@samscott89 thanks for you reply.
I can only share basic policy from our project.
We are using async SQLAlchemy && Ltree(PostgreSQL) together

allow (actor, action, resource) if
    has_permission(actor, action, resource);


resource Org {
    permissions = [
        "read",
        "edit",
        "invite",
    ];
    roles = [
        # Role can inherit
        "superuser",
        "agent",
        "manager",

        "member"
    ];

    relations = {
        parent: Org,
    };

    # superuser
    "agent" if "superuser";

    # agent
    "manager" if "agent";

    # manager
    "member" if "manager";
    "invite" if "manager";

    # member
    "read" if "member";

}

has_relation(parent_org: Org, "parent", child_org: Org) if
    parent_org = child_org.parent;


actor User {
}

# Superuser rule
has_role(user: User, "superuser", _org: Org) if
    user.is_superuser = true;

has_role(user: User, role_name: String, org: Org) if
    org_role in user.org_roles and
    org_role.org.id = org.id and
    org_role.role.value = role_name;

OrgIDSeq = Sequence("org_id_seq")

class Org(Base):
    """Org."""

    __tablename__ = "org"

    id: Any = Column(Integer, OrgIDSeq, primary_key=True)
    name = Column(String, nullable=False)
    path = Column(LtreeType, nullable=False)
    is_root = Column(Boolean, default=False)

    types = Column(
        ARRAY(
            ChoiceType(OrgType, impl=String()),
            as_tuple=True,
        ),
    )

    # relationship
    parent = relationship(
        "Org",
        primaryjoin=remote(path) == foreign(func.subpath(path, 0, -1)),
        backref="children",
        viewonly=True,
        lazy="immediate",
    )
    org_roles = relationship(
        "OrgRole",
        back_populates="org",
    )

    __table_args__ = (Index("ix_org_path", path, postgresql_using="gist"),)

UserOrgRole = Table(
    "user_org_role",
    Base.metadata,
    Column("user_id", Integer, ForeignKey("user.id"), primary_key=True),
    Column(
        "org_role_id", Integer, ForeignKey("org_role.id"), primary_key=True
    ),
)


class User(Base):

    __tablename__ = "user"

    id = Column(Integer, primary_key=True)
    name = Column(String)
    email = Column(EmailType)
    password = Column(String(length=128), nullable=False)
    is_active = Column(Boolean, default=False, nullable=False)
    is_verified = Column(Boolean, default=False, nullable=False)
    is_superuser = Column(Boolean, default=False, nullable=False)
    org_roles = relationship(
        "OrgRole",
        secondary=UserOrgRole,
        back_populates="users",
        lazy="immediate",
    )



class OrgRole(Base):

    __tablename__ = "org_role"

    id = Column(Integer, primary_key=True)
    org_id = Column(Integer, ForeignKey("org.id"))
    org = relationship("Org", back_populates="org_roles", lazy="immediate")
    role = Column(ChoiceType(Roles, impl=String()))

    users = relationship(
        "User",
        secondary=UserOrgRole,
        back_populates="org_roles",
    )

Get all roles from resource #1427

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions