844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

Joey

05/19/2022, 7:31 PM

are the permissions defined on the department for all managers or only specific managers?

Prchowdh

05/19/2022, 7:48 PM

didn't get the question

Prchowdh

05/19/2022, 7:48 PM

@Joey could you please elaborate

Joey

05/19/2022, 8:09 PM

@Prchowdh not 100% sure on the design of what you want, but one way might be something like:

definition user {}

definition department {
  relation manager: user
  relation view_employee: department#manager
  relation transfer_employee: department#manager
}

definition employee {
  relation department: department
  permission view = department->view_employee
  permission transfer = department->transfer_employee
}

Joey

05/19/2022, 8:09 PM

you'd write a relationship from the department to its

manager

relation into

view_employee

if managers can view employees

Joey

05/19/2022, 8:09 PM

same for

transfer_employee

Joey

05/19/2022, 8:09 PM

that grants the ability to the managers of the department to view or transfer, respectively

yetitwo

05/20/2022, 5:34 PM

are zedtokens opaque identifiers, or is there some way to take a timestamp and reverse-engineer a zedtoken? we're trying to figure out how auditing authzed/spicedb would work, and one of the questions we'd need to ask is "what did user X have access to at time Y"

Joey

05/20/2022, 6:32 PM

@yetitwo they are officially opaque to API callers right now

Joey

05/20/2022, 6:33 PM

the problem with "what did user X have access to at time Y" is that datastores GC after a set window (usually 24 hours, but some sooner)

Singha1

05/20/2022, 8:02 PM

Let's say one is building a single page application, there are multiple permissions check after login based on user profile. What's recommendations in such cases, makes those tens of remote call for each permissions check ?

Joey

05/20/2022, 8:48 PM

Make them in parallel and return the set to the front end

HOPE

05/23/2022, 9:46 AM

Hi I have a question about lookup, current say I have

organization

under which has

workspace

workspace

has permission

view

. I'd like to get all workspaces that a user has view permission under a certain organization. How can I achieve this? Thank you..

Jake

05/23/2022, 1:47 PM

I answered this a few days ago: https://discord.com/channels/844600078504951838/844600078948630559/976481154091851776

Jake

05/23/2022, 1:48 PM

you could also do it like google drive does, and just have separate copies of the user for each org

daniso

05/23/2022, 4:24 PM

Hello, I have a question. Is there a way to retrieve all permission that are contained in a relationship? For example: given a schema like:

definition resource {
    relation manager: user
    relation owner: user
    
    permission own = owner
    permission manage = manager + own
}

What I'd like to have is, given

resource_type=resource, relation=owner

return a list of permission an owner has on the resource type

resource

, in this case it would be

[own, manage]

. while if I query

manager

would be

[manage]

. This could be useful so that I don't have to hardcode the permission hierarchy in my code, but query it directly from spice

Joey

05/23/2022, 4:39 PM

@daniso currently, no, you need to call check on each permission. However, a number of people have raised similar requests, so I'd suggest making a proposal for a new API as an issue

Joey

05/23/2022, 4:40 PM

look at https://github.com/authzed/spicedb/issues/597 for the general proposal format

Prchowdh

05/23/2022, 5:01 PM

Team - How to provide permission on all resource instance , rather then doing it for a specific identifier

Joey

05/23/2022, 5:24 PM

@Prchowdh you mean applying a permission to every single resource?

Prchowdh

05/23/2022, 5:25 PM

yes

Joey

05/23/2022, 5:25 PM

so, the current "best" way to do so is defining a singleton container for the resources

Joey

05/23/2022, 5:25 PM

something like

Joey

05/23/2022, 5:26 PM

definition container {
  relation viewer: user
  permission view = viewer
}

definition resource {
  relation container: container
  relation viewer: user
  permission view = viewer + container->view
}

Joey

05/23/2022, 5:26 PM

then for every resource, when it is created, you add a relationship between the resource and the singleton container

Joey

05/23/2022, 5:26 PM

https://github.com/authzed/spicedb/issues/346 discusses some proposed alternatives

Singha1

05/23/2022, 6:03 PM

What pattern can we use to filter data based on user authorization or search output ?

Joey

05/23/2022, 6:12 PM

@Singha1 this is known as the "ACL Aware Filtering" problem. There are currently two options: (1) pre-filtering: use

LookupResources

to find the accessible resources and then pass that list to your search (2) post-filtering: conduct the search and

Check

each result after the fact

Joey

05/23/2022, 6:13 PM

https://github.com/authzed/spicedb/issues/280 has discussion

Singha1

05/23/2022, 6:20 PM

Option 2 is good for only small data set not for large data set.