unless you need them

if you can write everything out, its preferrable

in previous life, I used Roles with hundred+ permissions

very fine-grained access with very simple checking, looking for a way to model that

you could in theory use user-defined roles: https://authzed.com/blog/user-defined-roles/

and then you craft custom roles with distinct sets of permissions

ultimately, however, you need to check if the user can do something

looks promising, thank you

Hi! Do you have an estimated timeline for the lookupwatch implementation? I saw that there is a draft PR for it, but it seems that it has not been touched for 6 months. 😦 https://github.com/authzed/spicedb/pull/326 Is it still an active development? Is there a problem with it? I would need it to implement a local permission cache in postgres for our microservices that are performing complicated ACL aware queries in sql right now. Pre and post filtering is not an option due to the high number of resources. See my old question here: https://github.com/authzed/spicedb/issues/280

no firm timeline as of right now; the first part necessary for it (ReachableResources) landed about a month ago. I suspect we'll continue working on it at the end of the summer

I see, thank you! I just had this creazy thought, and wanted to check what you think about it: if I really need the lookupwatch api now and don’t really need the watch api in general, would it be stupid to flip subjects and resources in my application? So that I would add my users as resources instead of subjects and my entities as subjects? That way I could just use the already existing watch api to look for changes about what entities a user can access… Is the graph symmetric in this sense? Is it safe to do a switch like this?

watch API only returns which relationships are changes

changed*

LookupWatch will be walking the graph in both directions based on that

you could probably write a simple LookupWatch yourself: now that ReachableResources is there, its fairly straightforward to do

the hard part (and why it hasn't been done yet) is doing so in a way that scales to very large datasets

oh interesting, I misunderstood the watch api then a bit…

watch returns which relationships were created, touched or deleted

We are trying to solve the problem that we have a huge dataset and also complex postgres queries for listing a filtering entities along with access control checks through custom roles. We are considering using spicedb to extract authorization logic because other microservices would want to use the same, but the solution poses a lot of challenges around filtering two big lists from two different sources. Neither post nor pre filtering would work. So we were thinking about synchronizing the permission bitmap into our postgres database so we can join that ti our existing queries. Is that a common scenario?

yes, that's why we intend on building the Tiger cache

for exactly that purpose

but to do so at a scale that will work for VERY large datasets requires ensuring that we can minimize the amount of work necessary to build and update that cache

ReachableResources was step 1 for that

i see. i was reading the proposal about the tiger cache and i was having the question if it would live inside the spicedb service or could it be hosted next to our application and maybe even write its cache into our own database so we would not even have to query those roaring bitmaps but they would get written into our database directly? would something like this be feasible?

it would be hosted next to SpiceDB

LookupWatch you could instead store in your DB directly

that's why the proposal has two parts: LookupWatch if you want to have a join table in your own DB; tiger if you want to have it externally managed

hmm, that makes sense, thank you for the explanation! 🙂 i’m very interested to see how this goes

keep an eye on the issue: I hope to have some progress on it next month

i will! that would be great! until then : do you have a grpc or http api for the reachableresources implementation? so i could start experimenting with it?