YAML validation error in editor

[gyslinn]

We have a test file validating groups and relations.
The test passes with CLI (fga version v0.6.4) but there is an error in the editor that says: "member is not a relation of group". VS Code extension Version 0.2.24.

Group definition
type group relations define member: [user, group#member]

The test:
- user: group:federation_council#member relation: directory_owner object: organization:starfleet
- name: Users that are visible by directory owners of the organization:starfleet realm list_objects: - user: group:federation_council#member # <-- This is where the error is showing!! type: user assertions: can_read_metadata: - user:kirk - user:spock - user:uhura

[rhamzeh]

Can we ask you to post a full yaml file that reproduces the issue @gyslinn?

[gyslinn]

Hi @rhamzeh,

Please find below an extract of the model in question triggering the same error in the editor as previously reported.
Note that the test passes with CLI (fga version v0.6.4), the error is only in the editor.
Nevertheless, I rather not have to learn to ignore errors! 😁

Thank you for the support!

model: |
  model
    schema 1.1

  type user
    relations
      # Defines the visibility of the user
      # Users belong to a system or organization realm;
      # if in a system realm, they can see all users within the same realm, and all users in all organizations.
      # If in an organization realm, they can see all users in that organization.
      define realm: [system, organization]
        # Owners are like admins, with the addition of deletion permission
      define owner: [user, group#member] or directory_owner from realm
      # Admins can manage the user's permissions
      define admin: [user, group#member] or owner
      # Contributors can change user metadata
      define contributor: [user, group#member] or admin
      # Readers can see the user's metadata
      define reader: [user, group#member] or contributor
      # Read the user's name, email, and other metadata
      define can_read_metadata: reader
      # Owners can add and remove admins
      define can_manage_admins: owner
      # Admins can delete the user
      define can_delete_user: admin

  type group
    relations
      # Defines the visibility of the group
      define realm: [system, organization]
      # Members will receive the permissions assigned to the group
      define member: [user, group#member]
      # Owners are like admins, with the addition of deletion permission
      define owner: [user, group#member] or directory_owner from realm
      # Admins can manage the permissions to administer this group
      define admin: [user, group#member] or owner
      # Contributors can manage the group's members or change group metadata
      define contributor: [user, group#member] or admin
      # Readers can see the group's metadata
      define reader: [user, group#member] or member or contributor
      # Read the group name, description, and other metadata
      define can_read_metadata: reader
      # Admins can add and remove members
      define can_manage_members: admin
      # Add owners to the group
      define can_add_owner: owner      
      # Owners can delete the group
      define can_delete_group: owner

  type system

  type organization
    relations      
      define realm: [system, organization] # Defines the visibility of the organization
      define directory_owner: [user, group#member] or directory_owner from realm


tuples:
  - user: group:federation_council#member
    relation: directory_owner
    object: organization:starfleet
  - user: organization:starfleet
    relation: realm
    object: user:kirk
  - user: organization:starfleet
    relation: realm
    object: user:spock    

tests:    
  - name: Users that are visible by directory owners of the organization:starfleet realm
    list_objects:
      - user: group:federation_council#member
        type: user
        assertions:
          can_read_metadata: 
            - user:kirk
            - user:spock

[seandlg]

There seem to be some further issues here. Userset definitions do not seem to be fully supported in check and list-objects tests, see this very simple reference store (all tests pass with OpenFGA CLI v0.6.6):

name: Model Playground
model: |
  model
    schema 1.2

  type user

  type team
    relations
      define member: [user, team#member]


tuples:
  - user: user:alice
    relation: member
    object: team:devs
  - user: team:devs#member
    relation: member
    object: team:ops
tests:
  - name: Alice is a member of team:ops # OK, test passes
    check:
      - user: user:alice
        object: team:ops
        assertions:
          member: true

  - name: Devs member are members of team:ops # OpenFGAYamlValidationError, but test passes
    check:
      - user: team:devs#member # ERROR: tests.1.check.0.user `member` is not a relation on `team:devs`, and does not exist in model.OpenFGAYamlValidationError
        object: team:ops
        assertions:
          member: true

  - name: List teams of Alice # OK, test passes
    list_objects:
      - user: user:alice
        type: team
        assertions:
          member:
            - team:ops
            - team:devs

  # fga query list-objects team:devs#member member team
  - name: List teams of Devs # OpenFGAYamlValidationError, but test passes
    list_objects:
      - user: team:devs#member # ERROR: tests.3.list_objects.0.user `member` is not a relation on `team:devs`, and does not exist in model.OpenFGAYamlValidationError
        type: team
        assertions:
          member:
            - team:ops
            - team:devs

  # fga query list-users --object team:ops --user-filter=team#member --relation=member
  - name: List users of team:ops # OK
    list_users:
      - object: team:ops
        user_filter:
          - type: user
        assertions:
          member:
            users:
              - user:alice

  - name: List teams of team:ops # OK
    list_users:
      - object: team:ops
        user_filter:
          - type: team
            relation: member
        assertions:
          member:
            users: # WARNING: team:ops#member does not match any existing tuples; the check is still valid - but double check to ensure this is intended.OpenFGAYamlValidationError
              - team:ops#member
              - team:devs#member