Go

In this document you can find code examples for the Ory Keto Go SDK.

info

Missing an example? Please create a feature request and it will be added here.

You can find more examples of SDK usage in the auto-generated documentation keto-client-go.

Ory Keto exposes two APIs for integration

• gRPC
• REST

Installation

Installation gRPC API

go get github.com/ory/keto/proto

Installation REST API

go get github.com/ory/keto-client-go

REST API examples

As an example, let's create the following minimal permission rules. These just contain a User and Blog namespace as well as the view permission for the Blog namespace.

import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types"

class User implements Namespace { }

class Blog implements Namespace {
  related: {
    viewers: User[]
  }

  permits = {
    view: (ctx: Context): boolean =>
      this.related.viewers.includes(ctx.subject)
  }
}

If you want to learn more about creating permission rules read the Create a permission model guide.

CreateRelationship and CheckPermission

The following code creates and checks the following permission:

Blog:secret_post#view@Bob

This means Bob can view the secret_post in the Blog namespace.

package main

import (
	"context"
	"fmt"
	"os"

	ory "github.com/ory/keto-client-go"
)

// Use this context to access Ory APIs which require an Ory API Key.
var namespace = "Blog"
var object = "secret_post"
var relation = "view"
var subjectId = "Bob"

func main() {
	payload := ory.CreateRelationshipBody{
		Namespace: &namespace,
		Object:    &object,
		Relation:  &relation,
		SubjectId: &subjectId,
	}
	configuration := ory.NewConfiguration()
	configuration.Servers = []ory.ServerConfiguration{
		{
			URL: "http://127.0.0.1:4467", // Write API
		},
	}
	writeClient := ory.NewAPIClient(configuration)
	_, r, err := writeClient.RelationshipApi.CreateRelationship(context.Background()).CreateRelationshipBody(payload).Execute()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
		panic("Encountered error: " + err.Error())
	}
	fmt.Println("Successfully created tuple")
	configuration.Servers = []client.ServerConfiguration{
		{
			URL: "http://127.0.0.1:4466", // Read API
		},
	}
	readClient := client.NewAPIClient(configuration)

	check, r, err := readClient.PermissionApi.CheckPermission(context.Background()).
		Namespace(*&namespace).
		Object(*&object).
		Relation(*&relation).
		SubjectId(*&subjectId).Execute()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
		panic("Encountered error: " + err.Error())
	}
	if check.Allowed {
		fmt.Println(*&subjectId + " can " + *&relation + " the " + *&object)
	}
}