844600078504951838 #spicedb

Channels

yetitwo

05/18/2022, 8:07 PM

something idiosyncratic by the look of it 🤔 i found this file in the docs repo that seems to hold most of the meat of it: https://github.com/authzed/docs/blob/main/src/theme/prism-zed-lang.js

yetitwo

05/18/2022, 8:07 PM

and i'd have to figure out how to translate that over to vim

yetitwo

05/18/2022, 8:07 PM

i'll let you know if i get anything useful working

Joey

05/18/2022, 8:18 PM

yep

yetitwo

05/18/2022, 8:26 PM

is it true that

zed schema

will only work on

.zed

files and

zed validate

will only work on full yaml descriptions?

Joey

05/18/2022, 8:31 PM

yes

Joey

05/18/2022, 8:32 PM

validate would otherwise only be a schema parse check, without any validation

Joey

05/18/2022, 8:32 PM

I guess it could also type check, I suppose

Joey

05/18/2022, 8:32 PM

but yes, that's how it is right now

liammoch

05/18/2022, 8:35 PM

@Joey I would love to hear your thoughts on modeling access to each port as a permission. Want to weigh the pros and cons with having potentially lots of permissions in the system. Finally, do let me know if the idea of a default permission is interesting or flawed in some way.

Joey

05/18/2022, 8:36 PM

@liammoch not sure I follow the default permission idea; can you expand upon it?

Joey

05/18/2022, 8:36 PM

for each port as a permission, you'd have a

relation

per port I guess?

liammoch

05/18/2022, 8:43 PM

Yes, something like

definition host {
  relation port8080_users: user
  relation port80_users: user
  relation port23_users: user
  relation port1345_users: user
  relation super_user: user
  permission can_access_port8080 = port8080_users
  permission can_access_port80 = port80_users
  permission can_access_port23 = port23_users
  permission can_access_port1345 = port1345_users
  permission default = super_user
}

If the permission in the check request does not match any of the specific permissions it would be handled as per the default

Singha1

05/18/2022, 8:44 PM

I have following use-case. User has Groups like G1, G2 in Application A R1 (Resource) has viewer relationship with G1 R1 (Resource) has writer relationship with G2 Inside application code before rendering edit button, need to check if user (based on group) has write permission. I will have to make 2 calls for permission check 1 for G1 and 2nd for G2? If user has N groups, this becomes N calls. Because we don't have direct relationship with resource and user, we have only resource to group relationship.

Joey

05/18/2022, 8:47 PM

hmmm.... any interesting thought

Joey

05/18/2022, 8:47 PM

as for the having a permission per port, its perfectly doable

Joey

05/18/2022, 8:48 PM

but it does mean you'll have lots and lots of relations, so not sure it buys you that much in terms of relationships necessary to write

Joey

05/18/2022, 8:48 PM

you can store the relationship between the user and the groups in SpiceDB

Joey

05/18/2022, 8:48 PM

and then just check for the user, if you have the user available

liammoch

05/18/2022, 8:49 PM

It might be a useful trade-off if the system is 'check' heavy as opposed to writes.

Joey

05/18/2022, 8:49 PM

definition group {
  relation member: user
}

definition resource {
  relation viewer: group#member | user
  relation writer: group#member | user

  permission write = writer
  permission view = viewer + write
}

Joey

05/18/2022, 8:50 PM

but you'd still need a relationship between the port relation and the user

Joey

05/18/2022, 8:50 PM

if you have a port object per host+port, its very similar

Joey

05/18/2022, 8:50 PM

but you do save the port->host relationship in your design

aboutblank

05/18/2022, 8:52 PM

Hi there! Is it possible to list all permissions on an object given a subject? I'm trying to answer the question: "what things (permissions) can blog/user:emilia (subject) do on blog/post:1 (object)?"

liammoch

05/18/2022, 8:52 PM

The main advantage is that I don't need to create a hostX_PortY object for every potential port and host (and there could be lots of them) to handle the super user case. And this could potentially be a scale killing cross product

Singha1

05/18/2022, 8:53 PM

Yes we can store in SpiceDB but for few application we don't want to persists user information there

Joey

05/18/2022, 8:53 PM

you have to do a check per permission; you can do so in parallel

Joey

05/18/2022, 8:53 PM

any reason why?

Joey

05/18/2022, 8:54 PM

if you don't link the groups to the users, you'll need to do a check per group