Looking forward to it!

is there a reason you prefer MySQL to Postgres?

We have a large TiDB cluster that's in use across a lot of systems. While we admire Postgres and all, it's just not widely implemented at our company so Spice is using a tiny cockroach cluster. There's no issue but the TiDB cluster is practically bulletproof with how large the cluster is.

Do you have any guidance around schema migration (as in calling WriteSchemaRequest with new content)? What happens to relationships that were written for a definition "foo" when "foo" is removed from the schema? Are the orphaned? Is the new schema rejected?

the new schema is rejected

if you intend to remove a relation, you need to delete its relationships first

or if you intend to remove a supported type

one option, if you're not planning on using it, is to just leave the relation unused by any permission, then delete later

but that means having a post-schema update cleanup

WriteSchema feels like a very course-grained API. I'm surprised there isn't something like CreateDefinition(), CreateRelation(), etc. Then you could have a terraform provider for SchemaService.

v0 had the ability to create individual definitions, but we found it actually made things harder to understand

long term, we plan to have a more well-defined migration system for schemas

I feel like both are valuable. The DSL is great for getting started, examples, and small deployments, but in a large organization, the fine-grained API would be very valuable

part of the problem with a more fine grained API is that it makes optimizing and checking harder

as in, there is a runtime performance penalty for CheckPermission calls?

every time the schema is updated, we need to validate it

when we have the whole schema, it can be validated against itself

if you're updating, say, a single relation, then we'd have to load everything else

so there is a performance penalty for the update

its minor, but it is a consideration

how is that different from me adding a new relation line to my monolithic schema file and calling WriteSchema?

Aren't you checking the whole thing by definition?

no, we diff it

and then validate the changes

how often are you making schema changes of such a small nature?

Our org has ~100 microservices each with their own teams managing them. Imagine shared "user" and "group" definitions, and then each microservice has its own definitions for the resource oriented APIs that they expose. We have production, staging, and development environments, etc. A single file or one file per environment doesn't scale very well in our environment.

yeah

this is something we're investigating identifying

but I suspect it won't be at the "relation" or "definition" level

I would like to be able to delegate a portion of the definition namespace to each microservice team. We already do this kind of thing for provisioning other resources using terraform. We use OWNERS files in our git repository to restrict who can change files on a per directory basis. I could probably rig up some system that traverses some directory hierarchy and globs all the definitions together into a single file.