feat(authz): address tenant isolation for authz (#9293)

* feat(authz): address tenant isolation for authz

* feat(authz): handle role module self registry

* feat(authz): keep role / user / resource sync in naming

* feat(authz): rename orgId to orgID

* feat(authz): add the missing / for user

* feat(authz): remove embedding for pkgopenfgaauthz service

ee/authz/openfgaauthz/provider.go

@@ -0,0 +1,79 @@
+package openfgaauthz
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/authz"
+	pkgopenfgaauthz "github.com/SigNoz/signoz/pkg/authz/openfgaauthz"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+	openfgapkgtransformer "github.com/openfga/language/pkg/go/transformer"
+)
+
+type provider struct {
+	pkgAuthzService authz.AuthZ
+}
+
+func NewProviderFactory(sqlstore sqlstore.SQLStore, openfgaSchema []openfgapkgtransformer.ModuleFile) factory.ProviderFactory[authz.AuthZ, authz.Config] {
+	return factory.NewProviderFactory(factory.MustNewName("openfga"), func(ctx context.Context, ps factory.ProviderSettings, config authz.Config) (authz.AuthZ, error) {
+		return newOpenfgaProvider(ctx, ps, config, sqlstore, openfgaSchema)
+	})
+}
+
+func newOpenfgaProvider(ctx context.Context, settings factory.ProviderSettings, config authz.Config, sqlstore sqlstore.SQLStore, openfgaSchema []openfgapkgtransformer.ModuleFile) (authz.AuthZ, error) {
+	pkgOpenfgaAuthzProvider := pkgopenfgaauthz.NewProviderFactory(sqlstore, openfgaSchema)
+	pkgAuthzService, err := pkgOpenfgaAuthzProvider.New(ctx, settings, config)
+	if err != nil {
+		return nil, err
+	}
+
+	return &provider{
+		pkgAuthzService: pkgAuthzService,
+	}, nil
+}
+
+func (provider *provider) Start(ctx context.Context) error {
+	return provider.pkgAuthzService.Start(ctx)
+}
+
+func (provider *provider) Stop(ctx context.Context) error {
+	return provider.pkgAuthzService.Stop(ctx)
+}
+
+func (provider *provider) Check(ctx context.Context, tuple *openfgav1.TupleKey) error {
+	return provider.pkgAuthzService.Check(ctx, tuple)
+}
+
+func (provider *provider) CheckWithTupleCreation(ctx context.Context, claims authtypes.Claims, orgID valuer.UUID, relation authtypes.Relation, _ authtypes.Relation, typeable authtypes.Typeable, selectors []authtypes.Selector) error {
+	subject, err := authtypes.NewSubject(authtypes.TypeUser, claims.UserID, authtypes.Relation{})
+	if err != nil {
+		return err
+	}
+
+	tuples, err := typeable.Tuples(subject, relation, selectors, orgID)
+	if err != nil {
+		return err
+	}
+
+	err = provider.BatchCheck(ctx, tuples)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (provider *provider) BatchCheck(ctx context.Context, tuples []*openfgav1.TupleKey) error {
+	return provider.pkgAuthzService.BatchCheck(ctx, tuples)
+}
+
+func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, typeable authtypes.Typeable) ([]*authtypes.Object, error) {
+	return provider.pkgAuthzService.ListObjects(ctx, subject, relation, typeable)
+}
+
+func (provider *provider) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
+	return provider.pkgAuthzService.Write(ctx, additions, deletions)
+}

ee/http/middleware/authz.go

@@ -1,132 +0,0 @@
-package middleware
-
-import (
-	"log/slog"
-	"net/http"
-
-	"github.com/SigNoz/signoz/pkg/authz"
-	"github.com/SigNoz/signoz/pkg/http/render"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/gorilla/mux"
-)
-
-const (
-	authzDeniedMessage string = "::AUTHZ-DENIED::"
-)
-
-type AuthZ struct {
-	logger       *slog.Logger
-	authzService authz.AuthZ
-}
-
-func NewAuthZ(logger *slog.Logger) *AuthZ {
-	if logger == nil {
-		panic("cannot build authz middleware, logger is empty")
-	}
-
-	return &AuthZ{logger: logger}
-}
-
-func (middleware *AuthZ) ViewAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		if err := claims.IsViewer(); err != nil {
-			middleware.logger.WarnContext(req.Context(), authzDeniedMessage, "claims", claims)
-			render.Error(rw, err)
-			return
-		}
-
-		next(rw, req)
-	})
-}
-
-func (middleware *AuthZ) EditAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		if err := claims.IsEditor(); err != nil {
-			middleware.logger.WarnContext(req.Context(), authzDeniedMessage, "claims", claims)
-			render.Error(rw, err)
-			return
-		}
-
-		next(rw, req)
-	})
-}
-
-func (middleware *AuthZ) AdminAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		if err := claims.IsAdmin(); err != nil {
-			middleware.logger.WarnContext(req.Context(), authzDeniedMessage, "claims", claims)
-			render.Error(rw, err)
-			return
-		}
-
-		next(rw, req)
-	})
-}
-
-func (middleware *AuthZ) SelfAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		id := mux.Vars(req)["id"]
-		if err := claims.IsSelfAccess(id); err != nil {
-			middleware.logger.WarnContext(req.Context(), authzDeniedMessage, "claims", claims)
-			render.Error(rw, err)
-			return
-		}
-
-		next(rw, req)
-	})
-}
-
-func (middleware *AuthZ) OpenAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		next(rw, req)
-	})
-}
-
-// Check middleware accepts the relation, typeable, parentTypeable (for direct access + group relations) and a callback function to derive selector and parentSelectors on per request basis.
-func (middleware *AuthZ) Check(next http.HandlerFunc, relation authtypes.Relation, translation authtypes.Relation, typeable authtypes.Typeable, cb authtypes.SelectorCallbackFn) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		selector, err := cb(req.Context(), claims)
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		err = middleware.authzService.CheckWithTupleCreation(req.Context(), claims, relation, typeable, selector)
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		next(rw, req)
-	})
-}

pkg/authz/authz.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -15,11 +16,14 @@ type AuthZ interface {
 	Check(context.Context, *openfgav1.TupleKey) error
 
 	// CheckWithTupleCreation takes upon the responsibility for generating the tuples alongside everything Check does.
-	CheckWithTupleCreation(context.Context, authtypes.Claims, authtypes.Relation, authtypes.Typeable, []authtypes.Selector) error
+	CheckWithTupleCreation(context.Context, authtypes.Claims, valuer.UUID, authtypes.Relation, authtypes.Relation, authtypes.Typeable, []authtypes.Selector) error
 
-	// writes the tuples to upstream server
-	Write(context.Context, *openfgav1.WriteRequest) error
+	// Batch Check returns error when the upstream authorization server is unavailable or for all the tuples of subject (s) doesn't have relation (r) on object (o).
+	BatchCheck(context.Context, []*openfgav1.TupleKey) error
 
-	// lists the selectors for objects assigned to subject (s) with relation (r) on resource (s)
+	// Write accepts the insertion tuples and the deletion tuples.
+	Write(context.Context, []*openfgav1.TupleKey, []*openfgav1.TupleKey) error
+
+	// Lists the selectors for objects assigned to subject (s) with relation (r) on resource (s)
 	ListObjects(context.Context, string, authtypes.Relation, authtypes.Typeable) ([]*authtypes.Object, error)
 }

pkg/authz/openfgaauthz/provider.go

@@ -232,13 +232,13 @@ func (provider *provider) BatchCheck(ctx context.Context, tupleReq []*openfgav1.
 
 }
 
-func (provider *provider) CheckWithTupleCreation(ctx context.Context, claims authtypes.Claims, relation authtypes.Relation, typeable authtypes.Typeable, selectors []authtypes.Selector) error {
+func (provider *provider) CheckWithTupleCreation(ctx context.Context, claims authtypes.Claims, orgID valuer.UUID, _ authtypes.Relation, translation authtypes.Relation, _ authtypes.Typeable, _ []authtypes.Selector) error {
 	subject, err := authtypes.NewSubject(authtypes.TypeUser, claims.UserID, authtypes.Relation{})
 	if err != nil {
 		return err
 	}
 
-	tuples, err := typeable.Tuples(subject, relation, selectors)
+	tuples, err := authtypes.TypeableOrganization.Tuples(subject, translation, []authtypes.Selector{authtypes.MustNewSelector(authtypes.TypeOrganization, orgID.StringValue())}, orgID)
 	if err != nil {
 		return err
 	}
@@ -251,11 +251,21 @@ func (provider *provider) CheckWithTupleCreation(ctx context.Context, claims aut
 	return nil
 }
 
-func (provider *provider) Write(ctx context.Context, req *openfgav1.WriteRequest) error {
+func (provider *provider) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
+	deletionTuplesWithoutCondition := make([]*openfgav1.TupleKeyWithoutCondition, len(deletions))
+	for idx, tuple := range deletions {
+		deletionTuplesWithoutCondition[idx] = &openfgav1.TupleKeyWithoutCondition{User: tuple.User, Object: tuple.Object, Relation: tuple.Relation}
+	}
+
 	_, err := provider.openfgaServer.Write(ctx, &openfgav1.WriteRequest{
 		StoreId:              provider.storeID,
 		AuthorizationModelId: provider.modelID,
-		Writes:               req.Writes,
+		Writes: &openfgav1.WriteRequestWrites{
+			TupleKeys: additions,
+		},
+		Deletes: &openfgav1.WriteRequestDeletes{
+			TupleKeys: deletionTuplesWithoutCondition,
+		},
 	})
 
 	return err

pkg/http/middleware/authz.go

@@ -7,6 +7,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
@@ -106,7 +107,7 @@ func (middleware *AuthZ) OpenAccess(next http.HandlerFunc) http.HandlerFunc {
 	})
 }
 
-func (middleware *AuthZ) Check(next http.HandlerFunc, _ authtypes.Relation, translation authtypes.Relation, _ authtypes.Typeable, _ authtypes.Typeable, _ authtypes.SelectorCallbackFn) http.HandlerFunc {
+func (middleware *AuthZ) Check(next http.HandlerFunc, relation authtypes.Relation, translation authtypes.Relation, typeable authtypes.Typeable, cb authtypes.SelectorCallbackFn) http.HandlerFunc {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		claims, err := authtypes.ClaimsFromContext(req.Context())
 		if err != nil {
@@ -114,7 +115,19 @@ func (middleware *AuthZ) Check(next http.HandlerFunc, _ authtypes.Relation, tran
 			return
 		}
 
-		err = middleware.authzService.CheckWithTupleCreation(req.Context(), claims, translation, authtypes.TypeableOrganization, []authtypes.Selector{authtypes.MustNewSelector(authtypes.TypeOrganization, claims.OrgID)})
+		orgId, err := valuer.NewUUID(claims.OrgID)
+		if err != nil {
+			render.Error(rw, err)
+			return
+		}
+
+		selectors, err := cb(req.Context(), claims)
+		if err != nil {
+			render.Error(rw, err)
+			return
+		}
+
+		err = middleware.authzService.CheckWithTupleCreation(req.Context(), claims, orgId, relation, translation, typeable, selectors)
 		if err != nil {
 			render.Error(rw, err)
 			return

pkg/modules/dashboard/dashboard.go

@@ -27,6 +27,7 @@ type Module interface {
 	GetByMetricNames(ctx context.Context, orgID valuer.UUID, metricNames []string) (map[string][]map[string]string, error)
 
 	statsreporter.StatsCollector
+
 	role.RegisterTypeable
 }
 

pkg/modules/dashboard/impldashboard/module.go

@@ -225,5 +225,5 @@ func (module *module) Collect(ctx context.Context, orgID valuer.UUID) (map[strin
 }
 
 func (module *module) MustGetTypeables() []authtypes.Typeable {
-	return []authtypes.Typeable{dashboardtypes.ResourceDashboard, dashboardtypes.ResourcesDashboards}
+	return []authtypes.Typeable{dashboardtypes.TypeableResourceDashboard, dashboardtypes.TypeableResourcesDashboards}
 }

pkg/modules/role/implrole/module.go

@@ -9,7 +9,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/roletypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
-	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
 type module struct {
@@ -47,6 +46,8 @@ func (module *module) GetResources(_ context.Context) []*authtypes.Resource {
 	for _, register := range module.registry {
 		typeables = append(typeables, register.MustGetTypeables()...)
 	}
+	// role module cannot self register itself!
+	typeables = append(typeables, module.MustGetTypeables()...)
 
 	resources := make([]*authtypes.Resource, 0)
 	for _, typeable := range typeables {
@@ -142,24 +143,17 @@ func (module *module) Patch(ctx context.Context, orgID valuer.UUID, id valuer.UU
 }
 
 func (module *module) PatchObjects(ctx context.Context, orgID valuer.UUID, id valuer.UUID, relation authtypes.Relation, additions, deletions []*authtypes.Object) error {
-	additionTuples, err := roletypes.GetAdditionTuples(id, relation, additions)
+	additionTuples, err := roletypes.GetAdditionTuples(id, orgID, relation, additions)
 	if err != nil {
 		return err
 	}
 
-	deletionTuples, err := roletypes.GetDeletionTuples(id, relation, deletions)
+	deletionTuples, err := roletypes.GetDeletionTuples(id, orgID, relation, deletions)
 	if err != nil {
 		return err
 	}
 
-	err = module.authz.Write(ctx, &openfgav1.WriteRequest{
-		Writes: &openfgav1.WriteRequestWrites{
-			TupleKeys: additionTuples,
-		},
-		Deletes: &openfgav1.WriteRequestDeletes{
-			TupleKeys: deletionTuples,
-		},
-	})
+	err = module.authz.Write(ctx, additionTuples, deletionTuples)
 	if err != nil {
 		return err
 	}
@@ -170,3 +164,7 @@ func (module *module) PatchObjects(ctx context.Context, orgID valuer.UUID, id va
 func (module *module) Delete(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
 	return module.store.Delete(ctx, orgID, id)
 }
+
+func (module *module) MustGetTypeables() []authtypes.Typeable {
+	return []authtypes.Typeable{authtypes.TypeableRole, roletypes.TypeableResourcesRoles}
+}

pkg/modules/role/role.go

@@ -33,6 +33,8 @@ type Module interface {
 
 	// Deletes the role metadata and tuples in authorization server
 	Delete(context.Context, valuer.UUID, valuer.UUID) error
+
+	RegisterTypeable
 }
 
 type RegisterTypeable interface {
@@ -40,27 +42,19 @@ type RegisterTypeable interface {
 }
 
 type Handler interface {
-	// Creates the role metadata and tuples in authorization server
 	Create(http.ResponseWriter, *http.Request)
 
-	// Gets the role metadata
 	Get(http.ResponseWriter, *http.Request)
 
-	// Gets the objects for the given relation and role
 	GetObjects(http.ResponseWriter, *http.Request)
 
-	// Gets all the resources and the relations
 	GetResources(http.ResponseWriter, *http.Request)
 
-	// Lists all the roles metadata for the organization
 	List(http.ResponseWriter, *http.Request)
 
-	// Patches the role metdata
 	Patch(http.ResponseWriter, *http.Request)
 
-	// Patches the objects for the given relation and role
 	PatchObjects(http.ResponseWriter, *http.Request)
 
-	// Deletes the role metadata and tuples in authorization server
 	Delete(http.ResponseWriter, *http.Request)
 }

pkg/types/authtypes/selector.go

@@ -17,7 +17,8 @@ var (
 	typeRoleSelectorRegex         = regexp.MustCompile(`^[0-9a-f]{8}(?:\-[0-9a-f]{4}){3}-[0-9a-f]{12}$`)
 	typeOrganizationSelectorRegex = regexp.MustCompile(`^[0-9a-f]{8}(?:\-[0-9a-f]{4}){3}-[0-9a-f]{12}$`)
 	typeResourceSelectorRegex     = regexp.MustCompile(`^[0-9a-f]{8}(?:\-[0-9a-f]{4}){3}-[0-9a-f]{12}$`)
-	typeResourcesSelectorRegex    = regexp.MustCompile(`^org/[0-9a-f]{8}(?:\-[0-9a-f]{4}){3}-[0-9a-f]{12}$`)
+	// resources selectors are used to select either all or none
+	typeResourcesSelectorRegex = regexp.MustCompile(`^\*$`)
 )
 
 type SelectorCallbackFn func(context.Context, Claims) ([]Selector, error)
@@ -27,7 +28,7 @@ type Selector struct {
 }
 
 func NewSelector(typed Type, selector string) (Selector, error) {
-	err := IsValidSelector(typed, Selector{val: selector})
+	err := IsValidSelector(typed, selector)
 	if err != nil {
 		return Selector{}, err
 	}
@@ -35,26 +36,26 @@ func NewSelector(typed Type, selector string) (Selector, error) {
 	return Selector{val: selector}, nil
 }
 
-func IsValidSelector(typed Type, selector Selector) error {
+func IsValidSelector(typed Type, selector string) error {
 	switch typed {
 	case TypeUser:
-		if !typeUserSelectorRegex.MatchString(selector.String()) {
+		if !typeUserSelectorRegex.MatchString(selector) {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthZInvalidSelectorRegex, "selector must conform to regex %s", typeUserSelectorRegex.String())
 		}
 	case TypeRole:
-		if !typeRoleSelectorRegex.MatchString(selector.String()) {
+		if !typeRoleSelectorRegex.MatchString(selector) {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthZInvalidSelectorRegex, "selector must conform to regex %s", typeRoleSelectorRegex.String())
 		}
 	case TypeOrganization:
-		if !typeOrganizationSelectorRegex.MatchString(selector.String()) {
+		if !typeOrganizationSelectorRegex.MatchString(selector) {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthZInvalidSelectorRegex, "selector must conform to regex %s", typeOrganizationSelectorRegex.String())
 		}
 	case TypeResource:
-		if !typeResourceSelectorRegex.MatchString(selector.String()) {
+		if !typeResourceSelectorRegex.MatchString(selector) {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthZInvalidSelectorRegex, "selector must conform to regex %s", typeResourceSelectorRegex.String())
 		}
 	case TypeResources:
-		if !typeResourcesSelectorRegex.MatchString(selector.String()) {
+		if !typeResourcesSelectorRegex.MatchString(selector) {
 			return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthZInvalidSelectorRegex, "selector must conform to regex %s", typeResourcesSelectorRegex.String())
 		}
 	}

pkg/types/authtypes/transaction.go

@@ -24,7 +24,7 @@ type Transaction struct {
 }
 
 func NewObject(resource Resource, selector Selector) (*Object, error) {
-	err := IsValidSelector(resource.Type, selector)
+	err := IsValidSelector(resource.Type, selector.val)
 	if err != nil {
 		return nil, err
 	}

pkg/types/authtypes/typeable.go

@@ -30,8 +30,8 @@ var (
 type Typeable interface {
 	Type() Type
 	Name() Name
-	Prefix() string
-	Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error)
+	Prefix(orgId valuer.UUID) string
+	Tuples(subject string, relation Relation, selector []Selector, orgID valuer.UUID) ([]*openfgav1.TupleKey, error)
 }
 
 type Type struct{ valuer.String }

pkg/types/authtypes/typeable_organization.go

@@ -3,6 +3,7 @@ package authtypes
 import (
 	"strings"
 
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -10,7 +11,7 @@ var _ Typeable = new(typeableOrganization)
 
 type typeableOrganization struct{}
 
-func (typeableOrganization *typeableOrganization) Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error) {
+func (typeableOrganization *typeableOrganization) Tuples(subject string, relation Relation, selector []Selector, _ valuer.UUID) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 	for _, selector := range selector {
 		object := strings.Join([]string{typeableOrganization.Type().StringValue(), selector.String()}, ":")
@@ -28,6 +29,6 @@ func (typeableOrganization *typeableOrganization) Name() Name {
 	return MustNewName("organization")
 }
 
-func (typeableOrganization *typeableOrganization) Prefix() string {
+func (typeableOrganization *typeableOrganization) Prefix(_ valuer.UUID) string {
 	return typeableOrganization.Type().StringValue()
 }

pkg/types/authtypes/typeable_resource.go

@@ -1,8 +1,7 @@
 package authtypes
 
 import (
-	"strings"
-
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -24,10 +23,10 @@ func MustNewTypeableResource(name Name) Typeable {
 	return typeableesource
 }
 
-func (typeableResource *typeableResource) Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error) {
+func (typeableResource *typeableResource) Tuples(subject string, relation Relation, selector []Selector, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 	for _, selector := range selector {
-		object := typeableResource.Prefix() + "/" + selector.String()
+		object := typeableResource.Prefix(orgID) + "/" + selector.String()
 		tuples = append(tuples, &openfgav1.TupleKey{User: subject, Relation: relation.StringValue(), Object: object})
 	}
 
@@ -42,6 +41,7 @@ func (typeableResource *typeableResource) Name() Name {
 	return typeableResource.name
 }
 
-func (typeableResource *typeableResource) Prefix() string {
-	return strings.Join([]string{typeableResource.Type().StringValue(), typeableResource.Name().String()}, ":")
+func (typeableResource *typeableResource) Prefix(orgID valuer.UUID) string {
+	// example: resource:organization/0199c47d-f61b-7833-bc5f-c0730f12f046/dashboard
+	return typeableResource.Type().StringValue() + ":" + "organization" + "/" + orgID.StringValue() + "/" + typeableResource.Name().String()
 }

pkg/types/authtypes/typeable_resources.go

@@ -1,8 +1,7 @@
 package authtypes
 
 import (
-	"strings"
-
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -24,10 +23,10 @@ func MustNewTypeableResources(name Name) Typeable {
 	return resources
 }
 
-func (typeableResources *typeableResources) Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error) {
+func (typeableResources *typeableResources) Tuples(subject string, relation Relation, selector []Selector, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 	for _, selector := range selector {
-		object := typeableResources.Prefix() + "/" + selector.String()
+		object := typeableResources.Prefix(orgID) + "/" + selector.String()
 		tuples = append(tuples, &openfgav1.TupleKey{User: subject, Relation: relation.StringValue(), Object: object})
 	}
 
@@ -42,6 +41,7 @@ func (typeableResources *typeableResources) Name() Name {
 	return typeableResources.name
 }
 
-func (typeableResources *typeableResources) Prefix() string {
-	return strings.Join([]string{typeableResources.Type().StringValue(), typeableResources.Name().String()}, ":")
+func (typeableResources *typeableResources) Prefix(orgID valuer.UUID) string {
+	// example: resources:organization/0199c47d-f61b-7833-bc5f-c0730f12f046/dashboards
+	return typeableResources.Type().StringValue() + ":" + "organization" + "/" + orgID.StringValue() + "/" + typeableResources.Name().String()
 }

pkg/types/authtypes/typeable_role.go

@@ -1,8 +1,7 @@
 package authtypes
 
 import (
-	"strings"
-
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -10,10 +9,10 @@ var _ Typeable = new(typeableRole)
 
 type typeableRole struct{}
 
-func (typeableRole *typeableRole) Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error) {
+func (typeableRole *typeableRole) Tuples(subject string, relation Relation, selector []Selector, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 	for _, selector := range selector {
-		object := strings.Join([]string{typeableRole.Type().StringValue(), selector.String()}, ":")
+		object := typeableRole.Prefix(orgID) + "/" + selector.String()
 		tuples = append(tuples, &openfgav1.TupleKey{User: subject, Relation: relation.StringValue(), Object: object})
 	}
 
@@ -28,6 +27,7 @@ func (typeableRole *typeableRole) Name() Name {
 	return MustNewName("role")
 }
 
-func (typeableRole *typeableRole) Prefix() string {
-	return typeableRole.Type().StringValue()
+func (typeableRole *typeableRole) Prefix(orgID valuer.UUID) string {
+	// example: role:organization/0199c47d-f61b-7833-bc5f-c0730f12f046/role
+	return typeableRole.Type().StringValue() + ":" + "organization" + "/" + orgID.StringValue() + "/" + typeableRole.Name().String()
 }

pkg/types/authtypes/typeable_user.go

@@ -1,8 +1,7 @@
 package authtypes
 
 import (
-	"strings"
-
+	"github.com/SigNoz/signoz/pkg/valuer"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 )
 
@@ -10,10 +9,10 @@ var _ Typeable = new(typeableUser)
 
 type typeableUser struct{}
 
-func (typeableUser *typeableUser) Tuples(subject string, relation Relation, selector []Selector) ([]*openfgav1.TupleKey, error) {
+func (typeableUser *typeableUser) Tuples(subject string, relation Relation, selector []Selector, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 	for _, selector := range selector {
-		object := strings.Join([]string{typeableUser.Type().StringValue(), selector.String()}, ":")
+		object := typeableUser.Prefix(orgID) + "/" + selector.String()
 		tuples = append(tuples, &openfgav1.TupleKey{User: subject, Relation: relation.StringValue(), Object: object})
 	}
 
@@ -28,6 +27,7 @@ func (typeableUser *typeableUser) Name() Name {
 	return MustNewName("user")
 }
 
-func (typeableUser *typeableUser) Prefix() string {
-	return typeableUser.Type().StringValue()
+func (typeableUser *typeableUser) Prefix(orgID valuer.UUID) string {
+	// example: user:organization/0199c47d-f61b-7833-bc5f-c0730f12f046/user
+	return typeableUser.Type().StringValue() + ":" + "organization" + "/" + orgID.StringValue() + "/" + typeableUser.Name().String()
 }

pkg/types/dashboardtypes/dashboard.go

@@ -13,8 +13,8 @@ import (
 )
 
 var (
-	ResourceDashboard   = authtypes.MustNewTypeableResource(authtypes.MustNewName("dashboard"))
-	ResourcesDashboards = authtypes.MustNewTypeableResources(authtypes.MustNewName("dashboards"))
+	TypeableResourceDashboard   = authtypes.MustNewTypeableResource(authtypes.MustNewName("dashboard"))
+	TypeableResourcesDashboards = authtypes.MustNewTypeableResources(authtypes.MustNewName("dashboards"))
 )
 
 type StorableDashboard struct {

pkg/types/roletypes/role.go

@@ -21,6 +21,10 @@ var (
 	ErrCodeRoleFailedTransactionsFromString = errors.MustNewCode("role_failed_transactions_from_string")
 )
 
+var (
+	TypeableResourcesRoles = authtypes.MustNewTypeableResources(authtypes.MustNewName("roles"))
+)
+
 type StorableRole struct {
 	bun.BaseModel `bun:"table:role"`
 
@@ -166,7 +170,7 @@ func (role *PatchableRole) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func GetAdditionTuples(id valuer.UUID, relation authtypes.Relation, additions []*authtypes.Object) ([]*openfgav1.TupleKey, error) {
+func GetAdditionTuples(id valuer.UUID, orgID valuer.UUID, relation authtypes.Relation, additions []*authtypes.Object) ([]*openfgav1.TupleKey, error) {
 	tuples := make([]*openfgav1.TupleKey, 0)
 
 	for _, object := range additions {
@@ -179,6 +183,7 @@ func GetAdditionTuples(id valuer.UUID, relation authtypes.Relation, additions []
 			),
 			relation,
 			[]authtypes.Selector{object.Selector},
+			orgID,
 		)
 		if err != nil {
 			return nil, err
@@ -190,8 +195,8 @@ func GetAdditionTuples(id valuer.UUID, relation authtypes.Relation, additions []
 	return tuples, nil
 }
 
-func GetDeletionTuples(id valuer.UUID, relation authtypes.Relation, deletions []*authtypes.Object) ([]*openfgav1.TupleKeyWithoutCondition, error) {
-	tuples := make([]*openfgav1.TupleKeyWithoutCondition, 0)
+func GetDeletionTuples(id valuer.UUID, orgID valuer.UUID, relation authtypes.Relation, deletions []*authtypes.Object) ([]*openfgav1.TupleKey, error) {
+	tuples := make([]*openfgav1.TupleKey, 0)
 
 	for _, object := range deletions {
 		typeable := authtypes.MustNewTypeableFromType(object.Resource.Type, object.Resource.Name)
@@ -203,21 +208,13 @@ func GetDeletionTuples(id valuer.UUID, relation authtypes.Relation, deletions []
 			),
 			relation,
 			[]authtypes.Selector{object.Selector},
+			orgID,
 		)
 		if err != nil {
 			return nil, err
 		}
 
-		deletionTuples := make([]*openfgav1.TupleKeyWithoutCondition, len(transactionTuples))
-		for idx, tuple := range transactionTuples {
-			deletionTuples[idx] = &openfgav1.TupleKeyWithoutCondition{
-				User:     tuple.User,
-				Relation: tuple.Relation,
-				Object:   tuple.Object,
-			}
-		}
-
-		tuples = append(tuples, deletionTuples...)
+		tuples = append(tuples, transactionTuples...)
 	}
 
 	return tuples, nil