테넌트 소유자, 관리자 분리

docker/ory/keto/namespaces.ts

@@ -5,7 +5,7 @@ class User implements Namespace {}
 class Tenant implements Namespace {
   related: {
     owners: User[]
-    admins: (User | SubjectSet<Tenant, "owners">)[]
+    admins: User[]
     members: User[]
     parents: Tenant[]
   }
@@ -14,12 +14,18 @@ class Tenant implements Namespace {
     view: (ctx: Context): boolean =>
       this.related.members.includes(ctx.subject) ||
       this.related.admins.includes(ctx.subject) ||
+      this.related.owners.includes(ctx.subject) ||
       this.related.parents.traverse((p) => p.permits.view(ctx)),
 
     manage: (ctx: Context): boolean =>
       this.related.admins.includes(ctx.subject) ||
+      this.related.owners.includes(ctx.subject) ||
       this.related.parents.traverse((p) => p.permits.manage(ctx)),
-      
+
+    manage_admins: (ctx: Context): boolean =>
+      this.related.owners.includes(ctx.subject) ||
+      this.related.parents.traverse((p) => p.permits.manage_admins(ctx)),
+
     create_subtenant: (ctx: Context): boolean =>
       this.permits.manage(ctx)
   }