H... --file model.fga