Skip to main content
Version: 0.6.x

Instagram

This example presents an Instagram Authorization Schema, outlining the intricate relationships between users, accounts, and posts on the platform. It defines user access levels, privacy settings, and interactions, offering insights into how followers, account owners, and post restrictions are managed within the Instagram ecosystem.

Schema | Open in playground

entity user {}

entity account {
// users have accounts
relation owner @user

// accounts can follow other users/accounts.
relation following @user

// other users/accounts can follow account.
relation follower @user

// accounts can be private or public.
attribute public boolean

// users can view an account if they're followers, owners, or if the account is not private.
action view = (owner or follower) or public

}

entity post {
// posts are linked with accounts.
relation account @account

// comments are limited to people followed by the parent account.
attribute restricted boolean

// users can view the posts, if they have access to view the linked accounts.
action view = account.view

// users can comment and like on unrestricted posts or posts by owners who follow them.
action comment = account.following not restricted
action like = account.following not restricted
}

Brief Examination of the Model

The Instagram Authorization Schema models the relationships between users, accounts, and posts in the Instagram platform.

Users can own accounts, follow other accounts, and be followed by other users. Accounts can have public or private settings, and access to view an account is determined by ownership, followers, and privacy settings. Posts are associated with accounts and can have restricted comments and likes based on account privacy.

Entities & Relations

  • User: Represents a user on the Instagram platform.

  • Account: Represents a user account on Instagram. Accounts have owners, followers, and can follow other accounts.

  • Post: Represents a post on Instagram. Posts are linked to accounts and can have restricted comments and likes.

Permissions

Users can view an account if they are the owner, a follower, or if the account is public. Users can comment and like posts if they have access to view the linked account and the post is unrestricted.

Relationships and Attributes

Based on our schema, let's create some sample relationships to test both our schema and our authorization logic.

// Relationships
// Users, Accounts and Posts:
account:1#owner@user:kevin
account:2#owner@user:george
account:1#following@user:george
account:2#follower@user:kevin
post:1#account@account:1
post:2#account@account:2

// Attributes
// Accounts and Posts:
account:1$public|boolean:true
account:2$public|boolean:false
post:1$restricted|boolean:false
post:2$restricted|boolean:true

Test & Validation

To validate our authorization logic, let's run some tests on different scenarios using the Instagram Authorization Schema.

Test 1: Checking Account Viewing Permissions

Can user:kevin view account:1?

    entity account {
relation owner @user
relation following @user
relation follower @user
attribute public boolean
action view = (owner or follower) or public
}

According to the schema, user:kevin is the owner of account:1. Hence, user:kevin should be able to view account:1. The expected result is 'true'.

Can user:kevin view account:2?

    entity account {
relation owner @user
relation following @user
relation follower @user
attribute public boolean
action view = (owner or follower) or public
}

According to the schema, user:kevin follows account:2. Hence, user:kevin should be able to view account:2 because he is a follower. The expected result is 'true'.

Can user:george view account:1?

    entity account {
relation owner @user
relation following @user
relation follower @user
attribute public boolean
action view = (owner or follower) or public
}

According to the schema, user:george can view account:1, because the account is public. Hence, user:george should be able to view account:1. The expected result is 'true'.

Can user:george view account:2?

    entity account {
relation owner @user
relation following @user
relation follower @user
attribute public boolean
action view = (owner or follower) or public
}

According to the schema, user:george is the owner of account:2. Hence, user:george should be able to view account:2. The expected result is 'true'.

Test 2: Checking Post Viewing Permissions

Can user:george view post:1?

entity post {
relation account @account
attribute restricted boolean
action view = account.view
}

According to the schema, post:1 is linked with account:1, and it does not have restricted access. Also, user:george is following account:1. Hence, user:george should be able to view post:1. The expected result is 'true'.

Can user:kevin view post:2?

entity post {
relation account @account
attribute restricted boolean
action view = account.view
}

According to the schema, post:2 is linked with account:2, and it has restricted access. Also, user:george is not following account:1. Hence, user:kevin should not be able to view post:2. The expected result is 'false'.

Can user:george view post:2?

entity post {
relation account @account
attribute restricted boolean
action view = account.view
}

According to the schema, post:2 is linked with account:2, and it is restricted access. Also, user:george can view his own post:2. The expected result is 'true'.

Test 3: Checking Post Commenting Permissions

Can user:george comment post:1?

entity post {
relation account @account
attribute restricted boolean
action comment = account.following not restricted
}

According to the schema, post:1 is linked with account:1, and it is not restricted. Also, user:george can comment on post:1. The expected result is 'true'.

Can user:kevin comment post:2?

entity post {
relation account @account
attribute restricted boolean
action comment = account.following not restricted
}

According to the schema, post:2 is linked with account:2, and it is restricted. user:kevin cannot comment on post:2. The expected result is 'false'.

Let's test these access checks in our local with using permify validator. We'll use the below schema for the schema validation file.

schema: |-
entity user {}

entity account {
// users have accounts
relation owner @user

// accounts can follow other users/accounts.
relation following @user

// other users/accounts can follow account.
relation follower @user

// accounts can be private or public.
attribute public boolean

// users can view an account if they're followers, owners, or if the account is not private.
action view = (owner or follower) or public

}

entity post {
// posts are linked with accounts.
relation account @account

// comments are limited to people followed by the parent account.
attribute restricted boolean

// users can view the posts, if they have access to view the linked accounts.
action view = account.view

// users can comment and like on unrestricted posts or posts by owners who follow them.
action comment = account.following not restricted
action like = account.following not restricted
}
relationships:
- account:1#owner@user:kevin
- account:2#owner@user:george
- account:1#following@user:george
- account:2#follower@user:kevin
- post:1#account@account:1
- post:2#account@account:2
attributes:
- account:1$public|boolean:true
- account:2$public|boolean:false
- post:1$restricted|boolean:false
- post:2$restricted|boolean:true
scenarios:
- name: Account Viewing Permissions
description: Evaluate account viewing permissions for 'kevin' and 'george'.
checks:
- entity: account:1
subject: user:kevin
assertions:
view: true
- entity: account:2
subject: user:kevin
assertions:
view: true
- entity: account:1
subject: user:george
assertions:
view: true
- entity: account:2
subject: user:george
assertions:
view: true
- name: Post Viewing Permissions
description: Determine post viewing permissions for 'kevin' and 'george'.
checks:
- entity: post:1
subject: user:george
assertions:
view: true
- entity: post:2
subject: user:kevin
assertions:
view: true
- entity: post:2
subject: user:george
assertions:
view: true
- name: Post Commenting Permissions
description: Evaluate post commenting permissions for 'kevin' and 'george'.
checks:
- entity: post:1
subject: user:george
assertions:
comment: true
- entity: post:2
subject: user:kevin
assertions:
comment: false

Using Schema Validator in Local

After cloning Permify, open up a new file and copy the schema yaml file content inside. Then, build and run Permify instance using the command make serve

Running Permify

Then run permify validate {path of your schema validation file} to start the test process.

The validation result according to our example schema validation file:

test-result

Need any help ?

This is the end of demonstration of the authorization structure for Facebook groups. To install and implement this see the Set Up Permify section.