test: rewrite and traversal

internal/check/bench_test.go

@@ -135,6 +135,9 @@ func BenchmarkCheckEngine(b *testing.B) {
 //go:embed testfixtures/project_opl.ts
 var ProjectOPLConfig string
 
+//go:embed testfixtures/rewrite_and_traversal_opl.ts
+var RewriteAndTraversalConfig string
+
 func BenchmarkComputedUsersets(b *testing.B) {
 	ctx := context.Background()
 

internal/check/engine_test.go

@@ -582,6 +582,47 @@ func TestEngine(t *testing.T) {
 		}
 	})
 
+	t.Run("case=rewrite_and_traversal with depth", func(t *testing.T) {
+		t.Parallel()
+
+		for _, tc := range []struct {
+			name string
+			opl  string
+		}{
+			{"rewrite and traversal", RewriteAndTraversalConfig},
+		} {
+			tc := tc
+			t.Run("opl="+tc.name, func(t *testing.T) {
+				t.Parallel()
+
+				reg := driver.NewSqliteTestRegistry(t, false,
+					driver.WithConfig(config.KeyLimitMaxReadDepth, 10),
+					driver.WithOPL(RewriteAndTraversalConfig))
+
+				insertFixtures(t, reg.RelationTupleManager(), []string{
+					"Group:g#supers@SuperUsers:super",
+					"Role:admin#members@User:u",
+					"SuperUsers:super#admins@Role:admin#members",
+					"Comment:c#parents@Group:g",
+				})
+
+				e := check.NewEngine(reg)
+
+				t.Run("case=enough depth", func(t *testing.T) {
+					res, err := e.CheckIsMember(ctx, tupleFromString(t, "Comment:c#update@User:u"), 6)
+					require.NoError(t, err)
+					assert.True(t, res)
+				})
+
+				t.Run("case=not enough depth", func(t *testing.T) {
+					res, err := e.CheckIsMember(ctx, tupleFromString(t, "Comment:c#update@User:u"), 5)
+					require.NoError(t, err)
+					assert.False(t, res)
+				})
+			})
+		}
+	})
+
 	t.Run("case=batch check", func(t *testing.T) {
 		reg := newDepsProvider(t, []*namespace.Namespace{
 			{Name: "test"},

internal/check/testfixtures/rewrite_and_traversal_opl.ts

@@ -0,0 +1,37 @@
+import { Namespace, Context, SubjectSet } from "@ory/keto-namespace-types"
+
+class User implements Namespace {}
+
+class Role implements Namespace {
+    related: {
+        members: (User | Role)[]
+    }
+}
+
+class SuperUsers implements Namespace {
+    related: {
+        admins: SubjectSet<Role, "members">[]  // annotier admins
+    }
+}
+
+class Comment implements Namespace {
+    related: {
+        parents: Group[]
+    }
+
+    permits = {
+        delete: (ctx: Context): boolean => this.related.parents.traverse((group) => group.permits.update(ctx)),
+        update: (ctx: Context): boolean => this.permits.delete(ctx),
+    }
+}
+
+class Group implements Namespace {
+    related: {
+        supers: SuperUsers[]
+    }
+
+    permits = {
+        delete: (ctx: Context): boolean => this.related.supers.traverse((supe) => supe.related.admins.includes(ctx.subject)),  // delete a group
+        update: (ctx: Context): boolean => this.permits.delete(ctx), // if can delete then can update
+    }
+}