Tuples with Conditions Best Practice

Auth0 Fine-Grained Authorization
1

Curious what might be some best practices around writing tuples with conditions attached to them.

I have an interface that allows someone to write those and optional attach a time-based condition to it. The one small challenge is in this same interface someone has the ability to check, list objects as well. However, the challenge I was trying to work through was how would I handle the ability to look/check tuples when a person does not know if there is an attached time-based constraint?

Should I present them with an “error” and mention that there is a time-based constraint on the tuple, or should I just magically retry with the additional time context and abstract that from them? Or when a tuple is being written that includes a condition, it SHOULD only be written with the condition and never have the ability to optional include the condition?

2

Hi @stephenbawks1

I am sorry about the delayed response to your inquiry regarding the matter.

I believe that the recommended approach for time constrained tuples would be to abstract the context injection from the user. You should not force the user to guess if a time constraint exists, nor should you present them with an error if the system can resolve it automatically.

Instead of a “magic retry,” you should do a “magic inclusion.” If your system supports time-based conditions, your backend service that calls the Auth0 FGA API should automatically inject {"current_time": "<ISO8601-timestamp>"} into the context object of every single Check and ListObjects API call.

You can check more information about timed conditions here.

Kind Regards,
Nik