844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

Jake

05/06/2022, 5:43 PM

Then you don’t need a separate lookup table, they can just be decoded

Joey

05/06/2022, 5:46 PM

recommendation is url safe base64

nshttpd

05/06/2022, 5:48 PM

we had tossed that out there and decided not to and now I can't remember why now though. Let me go change the code try that. Thanks

dantheman

05/06/2022, 7:44 PM

Has there been any consideration of generating typed libraries from your schema that include the subjects/resources, permissions, and relation strings to avoid needing to keep them in sync manually in code?

williamdclt

05/06/2022, 8:04 PM

whatever the Expected Relationships tab does, couldn't it be done by ExpandPermissionTree itself? I'm pretty much reimplementing it poorly I feel!

Joey

05/06/2022, 8:04 PM

ExpandPermissionTree is explicitly not designed for that

Joey

05/06/2022, 8:04 PM

that's what LookupSubjects is going to do

Joey

05/06/2022, 8:05 PM

ExpandPermissionsTree, as its name implies, is designed to return a tree view, matching the structure of the schema

Joey

05/06/2022, 8:05 PM

LookupSubjects will run the calculations to "simplify" the tree down into a set of subjects

williamdclt

05/06/2022, 8:12 PM

Fair enough

Joey

05/06/2022, 8:14 PM

does sounds like LookupSubjects is needed by a bunch of people though

Joey

05/06/2022, 8:14 PM

so we'd appreciate feedback on that issue

williamdclt

05/06/2022, 8:32 PM

I'll take a look soon!

yetitwo

05/06/2022, 9:13 PM

can spicedb's postgres backend be configured with environment vars instead of CLI flags?

yetitwo

05/06/2022, 9:15 PM

ah found it: https://docs.authzed.com/spicedb/installing#flags

ecordell

05/06/2022, 9:16 PM

yep! beat me to it

ecordell

05/06/2022, 9:16 PM

we have discussed that idea a bit, but I'm not sure if there's a github issue for it yet

ecordell

05/06/2022, 9:17 PM

if you have a specific need or use-case in mind it would be helpful if you could write it up in an issue

crafterix

05/09/2022, 9:53 AM

Yes, I have a lot of intersections and unions, but I don't really use exclusions. I have rules that look like this:

// Roles
permission guest = assignees & company->guest;
permission member = assignees & company->member;
permission admin = admins + company->admin;
permission at_least_member = member + admin;
permission at_least_guest = guest + at_least_member;

permission access = at_least_guest;

permission access = (task->access & project->at_least_member) + (creator & project->member);

crafterix

05/09/2022, 10:05 AM

Do you have a github issue for this?

Joey

05/09/2022, 7:30 PM

@crafterix no, but its under active development. The first PR towards changing Lookup can be found here: https://github.com/authzed/spicedb/pull/517

shubhamsinha

05/10/2022, 10:58 PM

Just wanted to check if I am doing this right . So I have a schema for a resource:

definition alert {
    relation company: company
        relation user: user

    permission update_alert = user
    permission delete_alert = company
    permission get_alert = company
    permission get_metric_alert_history = company
}

The use case is that anyone in the company can delete an alert , get alert details and get alert history. However, only the user that created the alert can update it. Does this mean that when an alert is created I need to create two sets of permissions: One with the company and another one with the user? Is there a better way to write the schema?

Jake

05/10/2022, 11:18 PM

definition user {}

definition company {
    relation user: user
}

definition alert {
    relation creator: user
    relation company: company

    permission update_alert = creator
    permission delete_alert = company->user
    permission get_alert = company->user
    permission get_metric_alert_history = company->user
}

Jake

05/10/2022, 11:19 PM

> Does this mean that when an alert is created I need to create two sets of permissions: One with the company and another one with the user? Yes this is likely how you will want to model it

Jake

05/10/2022, 11:21 PM

if you absolutely wanted to do only one relationships per alert, and you wanted to front-load by creating more relationships between users and companies, you could do:

/** More denormalized, assumes the all users belong to only one company, and you can infer an alert's company by its creator user */
definition user {
    relation company: company
    permission company_users = company->user
}

definition company {
    relation user: user
}

definition alert {
    relation creator: user

    permission update_alert = creator
    permission delete_alert = creator->company_users
    permission get_alert = creator->company_users
    permission get_metric_alert_history = creator->company_users
}

Jake

05/10/2022, 11:22 PM

@shubhamsinha ^

shubhamsinha

05/10/2022, 11:33 PM

Got it thanks @Jake . Are there any drawbacks of going with the first approach of creating the two sets of permissions? Just making sure I am not going against a best practice

Jake

05/10/2022, 11:33 PM

Nope, totally fine and you can create them atomically with a single write call

shubhamsinha

05/10/2022, 11:35 PM

Right makes sense. Thanks for your help!

LemmeCode

05/11/2022, 1:40 AM

Hi there guys. I'm trying to study and understand better how large-scale applications handle authorization and authentication. I started with things like Keycloak which was giving me pretty much everything authentication&authorization out of the box. I found out about SpiceDB and Zanzibar and really liked it and I'm feeling like now I need to understand a little better how they handle things but one thing still doesn't enter my head. I'm reading A LOT but I can't figure out this: if SpiceDB can help me with authorization, what about the authentication portion? How do those companies handle that? For example, I found out about OIDC but it's a layer on top of OAuth 2.0 which is for authorization so where does SpiceDB enter here? Keycloak gives me not only authentication but also user storage and stuff, do you guys know other alternatives for that? Like authentication & storage only so I can use it along with SpiceDB? Authentication and authorization give me goosebumps, sooo complex haha. Thank you guys.