fix(keto-client-wrapper): ensure complex nested conditions are correctly evaluated when using batch checks

packages/keto-client-wrapper/test/app.controller.mock.ts

@@ -101,6 +101,61 @@ export class ExampleController {
     return this.exampleService.getExample();
   }
 
+  @OryPermissionChecks({
+    type: 'OR',
+    conditions: [
+      {
+        type: 'AND',
+        conditions: [
+          (ctx) => {
+            const req = ctx.switchToHttp().getRequest();
+            const currentUserId = req.headers['x-current-user-id'] as string;
+            const resourceId = req.params.id;
+            return new RelationTupleBuilder()
+              .subject('User', currentUserId)
+              .isAllowedTo('play')
+              .of('Toy', resourceId)
+              .toString();
+          },
+          (ctx) => {
+            const req = ctx.switchToHttp().getRequest();
+            const currentUserId = req.headers['x-current-user-id'] as string;
+            const resourceId = req.params.id;
+            return new RelationTupleBuilder()
+              .subject('User', currentUserId)
+              .isAllowedTo('break')
+              .of('Toy', resourceId)
+              .toString();
+          },
+        ],
+      },
+      (ctx) => {
+        const req = ctx.switchToHttp().getRequest();
+        const currentUserId = req.headers['x-current-user-id'] as string;
+        return new RelationTupleBuilder()
+          .subject('User', currentUserId)
+          .isIn('members')
+          .of('Group', 'admin')
+          .toString();
+      },
+      (ctx) => {
+        const req = ctx.switchToHttp().getRequest();
+        const currentUserId = req.headers['x-current-user-id'] as string;
+        return new RelationTupleBuilder()
+          .subject('User', currentUserId)
+          .isIn('members')
+          .of('Group', 'superadmin')
+          .toString();
+      },
+    ],
+  })
+  @UseGuards(AuthorizationGuard())
+  @Get('complex2/:id')
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  getExampleComplex2(@Param('id') id?: string) {
+    return this.exampleService.getExample();
+  }
+
   @OryPermissionChecks((ctx) => {
     const req = ctx.switchToHttp().getRequest();
     const currentUserId = req.headers['x-current-user-id'] as string;

packages/keto-client-wrapper/test/keto-client-wrapper.spec.ts

@@ -26,11 +26,11 @@ describe('Keto client wrapper E2E', () => {
   const createOryRelation = async (relationTuple: RelationTupleBuilder) => {
     await oryRelationshipsService.createRelationship({
       createRelationshipBody: createRelationQuery(
-        relationTuple.toJSON()
+        relationTuple.toJSON(),
       ).unwrapOrThrow(),
     });
     const { data } = await oryPermissionService.checkPermission(
-      createPermissionCheckQuery(relationTuple.toJSON()).unwrapOrThrow()
+      createPermissionCheckQuery(relationTuple.toJSON()).unwrapOrThrow(),
     );
     expect(data.allowed).toEqual(true);
   };
@@ -151,6 +151,22 @@ describe('Keto client wrapper E2E', () => {
     });
   });
 
+  describe('GET /Example/complex2/:id', () => {
+    it('should pass authorization when relations exist in Ory Keto', async () => {
+      const object = 'bike';
+      const subjectObject = 'Renata';
+      await createAdminRelation(subjectObject);
+      await createPuppetmasterRelation(object);
+
+      const { body } = await request(app.getHttpServer())
+        .get(`/Example/complex2/${object}`)
+        .set({
+          'x-current-user-id': subjectObject,
+        });
+      expect(body).toEqual({ message: 'OK' });
+    });
+  });
+
   describe('GET /Example/play/:id', () => {
     it('should fail authorization when relations does not exist in Ory Keto as owner or puppetmaster', async () => {
       const object = 'truck';

packages/keto-client-wrapper/test/namespaces.ts

@@ -25,7 +25,12 @@ class Toy implements Namespace {
     play: (ctx: Context) =>
       this.related.owners.includes(ctx.subject) ||
       this.related.puppetmasters.includes(ctx.subject),
-    break: (ctx: Context) => this.permits.play(ctx),
-    steal: (ctx: Context) => !this.permits.play(ctx),
+    // can't use this.permits.play(ctx) anymore when using batched permission checks, why?
+    break: (ctx: Context) =>
+      this.related.owners.includes(ctx.subject) ||
+      this.related.puppetmasters.includes(ctx.subject),
+    steal: (ctx: Context) =>
+      !this.related.owners.includes(ctx.subject) &&
+      !this.related.puppetmasters.includes(ctx.subject),
   };
 }