Check a relationship on a specific authorization model

[vhpoet]

It looks like the Check endpoint is checking a relationship using the latest authorization model. Would it make sense to add authorization_model_id as an optional parameter to this endpoint?

My use case is a blue green deployment. Say I didn't have a breaking change (no types or relations have been renamed or removed) so I don't need to migrate tuples, but I changed the authorization model and I want my blue deployment to use the old authorization model from the same store and the green deployment to use the latest model.

[aaguiarz]

Hi @vhpoet

You can specify an authorization_model_id in Check, please check the body parameter in the example.

Are you asking because you want to deploy a specific change to your model with blue/green deployment, or because you might want to do that in the future? We are actually looking for examples of users trying this, so if you have a concrete example it would be awesome.

Thanks!

[vhpoet]

whoops, missed that 🤦‍♂️ was looking at the example instead of the parameters section.

We have a blue/green deployment in place and I'm integrating OpenFGA with the service at the moment. My current work is around setting up the infra with a very minimal model, but we'll be migrating the other stuff to OpenFGA in the next few weeks/months. Is there anything specific you're looking for?

[aaguiarz]

One of the scenarios that we've been discussing is deploying model changes when you make "complex" changes.

In that case, you could want to make sure that permission checks are working as expected, and run checks() on both models (e.g. 1% of the traffic calls check() for both models and compares the results, and once you are confident the differences are the expected ones, you roll it out to 100% of the traffic).

Is that the deployment model you are thinking of?