spicedb
- n
nvnsdrdy
09/22/2022, 8:55 PMno multiple tags for docs are allowed - j
Joey
09/22/2022, 8:55 PMsorry; I meant: is the check per tag, for a specific document - j
Joey
09/22/2022, 8:55 PMor is per tag, for any document - n
nvnsdrdy
09/22/2022, 8:57 PMactually, missed one thing here.. 2 things here.. people who add tags to docs and other piece is client looking up using tag, document to see if they can access the doc - j
Joey
09/22/2022, 8:57 PMright, but is it the ability to add any tag to any doc? or any tag to a specific doc? or a specific tag to any doc? etc etc - n
nvnsdrdy
09/22/2022, 8:58 PMany tag to any doc - j
Joey
09/22/2022, 8:58 PMand how will that permission be granted? on an organization level? globally? - n
nvnsdrdy
09/22/2022, 8:59 PMteam/group level which will sit under org - j
Joey
09/22/2022, 9:00 PMdefinition organization { relation tagger: user permission can_tag = tagger } definition document { relation org: organization permission can_tag = org->can_tag } - j
Joey
09/22/2022, 9:00 PMthis would be adocument -> organization - j
Joey
09/22/2022, 9:00 PMyou could also grant the permission to any member of teams - n
nvnsdrdy
09/22/2022, 9:01 PMone thing i am not getting around is do i store tags in spicedb or just if they can add tags or not? - j
Joey
09/22/2022, 9:02 PMnot unless you need them for a permission check - j
Joey
09/22/2022, 9:02 PMyou can, but if you don't use them, no reason to store them - i
Inbreakable
09/23/2022, 6:39 AMIs there a way to define the depth an expand call will traverse? Or is it always just 1 level? - v
vroldanbet
09/23/2022, 1:27 PMnot sure, but depending on what you are trying to achieve, maybe the new lookupsubjects API is what you need? - v
vroldanbet
09/23/2022, 1:27 PM@Joey for clarification ☝️ - j
Joey
09/23/2022, 2:37 PMYep; expand is always 1 level and LS will recurse fully - i
Inbreakable
09/23/2022, 5:17 PMAnother question. I see in the examples most connect to the db with ssl disabled. Do you have an example using certs? - g
gwb
09/23/2022, 9:16 PMi'm running spicedb in a docker container, and was able to write the schema with zed. when i try to connect to it on 50051 from another container using the python libraries and the basic code in the first app tutorial, i get: "tls: first record does not look like a TLS handshake". i searched through past messages, and didn't see a situation that matched close enough. any suggestions? - j
Joey
09/23/2022, 9:22 PMyou need to mark the connection as insecure: https://github.com/authzed/authzed-py/blob/main/tests/v1_test.py#L31 - j
Joey
09/23/2022, 9:22 PM(unless you have TLS setup) - j
Joey
09/23/2022, 9:23 PMdepends on the kind of database - i
Inbreakable
09/23/2022, 9:24 PMI am using cockroachdb. Didn't see any setting to setup certs for spicedb db connection - g
gwb
09/23/2022, 9:25 PMah, i presumed it ran on TLS. thanks, i'll try this. ultimately, i'll have to figure out how to turn on tls - j
Joey
09/23/2022, 9:26 PMis it a local CRDB or a remote one? - i
Inbreakable
09/23/2022, 9:29 PMIt's in a local cluster different namespace but same cluster as spicedb - j
Joey
09/23/2022, 9:38 PMadd the following to your connection string:?sslmode=verify-ca&sslrootcert=/path/to/server-ca.pem - i
Igor.Shmukler
09/23/2022, 10:38 PMis anyone working on the permissions tree parsing piece for the official NodeJS SDK? - g
gwb
09/23/2022, 11:31 PMi have spicedb running in a container and can connect from another container with:
but if i try to connect to the grpc endpoint via python:curl -H "Authorization: Bearer mytoken" -X POST spicedb:50052/v1/schema/read
it says:Python client = Client( "spicedb:50051", insecure_bearer_token_credentials("mytoken"), )
.Endpoint is neither UDS or TCP loopback address