Follow up question: How might this work when you want to have users be members of multiple groups, I've got an example here: https://play.authzed.com/s/AQghMTPYJ7J2/schema

// A inherits RW (except r1, no permissions)
resource:global#reader@group:A#member
resource:global#writer@group:A#member
resource:r1#uninherit@group:A#member

// B inherits RW (except r2, no permissions)
resource:global#reader@group:B#member
resource:global#writer@group:B#member
resource:r2#uninherit@group:B#member

group:A#member@user:matt
group:B#member@user:matt

here matt would no longer see any resources (which makes sense, it's how the schema is defined) but it's probably clear to most people the expected behaviour would be that they could see ALL resources - that is - we only want to uninherit permissions if it doesn't conflict with another group definition

so you'd want

matt

to be able to see the resource because he is a member of two global groups?

yeah - we'd like to say that a user in multiple groups has the maximal amount of permissions provided to them from the groups

interesting

I'll have to think that over

thanks, no worries, I've been trying for a while before asking but its not clear how this might work.

Thanks @User ! Very helpful and clearly stated on your part.

Hi all, one question, can I do a relationship query like getting me all resources Y with relation X. tried with following command get the virtual cards with under creditcard:cc_9MSTeIVLW0C6aHtiQSolob > zed relationship read virtualcard parent creditcard:cc_9MSTeIVLW0C6aHtiQSolob --insecure but it returns all virtual cards with parent relation. This is my sample schema. What am I doing wrong? > def user{} > def account { > relation owner: user > permission read = owner > } > definition creditcard { > relation parent: account > relation owner: user > relation viewer: user > > permission read = owner + viewer + parent->read > permission destroy = owner > } > > definition virtualcard { > relation parent: creditcard > relation recipient: user > relation viewer: user > > permission read = recipient + viewer + approver + parent->read > permission spend = recipient > permission requestupdate = recipient > }

looks like a bug in zed

i was able to repro with zed 0.4.0

can you file a bug? https://github.com/authzed/zed/issues/new

will do. thanks

thanks!

@User v0.4.1 of

zed

with a fix is going out now

brew upgrade zed

should fix it now, thanks for the report

Hello, currently evaluating spiced for our project, a quick query, does spicedb support pagination for expand use case? For e.g, show who all have access to give resource. This could return hundreds of record, how can this be returned in paginated way? Any refernce doc would help.

hi @User - pagination support is on the roadmap for Expand and other listing APIs

Is there any tentative date for this? If pagination not supported than is there a limit that could be set to limit depth traversal or number of record that can be returned

nothing firm yet, but Expand only returns depth of 1

the caller decides whether to recurse

Just wanted to ask for some assistance, I'm trying to setup a Production Permissions System and I'm getting the following issue

taking a look

i suspect it's the fine grained permissions that we just rolled out in preparation for some new management capabilities

if you want to make a development tenant, we can convert it to a production tenant when it's business hours again, will that work? they are the same from a performance and reliability perspective

@User ^

ah, that works! I'll create it as a development tenant for now. Thanks!

Hi I was wondering how people build additional support for filtering of listed resources they have access too? For example I have some users who would return millions of resources of a single type and need to sort those based on some metadata on those resources.

@User there are three basic ways this can work 1) post-filter with authzed CheckPermission: Do your database sort and filtering and then send each candidate result through to authzed for permissions checking. This works best when it's likely (but not guaranteed) that a user has access to any given resource. Example: most youtube videos are public 2) pre-filter with authzed LookupResources: Load all of the resources that the user has access to and then send those IDs in to your database as a where clause for further filtering/sorting. This works best if the user is unlikely to be able to view any given resource and most resources will be included in the result set. Example: most google docs are private. 3) (in-work) export an index from Authzed: Perform a special lookup which returns a compressed database-native index which includes the resources the user can see and which can natively be used by the database to filter internally. This is similar to the where clause approach but works with very large number of authorized resources. https://github.com/authzed/spicedb/issues/207

Is there any documentation on how ztokens are generated/implemented?