Thank you for your prompt response! So for this line

permission post_web = owner + ((posters & post_without_moderation) - prevent_post_web - banned)

does it mean no

user

can post as well?

And also for this scenario, does it mean only relation

editor

can post? So

editor

is not considered as a

user

, although each

editor

should be a

user

?

an

owner

could, if I'm reading it correctly

the exclusion (

-

) is within the parens

so the above reads (roughly):

owners and (posters (on posts without moderation), who are non-prevented and who are non-banned people) can post_web

And for non-prevented, it means either all users or all anonymous users?

only if that relationship has been written, yes

could be both

could be neither

so to prevent all

user

, you'd write the relationship:

whatevertype:someobject#prevent_post_web@user:*

similarly for anonymous user:

whatevertype:someobject#prevent_post_web@anonymoususer:*

Clear. Thank you so much!

what does it mean by could be both/neither? how about the example here, I assume

|

specifies a

or

relationship otherwise

sysprefix/user:*

would totally invalidates the existence of writing

sysprefix/user

ahead of it

definition sysprefix/user {}

definition sysprefix/resource {
    /**
     * viewer can be granted to a specific user or granted to *all* users.
     */
    relation viewer: sysprefix/user | sysprefix/user:*
}

The | means what types could be there

So in the above you can make a specific user a viewer

Or any user

the star is a wildcard matching any incoming users

if it can be matched to any incoming users, does it make sense to still matching a particular user?

Sometimes

One resource can be public

Another can be limited to a specific set of users

oh I see

Remember that these are what’s allowed; you still need to write the relationship itself to grant the viewer “role”

thanks for the explanation

Anytime

@everyone We've just created an event for our first office hours on this upcoming Monday! https://discord.gg/HSYK6qee?event=961312434805694494

I would be interested to see an example of how a gRPC-based service could implement https://github.com/googleapis/googleapis/blob/master/google/iam/v1/iam_policy.proto and back the implementation with calls to spicedb. It would be great to take something like https://github.com/GoogleCloudPlatform/python-docs-samples/blob/main/endpoints/bookstore-grpc/bookstore.proto and extend the proto with IAM.

I'm also curious about how to manage spicedb schemas in an environment where you have dozens of microservices, each needing their own schema for service-specific resource types, but sharing a common notion of user and group.

I haven't seen anyone mention this API before. If you implement this API with your application, I imagine that gets you integrations with different parts of GCP?