FGA API Reference

var access = await authService.CheckAccessAsync(subjectId, "CHAIN_VIEW", "chain-1");
if (!access.Allowed)
    return Results.Json(new { error = "Permission denied" }, statusCode: 403);

var canEdit = await authService.HasCapabilityAsync(subjectId, "CHAIN_EDIT");
if (!canEdit)
    return Results.Json(new { error = "Permission denied" }, statusCode: 403);

var filter = await authService
    .GetAuthorizationFilterAsync<Chain>(subjectId, "CHAIN_VIEW");
 
var chains = await dbContext.Chains
    .Where(filter)
    .OrderBy(c => c.Name)
    .ToListAsync();

var trace = await authService.TraceResourceAccessAsync(
    subjectId, "chain-1", "CHAIN_VIEW");
// trace contains the full decision path

var resourceId = context.CreateResource(
    parentId: "retail_root",
    name: request.Name,
    resourceTypeId: "chain"
);
 
var chain = new Chain { ResourceId = resourceId, Name = request.Name };
context.Chains.Add(chain);
await context.SaveChangesAsync();

return await authService.AuthorizedDetailAsync(
    context.Chains.Include(c => c.Locations),
    c => c.Id == id,
    subjectId,
    "CHAIN_VIEW",
    chain => new ChainDetailDto
    {
        Id = chain.Id,
        Name = chain.Name,
        LocationCount = chain.Locations.Count
    });

var spec = PagedSpec.For<Chain>(c => c.Id)
    .RequirePermission("CHAIN_VIEW")
    .SortByString("name", c => c.Name, isDefault: true)
    .SortByString("description", c => c.Description ?? "")
    .Search(search, c => c.Name, c => c.Description)
    .Configure(q => q.Include(c => c.Locations))
    .Build(pageSize, cursor, sortBy, sortDir);

var result = await executor.ExecuteAsync(
    context.Chains, spec, subjectId,
    c => new ChainDto
    {
        Id = c.Id,
        Name = c.Name,
        LocationCount = c.Locations.Count
    });
 
// result.Items     — the page of DTOs
// result.NextCursor — pass to next request for pagination
// result.HasMore   — whether more pages exist

var total = await executor.CountAsync(context.Chains, spec, subjectId);

public interface IHasResourceId
{
    string ResourceId { get; }
}

public class Chain : IHasResourceId
{
    public string Id { get; set; } = Guid.NewGuid().ToString();
    public string ResourceId { get; set; } = "";
    public string Name { get; set; } = "";
}

public class SqlOSFgaAccessCheckResult
{
    public bool Allowed { get; set; }
    public List<SqlOSFgaAccessTrace>? Trace { get; set; }
    public string? Error { get; set; }
}

public class SqlOSFgaAccessTrace
{
    public string Step { get; set; }
    public string Detail { get; set; }
    public string? ResourceId { get; set; }
    public string? ResourceName { get; set; }
    public string? GrantId { get; set; }
    public string? RoleName { get; set; }
    public string? SubjectName { get; set; }
}

public class SqlOSFgaResource
{
    public string Id { get; set; }
    public string ParentId { get; set; }
    public string Name { get; set; }
    public string ResourceTypeId { get; set; }
    public bool IsActive { get; set; }
}

public class SqlOSFgaGrant
{
    public string Id { get; set; }
    public string SubjectId { get; set; }
    public string ResourceId { get; set; }
    public string RoleId { get; set; }
    public string? Description { get; set; }
}

public class SqlOSFgaSubject
{
    public string Id { get; set; }
    public string SubjectTypeId { get; set; }
    public string DisplayName { get; set; }
    public string? OrganizationId { get; set; }
    public string? ExternalRef { get; set; }
}