https://linen.dev logo
Join Slack
Powered by
Hello Permit team :slightly_smiling_face: I just w...
# permit-saas
m
Hello Permit team 🙂 I just wanted to double check: Under Settings I can define user attributes of type 
object
, which is great, because we have the need for nested attributes. However, if I test a resource set using this attribute, it doesn't seem to work. Can you please confirm, that it should work? My example: • Define 
foo
user attribute and set it for a user to:
Copy code
"foo": {
    "A": 3,
    "B": 6
}
• Create a resource set using the condition: 
resource.foo less-than (ref) user.foo.A
• Testing it with the resource attribute 
"foo": 4
returns true, even though it's greater than the value of 
foo.A
(3). As always, thanks for your help in advance 🙏 simple smile
a
Hi @Maxim Baldinger, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Based on the documentation, object-typed attributes in ABAC work with specific operators for matching object properties (1) . When working with object-typed user attributes, you need to use the 
object_match
operator to access nested properties . Here's how it should work: For an object attribute like:
Copy code
{
  "allOf": [
    {
      "user.organization": {
        "object_match": {
          "match": {
            "country": {
              "equals": "US"
            },
            "subscription": {
              "equals": "pro"
            }
          }
        }
      }
    }
  ]
}
The documentation shows that when matching object attributes, you use 
object_match
with a 
match
object containing the nested conditions . Normal comparison operators work within the 
match
object for each object-attribute . For your specific use case comparing 
resource.foo
with 
user.foo.A
, the issue appears to be that you're trying to directly reference a nested property (
user.foo.A
) in a comparison, which may not be supported in the current implementation. The documentation examples only show object matching for equality checks within the 
object_match
operator, not for cross-referencing nested properties in less-than/greater-than comparisons. To help our engineers investigate this further, could you please provide: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. Any relevant logs from your PDP This will help us determine if this is a limitation or a bug in the current implementation.
To learn more, see the sources I considered: [[1] Operators](https://docs.permit.io/api/working-with-abac/operators)
o
The less-than operator is just for numbers. 🙂
m
I know, that's why 
foo
on the resource is of type 
number
and 
A
and 
B
inside the 
object
type attribute on the user are also numbers (the values I assigned, at least)
o
FOO is a JSON object that contains numbers, not a number by itself
m
I'm comparing the number (by definition) 
resource.foo
to a number inside the JSON object, 
user.foo.A
. I mean, I know that I cannot compare a number with an object, but if we swap out 
resource.foo
with the input (4 in my example) and 
user.foo.A
with what is configured (3), I end up with an expression that compares numbers: 
4 < 3
.
o
You’d need to use the more complex expression syntax with separating each attribute or using the attribute match syntax - as described here https://docs.permit.io/api/working-with-abac/operators/#matching-a-single-object-typed-attribute
Another option of course is to use PBAC and implement your policy directly with Rego
m
Thanks Or, I'll have a look at that 🙂
Open in Slack
PreviousNext
Powered by