feat: 테넌트 그룹 기반 권한 상속 고도화 및 개발자 포털 보안 강화 #239

backend/internal/service/keto_service.go

@@ -18,6 +18,7 @@ type KetoService interface {
 	CreateRelation(ctx context.Context, namespace, object, relation, subject string) error
 	DeleteRelation(ctx context.Context, namespace, object, relation, subject string) error
 	ListRelations(ctx context.Context, namespace, object, relation, subject string) ([]RelationTuple, error)
+	ListObjects(ctx context.Context, namespace, relation, subject string) ([]string, error)
 }
 
 type ketoService struct {
@@ -192,3 +193,40 @@ func (s *ketoService) DeleteRelation(ctx context.Context, namespace, object, rel
 	slog.Info("Keto relation deleted", "namespace", namespace, "object", object, "relation", relation, "subject", subject)
 	return nil
 }
+
+func (s *ketoService) ListObjects(ctx context.Context, namespace, relation, subject string) ([]string, error) {
+	u, _ := url.Parse(fmt.Sprintf("%s/relation-tuples", s.readURL))
+	q := u.Query()
+	q.Set("namespace", namespace)
+	q.Set("relation", relation)
+	q.Set("subject_id", subject)
+	u.RawQuery = q.Encode()
+
+	req, _ := http.NewRequestWithContext(ctx, "GET", u.String(), nil)
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("keto returned status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var res relationTuplesResponse
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return nil, err
+	}
+
+	objects := make([]string, 0, len(res.RelationTuples))
+	seen := make(map[string]bool)
+	for _, rt := range res.RelationTuples {
+		if !seen[rt.Object] {
+			objects = append(objects, rt.Object)
+			seen[rt.Object] = true
+		}
+	}
+
+	return objects, nil
+}