as for a lack of an index, we probably need to add it

@User PR issued

> the query is that way so we can batch it With the

limit

you added in the PR, that makes sense 😄

I have a few concern about migrations: are we expected to run

spicedb migrate head

after each SpiceDB release? - Are they guaranteed to be backward-compatible? - Are they guaranteed to be lock-free? - Apparently not: this one is a

CREATE INDEX

which takes a exclusive lock on the table. That's quite a big issue, it would mean serious disruption on a live system

no and in theory, but I apparently forgot that index creations in PG take locks by default

and yes, you are expected to do so, although in practice we don't see many migrations once the needed indexes are fully figured out

Is it possible to split the schema definition into multiple files? The only solution I can see is to have some tool that merges before feeding it to SpiceDB

That’s the best we have for now. There are whole schema optimizations that happen before it is accepted, and you remove relations and permissions by not declaring them on a subsequent upload.

hmm, looks like I will have to write some higher-level language tool for pre-processing the schema, as even with few objects and permissions, an RBAC-style schema gets pretty huge.

Can you open an issue on the repo with your use cases and a proposal?

ok. Is there a convention for grouping definitions? The prefix isn't sort of enough, and it seems like you can't use any special symbols and are limited to a single affix (single

/

)

There are no conventions that span companies AFAIK

Is there a technical reason why only a single divider

/

is permitted? I have not looked too deeply in how the underlying DB is managed, so I am assuming that the prefix is actually the the DB tenant?

We use it for tenant isolation on authzed.com, it’s not split out in the database (as of now)

Ah, so there is no actual technical limitation on how many dividers there could be, it's just a soft limitation?

Correct

There is a hard limitation on the total number of characters though

Oh, what is the hard character limit?

Also, would you be willing to accept a PR that removes the soft-limit on dividers

/

?

128

We would have to have a discussion, but if it’s well justified it would be likely to go in

As no other special characters are allowed, that seems to be the only way to logically nest the definitions.

I’m more interested in why there is such a large number of definitions to begin with, maybe there is a better way to model it

Most of the actual apps we have modeled have < 20 object types

Vilsol had to go for a bit; I believe we intend on having more than 20 object types; our use case is IaaS oriented with a large array of services

We are planning out the authorization schema for a growing PaaS with several SaaS offerings, and as the granularity of the permissions (with custom roles) and services go up, the definition balloons

yeah, I've definitely experienced that with the relations/permissions within an object definition

we've been thinking about what it would look like to have traits/inheritance/interfaces for object definitions

We will most likely end up with some sort of generative approach within a higher level of abstraction, and most likely a tool that would pre-process a language similar to GraphQL, where you can "extend" a type from another file.

like you could define a trait

CRUD-able

for things that have a minimum set of permissions for

read, update, delete