If I want use Permissions (i.e. keto on Ory Cloud/Network), I get that I can define the permission model there, and I can integrate the permission check for an API endpoint, but what I don't get is how keto can know, for example, which `userId`is what in the permission model. Using the below example from the docs, let's say we have the following:

import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types"

class User implements Namespace {
  related: {
    manager: User[]
  }
}

class Group implements Namespace {
  related: {
    members: (User | Group)[]
  }
}

class Folder implements Namespace {
  related: {
    parents: (File | Folder)[]
    viewers: SubjectSet<Group, "members">[]
  }

  permits = {
    view: (ctx: Context): boolean =>
      this.related.viewers.includes(ctx.subject) ||
      this.related.parents.traverse((p) => p.permits.view(ctx)),
  }
}

class File implements Namespace {
  related: {
    parents: (File | Folder)[]
    viewers: (User | SubjectSet<Group, "members">)[]
    owners: (User | SubjectSet<Group, "members">)[]
  }

  // Some comment
  permits = {
    view: (ctx: Context): boolean =>
      this.related.parents.traverse((p) => p.permits.view(ctx)) ||
      this.related.viewers.includes(ctx.subject) ||
      this.related.owners.includes(ctx.subject),

    edit: (ctx: Context) => this.related.owners.includes(ctx.subject),
  }
}

Our

userId

would be stored in our app database, so would we also store in our database whether that

userId

is a part of

viewers

of a particular

File

? Like I get that we can define a permission model, but I don't get how we connect or map this with user ids and resources (e.g.

File

or

Folder

) in our app database tables. I can't seem to find any good examples of how to do this. Thanks for helping this noob 😄

Hi @hundreds-match-36539 Thank you for reaching out 🙂 The documentation doesn't explicitly say which API is required when. We definitely need to improve on this! To answer your question, you will still need to insert the userId and their relationship to the object (objectId) into Keto. You can do this by calling the write API that Keto provides from your backend service. https://www.ory.sh/docs/keto/concepts/api-overview#write-apis You can follow the quickstart to get a grasp on how this works. https://www.ory.sh/docs/guides/permissions/overview

So the mapping of a permission relationship between a

userId

and

File

isn't in fact stored in our app database at all, it's basically the "Relationships" feature of Ory-Network as the database for this... yes?

Yes, the relationships are all handled by Keto. So if you wanted to check if userId has access to File you just call the check API with the two UUIDs. You still need to keeping track of the ids in your database though

I see. Makes sense. Thank you. Now I have to think how to best implement this...