https://authzed.com logo
Powered by
#spicedb
  • a

    Andy

    07/04/2022, 4:34 PM
    So would you do a call to grab all teams this user has access to under the org?
  • a

    Andy

    07/04/2022, 4:35 PM
    and then, for each team, call DeleteRelationships?
  • s

    Singha1

    07/04/2022, 4:35 PM
    So how graph is maintained ? Is there any document to read for it, I am just trying to understand
    j
    • 2
    • 10
  • j

    Joey

    07/04/2022, 4:42 PM
    you can just use delete relationships over the team member relation for the user, without specifying the team ID
  • a

    Andy

    07/04/2022, 6:35 PM
    As users can be part of multiple teams (in multiple orgs) I think I'll need to find all teams under the org they've been promoted to, and then revoke permissions for those teams for that user 🤯
  • j

    Joey

    07/04/2022, 6:41 PM
    If the team membership is based on being part of a single relation, then no. You can just delete the user from that relation for all teams, in a single call
  • a

    Andy

    07/04/2022, 6:42 PM
    i'll write some integration tests and give it a whirl then, cheers big man joey ❤️
  • j

    Joey

    07/04/2022, 6:58 PM
    let me know if you need any pointers
  • v

    vad8615

    07/05/2022, 7:10 AM
    the strange thing is that memory spikes when I start writing relations that are not returned by Lookup. Lookup is always for User u1, and I write relations for other Users unrelated to User u1 (ie. not in the same "group")
  • v

    vad8615

    07/05/2022, 7:12 AM
    BTW is 
    --dispatch-cache-max-cost=0
    that you're suggesting?
  • s

    Singha1

    07/05/2022, 10:07 AM
    Hi I want to achieve cascaded permission, for example,   1. Expense report is created/ edited/ deleted by owner 2. Owner's supervisor can approve it. 3. Supervisor's supervisor should also be able to approve expense report.
  • s

    Singha1

    07/05/2022, 10:07 AM
    With this Schema I am able to achieve top 2
  • s

    Singha1

    07/05/2022, 10:07 AM
    definition user { relation supervisor : user } definition expense_report { relation owner : user permission edit = owner permission delete = owner permission approve = owner -> supervisor }
  • s

    Singha1

    07/05/2022, 10:08 AM
    How to achieve the third one as well
  • s

    Singha1

    07/05/2022, 10:18 AM
    Test data
  • s

    Singha1

    07/05/2022, 10:18 AM
    user:alex#supervisor@user:barnes user:barnes#supervisor@user:peter expense_report:report_1#owner@user:alex
  • s

    Singha1

    07/05/2022, 1:26 PM
    I want to make sure assertion -> expense_report:report_1#approve@user:peter , passes
  • j

    Joey

    07/05/2022, 2:10 PM
    yup
  • j

    Joey

    07/05/2022, 2:11 PM
    Copy code
    definition user {
    relation supervisor : user
    permission approve = supervisor + supervisor->approve
}

definition expense_report {
    relation owner : user

    permission edit = owner
    permission delete = owner
    permission approve = owner->approve
}
  • s

    Singha1

    07/05/2022, 2:12 PM
    it works, thanks Joey !!
  • a

    Andy

    07/05/2022, 4:18 PM
    unfortunately could not do this, we don't actually create & store the team relations in spicedb just yet 😦 only organization stuff
  • j

    Joey

    07/05/2022, 4:20 PM
    ah, that'd make it a bit harder
  • h

    henko8

    07/06/2022, 4:31 AM
    Hi! I'm trying to call the Watch API through HTTP locally, but I'm always getting 404, whatever body I'm sending. I thought all of the params are optional. Other HTTP API endpoints are working fine. I'm running spicedb on docker. What's the trick? I can't find any help.
    Copy code
    curl --location --request POST 'http://localhost:8443/v1/watch' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer somerandomkeyhere' \
--data-raw '{}'
    And I'm getting:
    Copy code
    HTTP 404
{
    "code": 5,
    "message": "Not Found",
    "details": []
}
  • j

    Joey

    07/06/2022, 4:41 AM
    looks like a possible bug in the rest gateway; will have to take a look in the morning. if it is indeed a bug, we can fix it tomorrow
  • h

    henko8

    07/06/2022, 4:45 AM
    Thanks! Should I create a ticket on github for it? I just checked and the other watch endpoint is also returning 404: 
    /v1alpha1/lookupwatch
    -> 404
  • j

    Joey

    07/06/2022, 4:47 AM
    lookupwatch isn't implemented yet
  • j

    Joey

    07/06/2022, 4:47 AM
    so that's expected
  • j

    Joey

    07/06/2022, 4:47 AM
    watch should be working though
  • j

    Joey

    07/06/2022, 4:47 AM
    and sure, create an issue and I'll test it in the morning
  • h

    henko8

    07/06/2022, 4:58 AM
1...176177178...437Latest