Implementation of (F)ine (G)rade (A)uthorization inspired by OpenFGA

The motivation behind this project was to create a service that could handle the object list better than OpenFGA https://openfga.dev/. The mentioned solution is based on a relational database. The topic of permissions and accesses in my opinion is graphical in nature, so I decided to try it with graphs, preliminary benchmarks show a very big performance difference.

1. the DSL logic is parsed using ply to graph in networkx. An AuthModel is created
2. the AuthModelService using the AuthService generates access paths on the graph from object A to object B. It filters them by the required permissions
3. the access paths are converted into cypher commands that fly to memgraph.
4. everything is wrapped in the grpc client

3 tests were conducted:

-1000 objects
-10,000 objects
-100,000 objects

For one user with id "1" who has relatively the most connections 100 requests for his access were carried out As you can see, RelationFGA is almost an order of magnitude faster than OpenFga. All the files needed to run the benchmark with instructions are in the src/benchmark path

I am very open to criticism, I probably made mistakes

PROTOS:

run commands from graph_fga/grpc folder:

$ python -m grpc_tools.protoc -I./protos --python_out=./pb2 --pyi_out=./pb2 --grpc_python_out=./pb2 protos/messages.proto
$ python -m grpc_tools.protoc -I./protos --python_out=./pb2 --pyi_out=./pb2 --grpc_python_out=./pb2 protos/services.proto

edit file services_pb2_grpc first line to:

from . import messages_pb2 as messages__pb2

TESTS:

GRPC tests:

$ docker compose run server_grpc pytest