if you can get the exact error too, that would help

I tried to reproduce with a simple write-delete-write on postgres, no error raised so far

you're not using replication or multi-master, are you?

The err; unable to write relationships: ERROR: duplicate key value violates unique constraint \"uq_relation_tuple_living\" (SQLSTATE 23505)

okay

I think I figured out the problem

it looks like you have two create's occurring at the same time

we'll change that to a nice error

but if that's expected, we recommend using

TOUCH

instead of

CREATE

Two creates?

yeah

if you call

WriteRelationships

to

CREATE

a relationship that already exists, it should fail

which it is, but the error message is not nice

CREATE

is: only create this relationship if it doesn't already exist, otherwise fail

TOUCH

is: create the relationship if it does not exist, otherwise no-op

Ah but my point being the relationship shouldn't exist as we've called delete on it earlier?

it might though if you end up having another caller writing it

if you anticipate any scenario where the calls may overlap, TOUCH is the operation to use

or use a Precondition to check it isn't present before CREATE

Yeah I kinda gathered from the error message that it was trying to write the relation and the relation already existed, just baffled as to how when we deleted it the call earlier

I'll have a proper look tomorrow though

either way, I'll make the error message nicer to indicate which relationship(s) conflicted

👍 thanks for your help Joey

Is there a timeline for https://github.com/authzed/authzed-go/blob/main/proto/authzed/api/v1/permission_service_grpc.pb.go#L49 (LookupSubjects) official go release?

i don't think there's a timeline, just the next release since it's there, but just not cut

we're due for a release, so i'd think very soon

In my last project I had to implement permissions based on azure active directory groups (roles) in combination with data related permissions --> is a user owner of an entity, is an user a manager of the owner of an entity. For this project we implemented a custom solution to facilitate the data based permissions. A week ago I found out about Spicedb and I find the project very interesting. However I was wondering how to use it, to implement the use case of my last project. Would you use a hybrid approach: combine Azure AD groups for the groups (roles) and use Spicedb for the data related permissions. Or do you just sync all the users of the AD groups to Spicedb? Or is there another solution available that I am missing?

One option would be to build a SCIM integration with SpiceDB that writes relationships based on claims (e.g. roles). You could have a much richer data model in SpiceDB and use those relationships as a bridge into that model, so that not everything has to be as coarse-grained as AD.

Hi guys, im reading through the docs of spiceDB which sounds very promising. We have a quite complex domain model, where user can be in a team, which is part of an organization. Being a member of a team grants the user access to all the resources that are in this team (imagine that being a list of files for example). This user can have further permissions on files, that were given him personally. Is it possible to get a list of all resources that a user has access to?

And how does this integrate with existing solutions - for example we would need to page through a list of these resources that are accissible by this user. This is currently done via Elastic where our business logic "knows" which resources the user has access to. If this part can be extracted to spicedb, one would need to figure out a solution, on how to retrieve these resources