correct, except that Expand returns more information and is not automatically recursive. LookupSubjects (https://github.com/authzed/spicedb/issues/261) will be the direct opposite of LookupResources

Ahh Okay thanks @Joey . Any timeline planned for this to get published ?

well, I wrote the first major portion of it on Friday

so hopefully no more than a week or two?

you can track the progress in that issue above ^. The draft PR is linked on the bottom

Hi, I have a question about schema. We have Departments and their Teams. Department is the parent of Teams. Do you have any idea how to describe that Team viewer has view permission to the parent Department? Link to test schema https://play.authzed.com/s/KVNk09z5Uv1d/schema There are two invalid assertions, which we need to have valid.

There is a test project that uses the Java client to insert data into spicedb. Then the integration tests run, they test the whole application that consists of a number of microservices. One of those services is responsible for permissions and it uses also the Java client to connect to spicedb. All this in set up with docker containers

Re: this issue I'm still hitting this with v1.11.0. I've dug a little bit: - The

grpc_health_probe

is returning

NOT_SERVING

(screenshot 1) - On SpiceDB side, I'm seeing this log:

{"level":"debug","datastoreReady":false,"dispatchReady":true,"time":"2022-08-08T12:20:53Z","message":"completed dispatcher and datastore readiness checks"}

. That's with LOG_LEVEL=trace. My old service on

v1.7.1

has no problem: pods report healthy and can connect to the DB. Spinning up a new pod on

v.1.7.1

works as well. I can't see anything wrong database-side. How can we know why does SpiceDB think that the datastore isn't ready?

Re this issue

@williamdclt did you migrate the datastore?

It’s possible you are at an older revision

Hey all! My name is Grant, and I'm currently looking into possibly using spiceDB with an Aurora postgres datastore. I am exploring the permissions space for the first time, but just wanted to pop in here and say hello. I really appreciate all of the great content the Authzed team has put out on the interent, it has been very helpful to my understanding of what I am looking for in a permissions engine.

welcome!

One question I had, I see in the docs that PostgresSQL (https://docs.authzed.com/spicedb/selecting-a-datastore#usage-notes-2) is not recommended for global deployments, but it looks like AWS Aurora (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) allows for a global distributed database. Curious on if you all have seen anything that indicates that Aurora * does not * work well with spiceDB globally?

Wondering if anyone else has run into this issue before. We have a SpiceDB server running on a kubernetes cluster and when using the Java client to talk to it, we get a strange TLS error, but when using the

zed

client, things work fine. For some more context, I have the SpiceDB container port forwarded to my machine so I'm running the Java client and the

zed

client from the same place, to the same port. I have configured the client exactly how this is configured: https://github.com/authzed/authzed-java/blob/2a2cbb53334a50fdb6eaa1472973b12557bc2756/examples/v1/App.java#L42-L54 And here is the error

Hi I have a question about schema We

Hey! I have a question on SpiceDB compared to authzed cloud -> does SpiceDB come with any sort of front-end like the authzed playground / web ui to visualise schemas or view the data, or is it just providing the grpc endpoints for use with the cli / accessing programmatically ?

we're working on implementing "personas" in the context of spicedb and its schema. we chose to represent personas as a separate subject, and to define relations as potentially having either a user or persona subject:

definition site {
    relation accesses: user | persona

one of the constraints of personas is that a persona shouldn't grant access to an object that a user wouldn't otherwise have. the way we're currently approaching this is in calling logic, asking for

readPermissions

on both the persona and user and then returning the intersection of the results.

Are the project and binaries still up to date, so we could use it or are there any other recommendation for api integration testing (locally & pipeline)? https://github.com/authzed/zed-testserver

@Saturas 👋🏻 I'd have to check with the team, but I do know that examples on how to do integration testing were recently introduced in our new

examples

repository: https://github.com/authzed/examples/tree/main/integration-testing

examplesintegration-testing at main · a...

Hello! I have a question. Is there any CLI command to "join" the schema

.zed

file with the

.yaml

files for relations to create the unified

.zaml

for running tests?

are there plans to include boolean logic on filters, such as in a DeleteRelationships request? we'd like the ability to write filters that target individual relations, but we'd like to be able to do multiple relations atomically rather than having to fire multiple requests

Hi! Apologies if this question has been asked already. For LookupResources API call, is it possible to get all Resources a Subject has permissions to without defining ObjectType ? Ideally, I would like to get all the Resources (with various ObjectTypes) a Subject has permissions to in one call. If that's not possible, do you have other recommendations to achieve the desired output?

LookupResources API Questions

Hi. I am using the hosted plan, with a "development" permission system. When I try to create a node client, it is taking ~5 seconds to execute the (node)

v1.NewClient

, using the

@authzed/authzed-node

lib. Any ideas on what to look out for on why is it so slow? Thank you

no plans as of this moment; can you expand on the use case? would it just be multiple filters or would you want something more?

instantiating the client involves opening an HTTP2 connection via TLS; could be DNS, could be TLS, could be something in between: I'd see if you can look at delays in on the HTTP side

thank you. let me know if there is anything i can help you with while investigating it. I am calling this from a lambda in aws/sydney region

could be connection overhead since the main nodes are in the US, but 5s is still a lot; its also possible that the lambda simply needs to load a lot of support libs to make that connection; can you see if a subsequent one is faster?