From 9dc7d100c06a12176aa0793a2803d9f8982ec6e0 Mon Sep 17 00:00:00 2001 From: Prabodh Chaudhari Date: Sat, 5 Sep 2026 21:26:33 +0530 Subject: [PATCH] feat(openfga): cascade writer relation across b2b_org parent/child hierarchy writer now includes "writer from parent or writer from child" alongside the existing direct/owner/global_org_admin grants, mirroring the auditor relation's existing bidirectional traversal. An editor on any organization in a connected parent-child-sibling group becomes an editor on every member of that group. Bumps the model to v14.3.1 and documents the new inheritance in PERMISSIONS.md. Verified against a local OpenFGA instance: writer access on one org in a three-level test hierarchy correctly cascaded to parent, sibling, and grandchild orgs, with no effect on unrelated orgs. Jira: LFXV2-3029 Link: https://linuxfoundation.atlassian.net/browse/LFXV2-3029 Signed-off-by: Prabodh Chaudhari Co-authored-by: Cursor --- PERMISSIONS.md | 1 + charts/lfx-platform/files/model.fga | 8 +++++--- charts/lfx-platform/templates/openfga/model.yaml | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/PERMISSIONS.md b/PERMISSIONS.md index 221c5a0..3fb6d6f 100644 --- a/PERMISSIONS.md +++ b/PERMISSIONS.md @@ -216,6 +216,7 @@ grant assignment. #### Permission Inheritance +- **Writer**: inherited from parent B2B Organization, child B2B Organization - **Auditor**: inherited from parent B2B Organization, child B2B Organization, Project Membership Key Contact --- diff --git a/charts/lfx-platform/files/model.fga b/charts/lfx-platform/files/model.fga index 0d441dc..dc520ea 100644 --- a/charts/lfx-platform/files/model.fga +++ b/charts/lfx-platform/files/model.fga @@ -353,9 +353,11 @@ type b2b_org define owner: [user] # @fgadoc:jtbd Update org details & access settings # @fgadoc:jtbd Manage membership committee seat assignments - define writer: [user] or owner or global_org_admin - # auditor cascades transitively up and down the hierarchy via parent/child. - # writer does NOT cascade — edit scope stays on the directly-assigned org only. + define writer: [user] or owner or global_org_admin or writer from parent or writer from child + # writer and auditor both cascade transitively up and down the hierarchy via + # parent/child (LFXV2-3029) — an editor on any organization in a connected + # parent-child-sibling group is an editor on every member of that group, + # matching the auditor traversal below. # @fgadoc:jtbd View org details, settings & committee seats # @fgadoc:jtbd View org workspaces & workspace projects define auditor: [user, team#member] or writer or auditor from parent or auditor from child or key_contact from membership diff --git a/charts/lfx-platform/templates/openfga/model.yaml b/charts/lfx-platform/templates/openfga/model.yaml index 4cb78fa..7a6d7e1 100644 --- a/charts/lfx-platform/templates/openfga/model.yaml +++ b/charts/lfx-platform/templates/openfga/model.yaml @@ -28,7 +28,7 @@ spec: - version: major: 14 minor: 3 - patch: 0 + patch: 1 authorizationModel: | {{ .Files.Get "files/model.fga" | indent 8 }} {{- end }}