Filter EF queries with FGA

You'll learn how to build an FGA filter and apply it in EF Core queries for list and detail endpoints.

Goal#

List endpoints return only rows the current subject may read — in one SQL round-trip.

Steps#

1. Inject ISqlOSFgaAuthService in your endpoint or service.

2. Build a filter for the entity type:

var filter = await fgaAuth.GetAuthorizationFilterAsync<Project>(
    subjectId: userId,
    permissionKey: "project.read");
 
var projects = await db.Projects
    .Where(filter)
    .Where(p => p.IsActive)
    .OrderBy(p => p.Name)
    .Take(20)
    .ToListAsync();

3. Point checks for single-resource actions use CheckAccessAsync (see Checking a permission).

4. Verify with the access tester in /sqlos/admin/fga/.

Expected outcome#

• LINQ translates to SQL with the FGA TVF in the plan
• Pagination and sorting stay in the database
• No N+1 calls to an external policy engine

Next steps#

• List filtering — pagination and PagedSpec
• Syncing auth to FGA
• SDK reference