844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

Igor.Shmukler

09/12/2022, 2:37 PM

be my pleasure

radmongoose

09/12/2022, 4:16 PM

Hey all. I'm trying out the spicedb-operator, but am running into an issue. I'm trying to set it up to access spanner which requires setting up workload identity. However the operator seems to create it's own

spicedb

service account and there doesn't seem to be a way to override that.

ecordell

09/12/2022, 4:21 PM

if you create the service account ahead of time with the workload identity annotations, spicedb-operator won't overwrite them

ecordell

09/12/2022, 4:23 PM

that's the simplest workaround for now, we have https://github.com/authzed/spicedb-operator/issues/61 with some other options and tracking improvements in this area. if you have an opinion on the future direction, we'd love to hear it in a comment!

Alsbury

09/12/2022, 9:57 PM

I've spent the last couple of days trying to get a PHP library working so that I could use PHP and SpiceDB over gRPC. Using the Ruby project as my starting point, I was able to get classes to generate. However I've had a lot of issues. Some seem to be with the tooling for generating classes and the bug that put me at a complete standstill may be related to the protobuf PHP extension. The SpiceDB PHP library I created can be found here (it doesn't work): https://github.com/alsbury/chiphpotle The issue that I'm having is documented briefly here: https://github.com/alsbury/chiphpotle/issues/1 If anyone has any ideas on how I can get to the bottom of this, I'm interested in feedback. Getting a working PHP library for SpiceDB would open up SpiceDB to a large community.

Joey

09/12/2022, 10:14 PM

@jzelinskie ^

jzelinskie

09/12/2022, 10:15 PM

spicedb php client

Arash

09/12/2022, 10:21 PM

Hi folks. Is there a way to run the authzed playground locally? For some reason, my browser is unable to download the entire

main.wasm

file. It always fails at around 3 MB.

niodice

09/12/2022, 11:41 PM

Looking for guidance on how I might model some relationships. Suppose I have a

foo

object and I am granting

view

permissions on a

foo

based on the visibility of the

foo

(where visibility is an application logic, and could be

only_me

friends

, or

everyone

. I have a sample schema that works

definition foo {
  relation token: token
  relation friends: foo

  // representing the visibility settings of `foo`. Only 1 of these relations should be logically set at any given time.
  relation viz_me: foo
  relation viz_friends: foo
  relation viz_everyone: token:*

  // intermediary results
  permission friends_tokens = friends->token

  permission view = (viz_everyone + viz_me->token + viz_friends->friends_tokens)
}

But it is a little bit clunky. Suppose for example that a

foo

is configured in the application as

only_me

visibility -- meaning that only tokens with the

token

relation can view it. If that changes to

friends

, then I need to: - Check if

viz_me

viz_everyone

is set, and un-set it - Set

viz_friends

relation This pattern is common in our application and so I'm looking for a way to effectively work with this pattern. Ideally, I'd like to set just one relation and update it with something that represents the set of tokens. I think that this would be possible if I could write a statement like this:

definition foo {
  relation token: token
  relation friends: foo

  relation viz_tokens: token

  permission view = viz_tokens
}

And set the

viz_tokens

, when writing the relationship, to something like

token:*

, or

$THIS->token

, or

$THIS->friends->token

. That way I get an atomic update, and don't need to worry about managing the fact that

Only 1 of these relations should be logically set at any given time.

Joey

09/12/2022, 11:48 PM

well, you can perform multiple updates atomically, so that shouldn't be the primary concern, but I do see why you want it to be simpler

Joey

09/12/2022, 11:49 PM

if this is a common enough pattern across objects, it might possible to do things in a somewhat shared manner; let me give it some thought

Joey

09/12/2022, 11:49 PM

@niodice are the subjects of "friends" tokens as well?

Joey

09/13/2022, 12:06 AM

@niodice take a look at this: https://play.authzed.com/s/91S2iSz_mZ7z/schema. This schema allows you to specify a single type of

visibility

, create one per resource and choose which level based on the permission referenced

niodice

09/13/2022, 12:39 AM

ohh, @Joey this is interesting. i think this is more along the lines of what I was looking to do

niodice

09/13/2022, 12:39 AM

Lemme digest it a bit and circle back with any questions

niodice

09/13/2022, 1:03 AM

> well, you can perform multiple updates atomically, so that shouldn't be the primary concern, but I do see why you want it to be simpler What happens in one update if a subset of the relations don't exist and I try to delete them? Also I'm looking closer at your schema. It does simplify things, but it requires a bidirectional relationship. For example, I need to both set

document::visibility

and

visibility::parent

relationships. Is there a way to avoid such a cyclic dependency?

Joey

09/13/2022, 1:04 AM

its only cyclic if it were to walk back to itself

Joey

09/13/2022, 1:04 AM

it is bidirectional though

Joey

09/13/2022, 1:04 AM

and if you do want to share a type, its necessary

Joey

09/13/2022, 1:04 AM

unless you define the

owner

, etc on the visibility itself

Joey

09/13/2022, 1:04 AM

in which case, then you don't need to have the

parent

Igor.Shmukler

09/13/2022, 2:13 AM

hello Could use help with documentation. Looking at https://github.com/authzed/authzed-node and trying to make sense of it. Where do i set the context?

v1.NewClient('somerandomkeyhere')

should take care of the shared secret. This is great. Where do i point my client to the server running SpiceDB? Either the examples do not have it, or I cannot find it. I got other questions as well. The documentation for NodeJS package is limited. Got my draft schema close enough that checks with

zed

are all working fine. Regular examples are pretty good. Now, I want to map the

zed permission check event:27 edit user:2

command to the NodeJS library and suddenly it turns out to be a little complicated.

Joey

09/13/2022, 2:14 AM

take a look at https://github.com/authzed/authzed-node/blob/main/src/v1.test.ts#L39

Igor.Shmukler

09/13/2022, 2:15 AM

thank you, @Joey

Igor.Shmukler

09/13/2022, 3:04 AM

i am still unable to get NodeJS client do what I need. zed is working. I call it as:

zed permission check event:27 read user:2

and it returns

true

. that is perfect for me. following the example @Joey recommended, I was able to initialize the client. I don't get error, yet it is not working like

zed

. my code:

const eventRef = v1.ObjectReference.create({
        objectType: 'event',
        objectId: `${id}`
      });
      const userRef = v1.ObjectReference.create({
        objectType: 'user',
        objectId: `${userId}`
      });
      const checkPermissionRequest = v1.CheckPermissionRequest.create({
        resource: eventRef,
        permission: 'read',
        subject: v1.SubjectReference.create({
          object: userRef
        })
      });
      spiceDBclient.checkPermission(checkPermissionRequest, (err, response) => {
        console.log('response:', response);
        console.error(err);
      });

The respond I am getting is not a

true

false

. It reads like:

{ permissionship: 2, checkedAt: { token: 'GgQKAjMx' } }

What am I doing wrong? What is the correct what of getting what I need?

Joey

09/13/2022, 3:06 AM

expect(checkResponse?.permissionship).toBe(
          CheckPermissionResponse_Permissionship.HAS_PERMISSION
        );

Joey

09/13/2022, 3:07 AM

you need to compare the

.permissionship

of the response to

CheckPermissionResponse_Permissionship.HAS_PERMISSION

user

09/13/2022, 12:29 PM

Hi, I am looking for .Net client to use authzed? Do we have support for .net apps?

vroldanbet

09/13/2022, 12:32 PM

There are 2 community-mantained clients for C# and F#: https://github.com/authzed/awesome-spicedb

user

09/13/2022, 12:43 PM

thank you :)