Also, how do I truncate all relationships in a permissions system?

OK. Piping the results of

zed relationship read

into

zed relationship delete

. Would be cool if a bulk mode existed and if

zed

didn't switch to JSON mode once a pipe is attached.

Is there no way to read relationships cross-definition? For for instance;

book:1#reader@role:1#member
movie:1#reader@role:1#member

Providing

role:1#member

, I'd like to get a list,

book:1#reader, movie:1#reader

There is the

ReadRelationships

method, but that forces me to provide a resource type. The workaround is to make a ReadRelationships RPC for each resource type, but it'd be great to be able to omit that and just get a full list

@User V1 API has a

DeleteRelationships

call which you can use to delete in bulk based on filters

@User in the Zanzibar paper, read/write/delete operations always specify the object-type as a required parameter, presumably for sharding/perf reasons. Deviating from that has not been something we've decided to embrace yet.

I actually was mistaken here. We do also allow you to just specify the kube DNS, which works, but syncs at an interval that is decoupled from kube events. I'm going to add docs for this asap.

Makes sense. I’ll just iterate over them

hi blake!

hi 👋 When using a schema such as:

definition example/team {
    relation member: user
}

definition example/user {}

definition example/document {
    relation member: user | team#member

    permission edit = member
}

If I want expand the permissions for a given document, if the permission is given through a team membership, it doesn't expand up to the user level. I tried changing the relation to:

relation member: user | team

, excluding the

#member

part. But then the check doesn't work 🤔 What would be the correct way to define that a document member can be either a user or a team member, so that then the expand also expands team membership?

unfortunately expand doesn't recursively expand automatically, you'll have to call expand yourself to expand the team membership

the version with

team#member

looks correct to me at first glance

we have a version of expand which works recursively for our developer API, we may add that as an option to the API at some point, it can be a very expensive call that returns a large amount of data, so we've been waiting on the supporting user use-cases

We are planning to use SpiceDB for our Authz service implementation, we have plenty of use cases like the one above 🙂

A "hack" for this would be to create a different relationship for teams:

definition example/team {
    relation member: user
}

definition example/user {}

definition example/document {
    relation member: example/user
    relation teammember: example/team

    permission edit = member + teammember->member
}

From what I've tested this endsup expanding team membership, but isn't as neat as the other schema.

Hi, is there documentation anywhere for configuring the spicedb docker image?

or would I just use a custom dockerfile with a modified

CMD

?

You can pass env vars or flags to the docker run command, unless you're trying to to something else.

What exactly are you trying to configure?

Well I'm setting up a docker-compose environment with a psql server running in a sibling container

Yeah I can just modify the command options from compose

cool! yep, so any flag in spicedb can be configured with an environment variable

SPICEDB_FLAG_NAME

or you can pass them all as args

take a look at the sample k8s config: https://github.com/authzed/spicedb/blob/main/k8s/basic.yaml#L63-L67

Appreciate it!

One more question, where is the data directory on the docker image so I can attach a volume to it?