844600078504951838 #spicedb

Channels

spicedb

test-forum

zanzibar

Andy

07/04/2022, 4:34 PM

So would you do a call to grab all teams this user has access to under the org?

Andy

07/04/2022, 4:35 PM

and then, for each team, call DeleteRelationships?

Singha1

07/04/2022, 4:35 PM

So how graph is maintained ? Is there any document to read for it, I am just trying to understand

Joey

07/04/2022, 4:42 PM

you can just use delete relationships over the team member relation for the user, without specifying the team ID

Andy

07/04/2022, 6:35 PM

As users can be part of multiple teams (in multiple orgs) I think I'll need to find all teams under the org they've been promoted to, and then revoke permissions for those teams for that user 🤯

Joey

07/04/2022, 6:41 PM

If the team membership is based on being part of a single relation, then no. You can just delete the user from that relation for all teams, in a single call

Andy

07/04/2022, 6:42 PM

i'll write some integration tests and give it a whirl then, cheers big man joey ❤️

Joey

07/04/2022, 6:58 PM

let me know if you need any pointers

vad

07/05/2022, 7:10 AM

the strange thing is that memory spikes when I start writing relations that are not returned by Lookup. Lookup is always for User u1, and I write relations for other Users unrelated to User u1 (ie. not in the same "group")

vad

07/05/2022, 7:12 AM

BTW is

--dispatch-cache-max-cost=0

that you're suggesting?

Singha1

07/05/2022, 10:07 AM

Hi I want to achieve cascaded permission, for example, 1. Expense report is created/ edited/ deleted by owner 2. Owner's supervisor can approve it. 3. Supervisor's supervisor should also be able to approve expense report.

Singha1

07/05/2022, 10:07 AM

With this Schema I am able to achieve top 2

Singha1

07/05/2022, 10:07 AM

definition user { relation supervisor : user } definition expense_report { relation owner : user permission edit = owner permission delete = owner permission approve = owner -> supervisor }

Singha1

07/05/2022, 10:08 AM

How to achieve the third one as well

Singha1

07/05/2022, 10:18 AM

Test data

Singha1

07/05/2022, 10:18 AM

user:alex#supervisor@user:barnes user:barnes#supervisor@user:peter expense_report:report_1#owner@user:alex

Singha1

07/05/2022, 1:26 PM

I want to make sure assertion -> expense_report:report_1#approve@user:peter , passes

Joey

07/05/2022, 2:10 PM

yup

Joey

07/05/2022, 2:11 PM

definition user {
    relation supervisor : user
    permission approve = supervisor + supervisor->approve
}

definition expense_report {
    relation owner : user

    permission edit = owner
    permission delete = owner
    permission approve = owner->approve
}

Singha1

07/05/2022, 2:12 PM

it works, thanks Joey !!

Andy

07/05/2022, 4:18 PM

unfortunately could not do this, we don't actually create & store the team relations in spicedb just yet 😦 only organization stuff

Joey

07/05/2022, 4:20 PM

ah, that'd make it a bit harder

Henko

07/06/2022, 4:31 AM

Hi! I'm trying to call the Watch API through HTTP locally, but I'm always getting 404, whatever body I'm sending. I thought all of the params are optional. Other HTTP API endpoints are working fine. I'm running spicedb on docker. What's the trick? I can't find any help.

curl --location --request POST 'http://localhost:8443/v1/watch' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer somerandomkeyhere' \
--data-raw '{}'

And I'm getting:

HTTP 404
{
    "code": 5,
    "message": "Not Found",
    "details": []
}

Joey

07/06/2022, 4:41 AM

looks like a possible bug in the rest gateway; will have to take a look in the morning. if it is indeed a bug, we can fix it tomorrow

Henko

07/06/2022, 4:45 AM

Thanks! Should I create a ticket on github for it? I just checked and the other watch endpoint is also returning 404:

/v1alpha1/lookupwatch

-> 404

Joey

07/06/2022, 4:47 AM

lookupwatch isn't implemented yet

Joey

07/06/2022, 4:47 AM

so that's expected

Joey

07/06/2022, 4:47 AM

watch should be working though

Joey

07/06/2022, 4:47 AM

and sure, create an issue and I'll test it in the morning

Henko

07/06/2022, 4:58 AM

ok, thx: https://github.com/authzed/spicedb/issues/684