docs: rewrite multitenant rbac example with OPL#2545
docs: rewrite multitenant rbac example with OPL#2545DavudSafarli wants to merge 2 commits intomasterfrom
Conversation
DavudSafarli
requested review from
aeneasr,
piotrmsc,
unatasha8,
vinckr and
zepatrik
as code owners
There was a problem hiding this comment.
Pull request overview
This PR updates the Ory Keto RBAC documentation and associated syntax highlighting to reflect an OPL-based, multi-tenant-friendly modeling approach instead of the older RBAC example.
Changes:
- Rewrites the RBAC guide to demonstrate tenant-scoped RBAC modeling in OPL, including role management flows.
- Extends the
keto-naturalPrism grammar to support dotted permission names (e.g.users.list,reports.view) and the optionalperformkeyword. - Updates Jest Prism tokenization tests and snapshots to cover the new grammar behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| tests/jest/prism/ketoRelationsPermissionsPrism.test.ts | Adds a new declarative test case for dotted permission names in keto-natural. |
| tests/jest/prism/snapshots/ketoRelationsPermissionsPrism.test.ts.snap | Refreshes snapshots to match the updated tokenizer behavior and new test case. |
| src/theme/ketoRelationsPermissionsPrism.js | Updates regexes/tokenization rules to accept dotted relations/permits and perform. |
| docs/keto/guides/rbac.mdx | Replaces the RBAC guide content with an OPL-based, multi-tenant RBAC example and guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Admin role permissions | ||
| Organization:org_123#members.invite@Role:admin | ||
| Organization:org_123#roles.manage@Role:admin | ||
| Organization:org_123#reports.view@Role:admin | ||
| Organization:org_123#reports.create@Role:admin |
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR extends the keto-natural Prism grammar to recognize additional sentence forms, including "allowed to" and "perform" phrases, with refined lookahead-based placeholder matching and adjusted keyword/permit token ordering. Two new test cases validate these expanded patterns. ChangesGrammar and Test Expansion for "Allowed To" Constructs
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
tests/jest/prism/ketoRelationsPermissionsPrism.test.ts (1)
59-72: ⚡ Quick winAdd a question-form test for
performand dotted actions.
natural-check(lines 106 / 130 / 132 insrc/theme/ketoRelationsPermissionsPrism.js) was updated to accept(?:perform )?and dotted permits, butquestionTestCasesdoesn't exercise either path. Without a snapshot here, regressions in the question grammar'sperform/ dotted-action handling will go undetected.🧪 Suggested additional test cases
const questionTestCases = [ { name: "simple question: is User:Bob allowed to view on Document:X", input: "is User:Bob allowed to view on Document:X", }, { name: "question with 'in': is User:Alice in viewers of Document:X", input: "is User:Alice in viewers of Document:X", }, { name: "question with relation subject: are members of Group:XYZ allowed to view on Document:X", input: "are members of Group:XYZ allowed to view on Document:X", }, + { + name: "question with 'perform' and dotted action: is User:Bob allowed to perform users.list on Document:X", + input: "is User:Bob allowed to perform users.list on Document:X", + }, ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/jest/prism/ketoRelationsPermissionsPrism.test.ts` around lines 59 - 72, The questionTestCases array doesn't include cases exercising the new "perform" optional token and dotted actions; add at least two new test entries to questionTestCases: one with "perform" (e.g., input "is User:Bob allowed to perform view on Document:X") and one using a dotted action/permission (e.g., input "is User:Bob allowed to view.read on Document:X" or similar dotted permit form) so the grammar branch in natural-check (the updated rule accepting (?:perform )? and dotted permits) is exercised by the test suite; update the questionTestCases array by adding objects with descriptive name fields and the specified input strings.src/theme/ketoRelationsPermissionsPrism.js (1)
4-19: 💤 Low valueUpdate the grammar JSDoc to cover the new sentence forms.
The header docblock still only describes the original declarative/question forms. The grammar now also accepts:
<Subject> is allowed to <action> (to|on|of) <Object>(e.g.,User:Bob is allowed to access to Document:X)<Subject> is allowed to perform <action> <Object>- Dotted actions (e.g.,
users.list)Adding a couple of example lines here will keep the file self-documenting and match what the regex on lines 74/106 actually parses.
📝 Proposed doc additions
* Declarative sentences: * - User:Bob is owner of Document:X * - Group:group2 is in members of Group:group1 * - members of Group:Eng are viewers of Document:Xyz * - viewers of Group:Eng are in readers of Document:Xyz * - User:Bob is allowed to read Document:X * - members of Group:Eng is allowed to read Document:X + * - User:Bob is allowed to access to Document:X + * - User:Bob is allowed to perform users.list on Document:X * * Question sentences: * - is User:Bob allowed to view on Document:X * - is User:Alice in viewers of Document:X * - are members of Group:XYZ allowed to view on Document:X + * - is User:Bob allowed to perform users.list on Document:X🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/theme/ketoRelationsPermissionsPrism.js` around lines 4 - 19, Update the top JSDoc in src/theme/ketoRelationsPermissionsPrism.js to document the new sentence patterns parsed by the grammar: add examples for "<Subject> is allowed to <action> (to|on|of) <Object>" (e.g., "User:Bob is allowed to access to Document:X"), "<Subject> is allowed to perform <action> <Object>" (e.g., "Group:admins is allowed to perform users.list Document:Y"), and show dotted actions like "users.list" to reflect what the regexes used in the grammar (the patterns around the action parsing referenced near the action-related regexes) actually accept; include a couple representative example lines in the header so the docblock matches the parser behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/theme/ketoRelationsPermissionsPrism.js`:
- Around line 4-19: Update the top JSDoc in
src/theme/ketoRelationsPermissionsPrism.js to document the new sentence patterns
parsed by the grammar: add examples for "<Subject> is allowed to <action>
(to|on|of) <Object>" (e.g., "User:Bob is allowed to access to Document:X"),
"<Subject> is allowed to perform <action> <Object>" (e.g., "Group:admins is
allowed to perform users.list Document:Y"), and show dotted actions like
"users.list" to reflect what the regexes used in the grammar (the patterns
around the action parsing referenced near the action-related regexes) actually
accept; include a couple representative example lines in the header so the
docblock matches the parser behavior.
In `@tests/jest/prism/ketoRelationsPermissionsPrism.test.ts`:
- Around line 59-72: The questionTestCases array doesn't include cases
exercising the new "perform" optional token and dotted actions; add at least two
new test entries to questionTestCases: one with "perform" (e.g., input "is
User:Bob allowed to perform view on Document:X") and one using a dotted
action/permission (e.g., input "is User:Bob allowed to view.read on Document:X"
or similar dotted permit form) so the grammar branch in natural-check (the
updated rule accepting (?:perform )? and dotted permits) is exercised by the
test suite; update the questionTestCases array by adding objects with
descriptive name fields and the specified input strings.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 795dbdb8-3d6c-4bd6-a333-bf4572b2c48a
⛔ Files ignored due to path filters (2)
docs/keto/guides/rbac.mdxis excluded by!**/*.mdxtests/jest/prism/__snapshots__/ketoRelationsPermissionsPrism.test.ts.snapis excluded by!**/*.snap
📒 Files selected for processing (2)
src/theme/ketoRelationsPermissionsPrism.jstests/jest/prism/ketoRelationsPermissionsPrism.test.ts
DavudSafarli
force-pushed
the
keto-d-update-rbac-example
branch
from
c405eed to
539a7e1
Compare
zepatrik
left a comment
zepatrik
left a comment
There was a problem hiding this comment.
Very good starting point! Two general improvement ideas:
- I first had concerns because the last section on multi-tenancy is quite important and it wasn't obvious at first. Maybe it needs to be more prominent? Or the examples above should not look like a multi-tenant system as much?
- I think we should consistently use the
Sub is rel of objnotion.
vinckr
left a comment
vinckr
left a comment
There was a problem hiding this comment.
some style fixes:
- Always use Ory Keto, not Keto by itself
- Active voice in headlines, so for example
Create a new organizationinstead ofCreating a new organization - Remove numbering in the headlines so
Create a custom roleinstead of3. Creating a custom role
for some reason I couldn't comment on the individual sections of the text, but I hope this is clear.
stoked to see this merged 🚢
Replaces the outdated keto RBAC example
Summary by CodeRabbit