Is the following enough to setup the client?

client = Client( "localhost:50051", insecure_bearer_token_credentials("somerandomkeyhere"), )

that looks roughly correct

is it not working for you?

The permission checks are not working. for example: emilia = SubjectReference( object=ObjectReference( object_type="blog/user", object_id="emilia", ) ) beatrice = SubjectReference( object=ObjectReference( object_type="blog/user", object_id="beatrice", ) ) post_one = ObjectReference(object_type="blog/post", object_id="1") resp = client.CheckPermission( CheckPermissionRequest( resource=post_one, permission="read", subject=emilia ) ) assert resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION

produces error: Traceback (most recent call last): File "C:\Users\mimisss\Documents\spicedb\check_permissions.py", line 30, in resp = client.CheckPermission( File "C:\Users\mimisss\AppData\Local\Programs\Python\Python310\lib\site-packages\grpc\_channel.py", line 946, in __call__ return _end_unary_response_blocking(state, call, False, None) File "C:\Users\mimisss\AppData\Local\Programs\Python\Python310\lib\site-packages\grpc\_channel.py", line 849, in _end_unary_response_blocking raise _InactiveRpcError(state) grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with: status = StatusCode.FAILED_PRECONDITION details = "failed precondition: object definition

blog/user

not found" debug_error_string = "{"created":"@1648836977.003000000","description":"Error received from peer ipv6:[::1]:50051","file":"src/core/lib/surface/call.cc","file_line":904,"grpc_message":"failed precondition: object definition

blog/user

not found","grpc_status":9}"

even though the definitions, relations and permissions are set and saved in the datastore.

everything was working when no datastore was specified. I've executed: spicedb migrate head --datastore-engine=postgres --datastore-conn-uri="postgres://postgres:password@localhost:5432/spicedb?sslmode=disable" and: spicedb serve --grpc-preshared-key "somerandomkeyhere" --datastore-engine=postgres --datastore-conn-uri="postgres://postgres:password@localhost:5432/spicedb?sslmode=disable"

after you migrated over to postgres did you re-upload your schema with a call to

WriteSchema

?

just re-uploaded. Same error.

The funny thing is, on first run, the first and second assertions work; then error. On second run, the first assertion works; then error. On third run, no assertion works; error.

try using zedtokens or setting your consistency mode to fully consistent

are you running postgres on windows?

yes

ah, you're probably getting hit with the bug that this PR fixes: https://github.com/authzed/spicedb/pull/495/files

it normally takes 5-10 seconds for spicedb to converge with recently update data, but due to windows not using a UTC hardware clock it takes hours to converge

Does passing the zedtoken to CheckPermissionRequest, fix it?

btw, how to pass the zedtoken to CheckPermissionRequest (or CheckPermission)? What's the property name?

then you want to use

AtLeastAsFresh

consistency

or you can just use

FullyConsistent

consistency

I think either should fix it

Good.

Thanks.

Right. It works. So, one could say windows, unintentionally, imposes high consistency level 😛

now I KNOW it's april fool's day

🙂

Thank you very much.

spicedb's small docker image size and in-memory store for testing make it really nice to use with https://github.com/testcontainers

Yep! Make sure you check out the serve-testing command too, which gives you an isolated schema and data per access token.