feat(openfga): cascade writer relation across b2b_org parent/child hierarchy

[prabodhcs]

Summary

The writer relation on b2b_org now cascades transitively up and down the parent/child hierarchy, mirroring the existing auditor traversal. Part of LFXV2-3029.

Change

- define writer: [user] or owner or global_org_admin
+ define writer: [user] or owner or global_org_admin or writer from parent or writer from child

An editor on any organization in a connected parent-child-sibling group becomes an editor on every member of that group. Model bumped to v14.3.1; PERMISSIONS.md regenerated to document the new inheritance.

Verification

Verified against a local OpenFGA instance: writer access on one org in a three-level test hierarchy correctly cascaded to parent, sibling, and grandchild orgs, with no effect on unrelated orgs. No indexer/publisher changes are required — member-service already publishes both parent and child tuples today (needed for the existing auditor cascade).

Related

Consumed by the BFF-side change in lfx-self-serve#2216.

Jira: LFXV2-3029
Link: https://linuxfoundation.atlassian.net/browse/LFXV2-3029

Status

Draft — coordinating merge order with lfx-self-serve#2216 and pending remaining e2e coverage there.

Made with Cursor

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Extends B2B organization writer access transitively across parent-child hierarchies.

Changes:

• Adds bidirectional writer inheritance.
• Bumps the OpenFGA model to v14.3.1.
• Regenerates permissions documentation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
PERMISSIONS.md	Documents writer inheritance.
charts/lfx-platform/templates/openfga/model.yaml	Bumps the model version.
charts/lfx-platform/files/model.fga	Adds parent/child writer traversal.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.