grafana/pkg/services/authz/zanzana/schema/schema_resource.fga

module resource

extend type folder
  relations
    define resource_view: [user, service-account, team#member, role#assignee] or resource_edit or resource_view from parent
    define resource_edit: [user, service-account, team#member, role#assignee] or resource_admin or resource_edit from parent
    define resource_admin: [user, service-account, team#member, role#assignee] or resource_admin from parent

    define resource_get: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_view or resource_get from parent
    define resource_create: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_create from parent
    define resource_update: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_update from parent
    define resource_delete: [user with folder_group_filter, service-account with folder_group_filter, team#member with folder_group_filter, role#assignee with folder_group_filter] or resource_edit or resource_delete from parent

type group_resource
  relations
    define view: [user, service-account, render, team#member, role#assignee] or edit
    define edit: [user, service-account, team#member, role#assignee] or admin
    define admin: [user, service-account, team#member, role#assignee]

    define get: [user, service-account, render, team#member, role#assignee] or view
    define create: [user, service-account, team#member, role#assignee] or edit
    define update: [user, service-account, team#member, role#assignee] or edit
    define delete: [user, service-account, team#member, role#assignee] or edit

type resource
  relations
    define view: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
    define edit: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or admin
    define admin: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter]

    define get: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or view
    define update: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit
    define delete: [user with group_filter, service-account with group_filter, team#member with group_filter, role#assignee with group_filter] or edit

condition group_filter(requested_group: string, group_resource: string) {
  requested_group == group_resource
}

condition folder_group_filter(requested_group: string, group_resources: list<string>) {
  requested_group in group_resources
}