Tuples being reversed when writing to OPENFGA

[rai-prakhar]

Im trying to write some tuples to open fga but repeatdly getting error that it is not defined in schema, though i have defined it.

Schema:
model
schema 1.1

type user

type store
relations
define has_role: [role]

type role
relations
define member: [user]
define store: [store]
define can_view: [page]
define can_edit: [page]

type page
relations
define parent: [store]
define viewer_role: [role]
define editor_role: [role]
define global_context: [global_role]

define superadmin_access: [user] from superadmin of global_context

define can_view: [user] from member of viewer_role or superadmin_access

define can_edit: [user] from member of editor_role or superadmin_access

type global_role
relations
define superadmin: [user]

Error:

ERROR during isolated write: Write validation error for POST Write with body {"code":"validation_error","message":"Invalid tuple 'role:store2911_store_manager#has_role@store:store2911'. Reason: relation 'role#has_role' not found"}
 with error code validation_error error message: Invalid tuple 'role:store2911_store_manager#has_role@store:store2911'. Reason: relation 'role#has_role' not found

Functions:

Init:
func (s *OpenFGAService) Initialize(ctx context.Context) error {
if s.Initialized {
return nil
}

// Get or create store
storeID, err := s.getOrCreateStore(ctx)
if err != nil {
	return err
}
s.StoreID = storeID

// Write authorization model
var authzModel client.ClientWriteAuthorizationModelRequest
if err := json.Unmarshal([]byte(OpenFGASchema2), &authzModel); err != nil {
	return fmt.Errorf("error unmarshalling authorization model: %w", err)
}

modelResp, err := s.FgaClient.WriteAuthorizationModel(ctx).
	Body(authzModel).
	Options(client.ClientWriteAuthorizationModelOptions{
		StoreId: &s.StoreID,
	}).Execute()
if err != nil {
	return fmt.Errorf("failed to write authorization model: %w", err)
}

s.FgaClient.SetStoreId(s.StoreID)
s.AuthzModel = modelResp.GetAuthorizationModelId()
s.FgaClient.SetAuthorizationModelId(s.AuthzModel)

fmt.Printf("DEBUG: Using AuthzModel ID p1: '%s'\n", s.AuthzModel)
fmt.Printf("DEBUG: Using Store ID p1: '%s'\n", s.StoreID)

s.Initialized = true
return nil

}

Setup:

func (s *OpenFGAService) SetupStore(ctx context.Context, storeID string) error {
if err := s.ensureInitialized(ctx); err != nil {
return err
}

roles := []RoleType{
	RoleStoreManager,
	// RoleTeamLead,
	// RoleCook,
}

// --- TEMPORARY DEBUGGING: Isolate store#has_role@role ---
isolatedTuples := []client.ClientTupleKey{} // Use a new slice just for this test
storeObjID := formatStoreID(storeID)

fmt.Println("--- ISOLATION TEST: Preparing only store#has_role@role tuples ---")
for _, role := range roles {
	roleObjID := formatRoleID(fmt.Sprintf("%s_%s", storeID, role))

	// ONLY add the tuple type that seems related to the error, using the confirmed constant
	tupleToAdd := client.ClientTupleKey{
		User:     storeObjID,      // e.g., store:store2907
		Relation: HasRoleRelation, // Should be "has_role"
		Object:   roleObjID,       // e.g., role:store2907_store_manager
	}
	fmt.Printf("Adding to isolated batch: User=%s, Relation=%s, Object=%s\n", tupleToAdd.User, tupleToAdd.Relation, tupleToAdd.Object)
	isolatedTuples = append(isolatedTuples, tupleToAdd)
}
fmt.Println("----------------------------------------------------------------")

// Log exactly what's being sent in this isolated batch
fmt.Println("--- Tuples being sent in ISOLATED write ---")
for i, t := range isolatedTuples {
	fmt.Printf("Isolated Tuple %d: User=%s, Relation=%s, Object=%s\n", i, t.User, t.Relation, t.Object)
}
fmt.Println("-------------------------------------------")

fmt.Printf("DEBUG: Using AuthzModel ID: '%s'\n", s.AuthzModel)
fmt.Printf("DEBUG: Using Store ID: '%s'\n", s.StoreID)
// Attempt to write ONLY these isolated tuples
if err := s.writeTuples(ctx, isolatedTuples); err != nil {
	// Does it STILL fail with the store#store@role error?
	fmt.Printf("ERROR during isolated write: %v\n", err)
	return fmt.Errorf("failed to write isolated store#has_role@role tuples: %w", err)
}

fmt.Println("--- ISOLATION TEST: Isolated write successful! ---")

// --- END TEMPORARY DEBUGGING ---

// Comment out the rest of the function for this test
/*
	// ... original code for pages ...
	// if err := s.writeTuples(ctx, tuples); err != nil { ... } // Original first write
	// if err := s.setupDefaultAccessPermissions(ctx, storeID); err != nil { ... } // Original second write
*/

return nil // End function here for the test

}

[adriantam]

For

type store
  relations
    define has_role: [role]

It means that we assign role:X as user to the store:Y as object with has_role relation. However, your example is assigning store:store2907 as user to store:store2907 as `object. Thus, it is backward with respect to your model.