Make subject_set.relation optional for the DELETE relationship endpoint

[LucSalommez]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

TLDR: When we call the DELETE endpoint the parameter relation is optional but in a Subject Set it is mandatory which forces to hardcode all possible relations to make sure all tuples are deleted.

It is currently possible to delete relationships by calling the permission API and providing the values that should match the tuples we want to delete.

Let's say the following namespaces exist:

• User
• Group
• Company

It is possible to remove all User to Group relations for a specific group with this payload:

{
    "namespace": "Group",
    "object": "groupID",
}

Here "relation" is optional, thus enabling to delete all the Group tuples even if the relations are different (for exemple "members", "managers" ...).

Now let's take a Subject Set example where members of myGroup are employees of company and managers of myGroup are group_managers of company

Imagine we want to delete myGroup, which would imply deleting all the tuples where myGroup is used as a Subject Set.
What I would like to do following the first example logic is to delete all tuples like this:

{ 
    "namespace": "Company",
    "object": "company",
    "subject_set": {
        "namespace": "Group",
        "object": "myGroup"
    }
}

But when calling the endpoint I receive this error:

{
  "error": {
    "code": 400,
    "status": "Bad Request",
    "message": "incomplete subject, provide \"subject_id\" or a complete \"subject_set.*\""
  }
}

Which forces to define a "relation". This means that if the development team adds a new relation inside Group that is used as a Subject Set somewhere else, the backend code will have to be edited in the Group deletion process to also delete the new relations.

EDIT: I also tried with subject_set.relation = "" which returns a 204 and has no effects on my relations.

Describe your ideal solution

It would be a bit more maintainable to make the "subject_set.relation" parameter optional and delete all tuples the same way as when not using a Subject Set.

Workarounds or alternatives

Making a new request for each possible relation value.

Version

v0.11.0

Additional Context

No response

[LucSalommez]

I tried to compare the behavior with the PATCH endpoint.
Although the PATCH endpoint properly adds my tuples it does not behave the same way as the DELETE endpoint when trying to delete.

To take the same example as above I try to call the PATCH endpoint with this:

[
	{
    "action": "delete",
    "relation_tuple": {
      "namespace": "Company",
      "object": "company",
      "subject_set": {
        "namespace": "Group",
        "object": "myGroup",
        "relation": "members"
      }
    }
  }
]

With this same payload:

• The DELETE endpoint delete all the tuples matching the values
• The PATCH endpoint deletes nothing

This is another issue but is a bit related so I posted it here.
Let me know If I should write a proper issue.

[aeneasr]

Thank you for the report, we added this to the backlog. PRs welcomed, of course

[github-actions]

Hello contributors!

I am marking this issue as stale as it has not received any engagement from the community or maintainers for a year. That does not imply that the issue has no merit! If you feel strongly about this issue

• open a PR referencing and resolving the issue;
• leave a comment on it and discuss ideas on how you could contribute towards resolving it;
• leave a comment and describe in detail why this issue is critical for your use case;
• open a new issue with updated details and a plan for resolving the issue.

Throughout its lifetime, Ory has received over 10.000 issues and PRs. To sustain that growth, we need to prioritize and focus on issues that are important to the community. A good indication of importance, and thus priority, is activity on a topic.

Unfortunately, burnout has become a topic of concern amongst open-source projects.

It can lead to severe personal and health issues as well as opening catastrophic attack vectors.

The motivation for this automation is to help prioritize issues in the backlog and not ignore, reject, or belittle anyone.

If this issue was marked as stale erroneously you can exempt it by adding the backlog label, assigning someone, or setting a milestone for it.

Thank you for your understanding and to anyone who participated in the conversation! And as written above, please do participate in the conversation if this topic is important to you!

Thank you 🙏✌️