Skip to main content

v26.3.7

v26.3.7​

Stricter validation for the Ory Permission Language​

Ory Keto now rejects OPL mistakes it previously accepted silently, most importantly a name declared as both a relation and a permit in one namespace. In that case, the relation shadows the permit, so the permit is never evaluated and checks can return wrong results. Other more obvious mistakes include duplicate namespace or relation declarations, or references that mix up relations and permits.

For backward compatibility, Ory Keto continues to load and run existing configurations with the relation/permit collision, but a future release will reject them. Configurations with the other mistakes, such as duplicate declarations, fail to load after upgrading.

Before upgrading a self-hosted deployment, validate your configuration with /opl/syntax/check on the new version, or start the new version against your configuration in a test environment, and fix reported errors — for example by renaming a permit that clashes with a relation, or removing duplicate relations from the OPL, and updating the application code accordingly.