You guessed right ![]()
… and only because I absolutely needed to implement those! I don’t see a good way to implement that for all the objects, and because the scriptlet doesn’t have access to most the information about them, we’d need to implement costly (not in dev time, but in DB lookups) helpers just to fetch said objects (or just their names). OpenFGA is its own source of truth, so lookup is inexpensive. I think what you’re describing can only ever apply reasonably to OpenFGA.
The endpoint would quickly get really expensive, which mandates for caching on the client side, but you really wouldn’t want your users to not be able to click a button after a permission change if they don’t clear their cache (reloading the page is fine, but that’s soooo y2k
).
Now of course we could add the concept of rights/roles to fit the « rough roles » aspect of OIDC and SAML, which the scriptlet could probably consume, but I think we have internalized that it won’t be happening anytime soon ![]()
As I’m not an OpenFGA cool kid, I’m sure your endpoint is great, but I’m also sure I won’t be seeing a lot of grayed-out buttons in my UI at my job!