they are meant to be opaque to the caller

so there is no documentation of how they are implemented, though you can find the code pretty easily

I'm working on a similar consistency problem in another domain, and I was just curious how you implemented the point-in-time view on top of cockroachdb

for cockroach, the zedtoken includes the logical timestamp from the cluster. we extract that and pick a timestamp to use in AOST queries: https://www.cockroachlabs.com/docs/stable/as-of-system-time.html

Hi! Having an issue with this schema. https://play.authzed.com/s/8tnBOxWGuYf7/schema

When you go to run the assertions it gives an error message rather than a pass/fail.

When I run this on my actual database it seems to send spicedb into conniptions. The log goes crazy making queries on

relation_tuple

and

namespace_config

and, if I leave it on overnight, never stops.

I imagine I've misconfigured something in the zedfile but I'd appreciate some eyes on it.

Hello! We've been testing a new kubernetes deployment of spicedb and noticed some interesting verbose/debug dispatch logs. We were wondering if this behavior is normal. thread ->

Hi Jake: Is there any comparison doc between OPA and AuthZed(Zanzibar Implementation). I understand OPA has (PIP, PEP(API Gateway) and PDP) . Mapping to authzed I presume has (PIP(ZED), APIGW, PEP(spicedb)). Is that a correct abstraction?

likely a circular schema or data dependency

although SpiceDB should hit max depth and error

There is no translation doc per-se. I'm not super familiar with OPA terminology either, but from a cursory google: PEP -> policy enforcement point -> in zed this would most likely be an if statement calling out to one of our client libraries in your code, or a custom written plugin to act as an authorization middleware in your framework of choice PDP -> policy decision point -> authzed/spicedb itself PIP -> policy information point -> no such equivalent in authzed, you can use zed/playground to figure out if your schemas are working/correct, and then you can use zed to run specific queries APIGW -> not an OPA/ABAC component? presumably this means using a PEP for guarding API calls, which again you would do with a custom middleware

Thanks. Yes. That is correct. It is not an OPA/ABAC component

yeah, @User you're hitting max depth:

zed validate authzed-download-d0f351.yaml 
Error: max depth exceeded

which either means its SUPER deep, or there is as recursive data walk

There's also

--dispatch-max-depth

flag, if you want to set it super high and see if it does terminate. It's probably a cycle, though.

Hi Jake: Some of our customers are asking is - "Can we use OPA Rego to define our policies - agnostic to any PEP(spicedb or OPA) and make a choice of spicedb/OPA as a late binding decision?". Developers are sold on OPA Rego from policy definition perspective but DevNetOps and DevSecOps are not. Hence we are trying to balance both type of users

No, that's not how Authzed works at all, Authzed is centralized and optimized for read-heavy workloads by requiring all data to be given over to Authzed in advance, OPA is decentralized and optimized for write-heavy workloads by requiring the user to go and fetch all data and policy and give it to the PDP at decision time

We are completely sold on centralized Authzed model from PEP perspective(once we have the constraints implemented in spicedb). Defining and validating the user-intent is where we are debating. BTW OPA can run in both centralized and decentralized with a caveat that the policy states are maintained in-memory. Loss of the policy states(due to OPA restart/crash) requires re-download of the states from the controller(Bundle Manager)

Hi Jake: Can we set up a technical call as we are trying to make a decision wrt the spicedb?

I came up with something, but it's not very good: https://play.authzed.com/s/wmxWSUBCX3pu/schema

// Compute group space collisions
//   This means - any groups that have colliding spaces. EG
//     groupA{ all=RW, r1=nil } + groupB{ all=RW, r2=nil } + groupC{ all=R, r2 = nil, r3 =n nil } 
//   Each of these groups provides a default, which means it operates on every resource.
//   Any other group definition that explicitly removes a group will collide with that space.
//   So, for each of these groups, compute all possible membership tuples
//   (A, B) + (A, C) + (B, C)
// 
// This means n!/(2*(n-2)!) * n extra rules

uninherit_group:uninherit_r1#except@group:A_B#member
uninherit_group:uninherit_r1#except@group:A_C#member
uninherit_group:uninherit_r1#except@group:B_C#member

uninherit_group:uninherit_r2#except@group:A_B#member
uninherit_group:uninherit_r2#except@group:A_C#member
uninherit_group:uninherit_r2#except@group:B_C#member

uninherit_group:uninherit_r3#except@group:A_B#member
uninherit_group:uninherit_r3#except@group:A_C#member
uninherit_group:uninherit_r3#except@group:B_C#member

this certainly feels like a bad solution

yeah... not great

if we supported computed permissions on the left side of arrows

you could do

(reader - excluded)->member

but that's a purely speculative idea at present

Hello, just curious if Rest api are supported over Spicedb standalone? Or it works via Authzed only so as to obtain token

You can also run the REST API Gateway in spicedb, yes

Thanks for the quick reply, how would I go about acquiring the token required to invoke any api? On starting SpiceDB docker container I see below 3 ports , but I fail to connect to same via rest api {"level":"info","addr":":50051","network":"tcp","prefix":"grpc","time":"2022-03-15T12:14:13Z","message":"grpc server started listening"} {"level":"warn","addr":":8080","prefix":"dashboard","time":"2022-03-15T12:14:13Z","message":"http server serving plaintext"} {"level":"warn","addr":":9090","prefix":"metrics","time":"2022-03-15T12:14:13Z","message":"http server serving plaintext"} Rest api doc I am referring to is : https://petstore.swagger.io/?url=https://raw.githubusercontent.com/authzed/authzed-go/main/proto/apidocs.swagger.json#/

I may be wrong here (not part of the authzed team, just community member) but I believe the token bits are exclusive to the commercial offering.