kevin/baron-sso
1
0
Fork 0
forked from baron/baron-sso
Code Pull Requests Activity

fix: Keto 연결 설정 오류 수정 및 ReBAC 권한 상속 정책 추가 #239

Browse Source
This commit is contained in:
조찬영
2026-02-11 10:58:10 +09:00
parent 4ef7ab78e2
commit 10aa6f837f
4 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docker/ory/keto/namespaces.ts
View File

@@ -2,6 +2,12 @@ import { Namespace, Subject, Context, SubjectSet } from "@ory/keto-definitions"
class User implements Namespace {}
class TenantGroup implements Namespace {
related: {
admins: User[]
}
}
class UserGroup implements Namespace {
related: {
members: User[]
@@ -19,17 +25,20 @@ class Tenant implements Namespace {
admins: User[]
members: User[]
parent: Tenant[]
parent_group: TenantGroup[]
}
permits = {
view: (ctx: Context): boolean =>
this.related.members.includes(ctx.subject) ||
this.related.admins.includes(ctx.subject) ||
this.related.parent.traverse((p) => p.permits.view(ctx)),
this.related.parent.traverse((p) => p.permits.view(ctx)) ||
this.related.parent_group.traverse((g) => g.related.admins.includes(ctx.subject)),
manage: (ctx: Context): boolean =>
this.related.admins.includes(ctx.subject) ||
this.related.parent.traverse((p) => p.permits.manage(ctx)),
this.related.parent.traverse((p) => p.permits.manage(ctx)) ||
this.related.parent_group.traverse((g) => g.related.admins.includes(ctx.subject)),
create_subtenant: (ctx: Context): boolean =>
this.permits.manage(ctx)