terraform + openfga

main.ts

terraform {
  required_providers {
    openfga = {
      source = "mauriceackel/openfga"
    }
  }
}


provider "openfga" {
  api_url = "http://localhost:8080"
}

resource "openfga_store" "example" {
  name = "example_store_name"
}

data "openfga_authorization_model_document" "model" {
  mod_file_path = "${path.root}/models/fga.mod"
}

resource "openfga_authorization_model" "example" {
  store_id = openfga_store.example.id

  model_json = data.openfga_authorization_model_document.model.result
}

models--core.fga

module core

type user

type organization
  relations
    define member: [user]
    define admin: [user]

type group
  relations
    define member: [user]
    define can_edit: [user]

models--fga.mod

schema: '1.2'
contents:
  - core.fga
  - issue-tracker/projects.fga
  - issue-tracker/tickets.fga
  - wiki.fga

models--issue-tracker--projects.fga

module issue-tracker

extend type organization
  relations
    define can_create_project: admin

type project
  relations
    define organization: [organization]
    define viewer: member from organization

models--issue-tracker--tickets.fga

module issue-tracker

type ticket
  relations
    define project: [project]
    define owner: [user]

models--wiki.fga

module wiki

extend type organization
  relations
    define can_create_space: admin


type space
  relations
    define organization: [organization]
    define can_view_pages: member from organization

type page
  relations
    define space: [space]
    define owner: [user]